Site by using IPSec site

Similar Questions

• RV320 as SBS2011 router as DHCP server and use IPSEC

  p {margin-bottom: 0.25 cm; line-height: 120% ;}}

  Our society is really eager to acquire a VPN Cisco RV320 router to replace our old insecurity only PPTP VPN-router. Before actually buying the router, there are a few questions I'd like to have answered.

  In our current setup, we have a SBS2011 standard Server which is used as a DHCP, DNS, Exchange, and SMB server to our network of the company, all the peripheral functions within the same network (192.168.0.1/24).
  We would like to add the RV320 to our network to allow access of employees to the corporate network when they are at home or on the road using IPSEC VPN (client site).

  In our current configuration us use (or used) a VPN router and VPN clients allowed to acquire an IP address from the PPTP server, these IP addresses have fallen in a range that the DHCP SBS2011 server was free to distribute the. It's quite simple actually

  How can we configure the router RV320 so that there will be any conflict between the RV320 router and SBS2011 Server regarding distributing them IP addresses to the VPN IPSEC clients?

  Can configure us the RV320 to transfer earlier requests DHCP server SBS2011?  We want all customers (including IPSEC VPN clients so that they enter the same network).
  Is it possible to simply using the DHCP-relay option (in the web interface) and entering the IP address of the server SBS2011?

  We should disable the DHCP on the router-RV320, or is there another way to continue using the SBS2011 server as the DHCP server, while allowing client-to-site IPSEC VPN for access to our local network?

  Thanks in advance

  Hello and thanks for the exam Cisco for your network needs.

  First of all, I understand that you are used to working with the PPTP connection and now you want to switch to a more secure IPSec connection.

  It's a great idea, but there are a few things to consider:

  1. the RV320 supports the IPSec VPN via the Cisco VPN Client 5.0, you can download it from the site Web of Cisco if after you buy a contract for the router.

  The contract will set will cost about $70, depending on where you decide to buy it, but it has several features including 3 years of telephone support 24/7 and next day replacement guarantee for business if the unit doesn't respond, it also allows you to download special software like the Cisco VPN Client.

  2. for client VPN connection, you can not, or you need to try to relay the DHCP request what, whether the router will handle it and he will probably be on a different subnet from your local network, but it will you access to all devices on the network.

  3-If you do not want to buy the contract, then you can always use PPTP to the RV320 and it will give you the same access that you are already accustomed.

  I hope that was helpful, please let us know if you have any other questions.

• AnyConnect configuration using IPSec

  I have configured our ASA 8.4 (7) running for the client AnyConnect (using IPSec). It prompted me to create an identity certificate when you run the VPN Wizard, I did. We use AAA to authenticate, so I not create a CA. It must in any case for AnyConnect? When I try to connect from a client AnyConnect prédéployée, I get an error: "untrusted certificates VPN server. If I ignore and choose Connect in any case, the connection fails. What Miss me?

  Thank you

  In addition to VPN IPsec IKEv2, there is a bit of customer service that runs when you first connect. which is used to check the version of the package AnyConnect and distribute changes in the customer profile (and some more obscure things). 'S done it via SSL and that these uses of certificate of the ASA to validate the server. If your client does not trust the certificate, you will get the error.

  You can disable the service the customer by changing the default command:

  Crypto ikev2 activate out of service the customer port 443

  Just read

  Crypto ikev2 allow outside

  The best way is to enable and configure the ASA with an appropriate certificate of trust.

• PIX to PIX VPN using Ipsec Tunnel. Need help please.

  Hello everyone,

  I have a connection of two sites using 506th PIX and PIX 501. The one on the central site (WATBCINX1 - 506th PIX) sends the packet correctly and one on the remote site (CTXPOINX1 - PIX 501) receives (checked using icmp backtrace on the two PIX). The problem is that PIX 501 at remote site return packages. I have to say that the two PIX hace a 3com OfficeConnect ADSL router as gateway Internet 812. If someone could help me I would appreciate it a lot. Thank you!

  PIX 506th Configuration (central site):

  WATBCINX1 # sh conf

  : Saved

  : Written by enable_15 to the CEDT 08:36:50.090 Friday, June 20, 2003

  6.2 (2) version PIX

  ethernet0 nameif outside security0

  nameif ethernet1 inside the security100

  activate qU51Wrx8ggFHLusK encrypted password

  qU51Wrx8ggFHLusK encrypted passwd

  hostname WATBCINX1

  NEOKEM domain name. LAN

  clock timezone THATS 1

  clock to summer time CEDT recurring last Sun Mar 02:00 last Sun Oct 03:00

  fixup protocol ftp 21

  fixup protocol http 80

  fixup protocol h323 h225 1720

  fixup protocol h323 ras 1718-1719

  fixup protocol they 389

  fixup protocol rsh 514

  fixup protocol rtsp 554

  fixup protocol smtp 25

  fixup protocol sqlnet 1521

  fixup protocol sip 5060

  fixup protocol 2000 skinny

  no names

  name 80.37.246.195 POLINYÀ

  access-list outside_access_in allow accord any host 10.0.0.10

  outside_access_in list access permit tcp any host 10.0.0.10 eq 1723

  outside_access_in list access permit tcp any host 10.0.0.10 eq smtp

  outside_access_in list access permit tcp any host 10.0.0.10 eq pop3

  access-list outside_access_in allow icmp a whole

  inside_access_in ip access list allow a whole

  access-list inside_access_in allow a tcp

  access-list inside_access_in allow icmp a whole

  Allow Access-list inside_access_in a whole udp

  access-list 101 permit ip 192.168.0.0 255.255.255.0 192.168.11.0 255.255.255.0

  pager lines 24

  opening of session

  interface ethernet0 10full

  interface ethernet1 10full

  Outside 1500 MTU

  Within 1500 MTU

  outdoor IP 10.0.0.3 255.0.0.0

  IP address inside 192.168.0.1 255.255.255.0

  alarm action IP verification of information

  alarm action attack IP audit

  location of PDM 192.168.0.100 255.255.255.255 inside

  location of PDM 192.168.0.0 255.255.0.0 inside

  location of PDM 192.168.0.128 255.255.255.255 inside

  location of PDM 192.168.0.135 255.255.255.255 inside

  location of PDM 192.168.11.0 255.255.255.0 outside

  location of PDM 192.168.11.0 255.255.255.0 inside

  location of PDM 80.37.246.195 255.255.255.255 outside

  location of PDM 192.168.0.254 255.255.255.255 outside

  PDM 100 debug logging

  history of PDM activate

  ARP timeout 14400

  Global 1 interface (outside)

  (Inside) NAT 0-list of access 101

  NAT (inside) 1 0.0.0.0 0.0.0.0 0 0

  static (inside, outside) 10.0.0.10 192.168.0.100 netmask 255.255.255.255 0 0

  Access-group outside_access_in in interface outside

  inside_access_in access to the interface inside group

  Route outside 0.0.0.0 0.0.0.0 10.0.0.2 1

  Timeout xlate 0:05:00

  Conn Timeout 0:00:00 half closed 0: 10:00 udp 0:02:00 CPP 0: h323 from 10:00 0: 05:00 sip 0:30:00

  sip_media 0:02:00

  Timeout, uauth 0:00:00 absolute

  GANYMEDE + Protocol Ganymede + AAA-server

  RADIUS Protocol RADIUS AAA server

  AAA-server local LOCAL Protocol

  authenticate the NTP

  NTP server 192.43.244.18 source outdoors

  NTP server 128.118.25.3 prefer external source

  Enable http server

  http 192.168.0.100 255.255.255.255 inside

  http 192.168.0.128 255.255.255.255 inside

  http 192.168.0.135 255.255.255.255 inside

  http 192.168.11.0 255.255.255.0 inside

  No snmp server location

  No snmp Server contact

  SNMP-Server Community public

  No trap to activate snmp Server

  enable floodguard

  Permitted connection ipsec sysopt

  No sysopt route dnat

  Crypto ipsec transform-set esp - esp-md5-hmac COMUN_BCN

  Polinyà 1 ipsec-isakmp crypto map

  correspondence address 1 card crypto Polinyà 101

  card crypto Polinyà 1 set peer 80.37.246.195

  card crypto Polinyà 1 the transform-set COMUN_BCN value

  interface to crypto map outdoors Polinyà

  ISAKMP allows outside

  ISAKMP key * address 80.37.246.195 netmask 255.255.255.255

  ISAKMP identity address

  part of pre authentication ISAKMP policy 1

  of ISAKMP policy 1 encryption

  ISAKMP policy 1 md5 hash

  1 1 ISAKMP policy group

  ISAKMP policy 1 lifetime 1000

  Telnet 192.168.0.128 255.255.255.255 inside

  Telnet 192.168.0.135 255.255.255.255 inside

  Telnet 192.168.11.0 255.255.255.0 inside

  Telnet timeout 10

  SSH timeout 5

  username password QSECOFR privilege ELFfg8t/K5UMO89z encrypted 15

  Terminal width 80

  Cryptochecksum:74cd0cf16ef2c35804dffaeee924efdf

  WATBCINX1 #.

  PIX 501 Setup (remote site):

  CTXPOINX1 # sh conf

  : Saved

  : Written by enable_15 to the CEDT 09:27:14.439 Friday, June 20, 2003

  6.2 (2) version PIX

  ethernet0 nameif outside security0

  nameif ethernet1 inside the security100

  activate qU51Wrx8ggFHLusK encrypted password

  qU51Wrx8ggFHLusK encrypted passwd

  hostname CTXPOINX1

  NEOKEM domain name. LAN

  clock timezone THATS 1

  clock to summer time CEDT recurring last Sun Mar 02:00 last Sun Oct 03:00

  fixup protocol ftp 21

  fixup protocol http 80

  fixup protocol h323 h225 1720

  fixup protocol h323 ras 1718-1719

  fixup protocol they 389

  fixup protocol rsh 514

  fixup protocol rtsp 554

  fixup protocol smtp 25

  fixup protocol sqlnet 1521

  fixup protocol sip 5060

  fixup protocol 2000 skinny

  no names

  name 80.32.132.188 BCN

  access-list inside_access_in allow a tcp

  Allow Access-list inside_access_in a whole udp

  access-list inside_access_in allow icmp a whole

  inside_access_in ip access list allow a whole

  access-list outside_access_in allow icmp a whole

  access-list 101 permit ip 192.168.11.0 255.255.255.0 192.168.0.0 255.255.255.0

  pager lines 24

  opening of session

  interface ethernet0 10baset

  interface ethernet1 10full

  Outside 1500 MTU

  Within 1500 MTU

  IP 10.0.0.1 address outside 255.0.0.0

  IP address inside 192.168.11.2 255.255.255.0

  alarm action IP verification of information

  alarm action attack IP audit

  location of PDM 192.168.0.0 255.255.0.0 inside

  location of PDM 192.168.11.0 255.255.255.255 inside

  PDM 100 debug logging

  history of PDM activate

  ARP timeout 14400

  Global 1 interface (outside)

  (Inside) NAT 0-list of access 101

  NAT (inside) 1 0.0.0.0 0.0.0.0 0 0

  Access-group outside_access_in in interface outside

  inside_access_in access to the interface inside group

  Route outside 0.0.0.0 0.0.0.0 10.0.0.2 1

  Timeout xlate 0:05:00

  Conn Timeout 0:00:00 half closed 0: 10:00 udp 0:02:00 CPP 0: h323 from 10:00 0: 05:00 sip 0:30:00

  sip_media 0:02:00

  Timeout, uauth 0:00:00 absolute

  GANYMEDE + Protocol Ganymede + AAA-server

  RADIUS Protocol RADIUS AAA server

  AAA-server local LOCAL Protocol

  authenticate the NTP

  NTP server 192.5.41.209 prefer external source

  Enable http server

  HTTP 80.32.132.188 255.255.255.255 outside

  http 192.168.0.0 255.255.0.0 inside

  http 192.168.11.0 255.255.255.255 inside

  No snmp server location

  No snmp Server contact

  SNMP-Server Community public

  No trap to activate snmp Server

  enable floodguard

  Permitted connection ipsec sysopt

  No sysopt route dnat

  Crypto ipsec transform-set esp - esp-md5-hmac COMUN

  BCN 1 ipsec-isakmp crypto map

  card crypto bcn 1 set peer 80.32.132.188

  card crypto bcn 1 the transform-set COMMON value

  bcn outside crypto map interface

  ISAKMP allows outside

  ISAKMP key * address 80.32.132.188 netmask 255.255.255.255

  ISAKMP identity address

  part of pre authentication ISAKMP policy 1

  of ISAKMP policy 1 encryption

  ISAKMP policy 1 md5 hash

  1 1 ISAKMP policy group

  ISAKMP policy 1 lifetime 1000

  Telnet 80.32.132.188 255.255.255.255 outside

  Telnet 192.168.0.0 255.255.0.0 inside

  Telnet timeout 10

  SSH timeout 5

  username password QSECOFR privilege ELFfg8t/K5UMO89z encrypted 15

  Terminal width 80

  Cryptochecksum:dc8d08655d07886b74d867228e84f70f

  CTXPOINX1 #.

  Hello

  You left out of your config VPN 501 correspondence address... put this in...

  correspondence address 1 card crypto bcn 101

  Hope that helps...

• 3.5.1 to 506th Pix VPN Client using IPsec over TCP

  Is it possible to do when there is a device in the path of the VPN tunnel that will make the static NAT?

  The reason is that the external interface of the Pix will have a private address, and it is the endpoint of the tunnel. The performance of NAT device has a public address, who thinks that the VPN client is the end of the tunnel, the static NAT will result the incoming packets on port UDP 500 for a destination of the Pix.

  Thank you.

  The Pix can not do TCP encapsulation. He can do UDP encapsulation.

  You can create IPSec tunnels to the external of the Pix even if address he addresses NATted provided that it is NOT of PAT and NAT.

• Misconfigured remote VPN server by using IPSEC client

  I'm trying to figure out what I did wrong in my setup.  The environment is:

  ASA 5505 running 8.2 with 6.2 ASDM.

  Version of the VPN Client 5.0.05.0290

  I installed VPN ipsec clients both anyconnect and connected successfully to the remote access VPN server. However, the client doesn't show any returned package.  Thinking that I have badly configured, I have reset to the default value of the factory and began again.  Now I only have the configured ipsec vpn and I have exactly the same symptoms.  I followed the instructions to configure the ipsec vpn in Document 68795 and double-checked my setup and I don't know what I did wrong.  Because I can connect to the internet from inside network and I can connect to the VPN from outside of the network (and the ASDM Watch monitor an active connection with nothing sent to the client) I believe this is a road or an access rule preventing communication but I can't quite figure out where (and I tried the static routes to the ISP and a wide variety of access rules before rinsing to start) above).

  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  WebVPN
  internal group vogon strategy
  attributes of vogon group policy
  Protocol-tunnel-VPN IPSec
  Split-tunnel-policy tunnelspecified
  value of Split-tunnel-network-list vogon_splitTunnelAcl
  username password privilege encrypted 0987654321 zaphod 15
  username password encrypted AaBbCcDdEeFf privilege 0 arthur
  username arthur attributes
  VPN-group-policy vogon
  tunnel-group vogon type remote access
  tunnel-group vogon General attributes
  address pool VPN_Pool
  strategy-group-by default vogon
  tunnel-group vogon ipsec-attributes
  pre-shared-key *.
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  inspect the rtsp
  inspect esmtp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  inspect xdmcp
  inspect the sip
  inspect the netbios
  inspect the tftp
  !
  global service-policy global_policy
  context of prompt hostname
  Cryptochecksum:xxxxxxxxxxxxxxxxxxxxxx
  

  Looks like a typo for the Pool of IP subnet mask.

  You currently have:

  mask 10.92.66.10 - 10.92.66.24 255.255.0.0 IP local pool VPN_Pool

  It should be:

  mask 10.92.66.10 - 10.92.66.24 255.255.255.0 IP local pool VPN_Pool

  Please kindly change the foregoing and test, if it still does not work, please please add the following:

  management-access inside

  Policy-map global_policy
  class inspection_default

  inspect the icmp

  Then try to VPN in and see if you can ping 10.92.65.1 and let us know if this ping works.

  Please also share the output of: "cry ipsec to show his" after the trial, if it does not work.

• VPN site to Site using the router and ASA

  Hello

  I have a Cisco 1812 router that is configured for remote access VPN using IPSec (Cisco VPN Client), my question is if I can configure a Cisco ASA 5505 to connect to the router as a VPN from site to site.

  Thank you

  Karl

  Dear Karl,

  Yor are right, in this case you can create a tunnel vpn site-to-site between devices or you can configure your ASA as hardware VPN client. That is to say; Easy VPN.

  For the same thing, you can consult the document below.

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a00808a61f4.shtml

  Kind regards

  Shijo.

• site noncisco routers with IPSec VPN

  Hello

  I try to connect Router 2911 cisco routers noncisco (HP, TPlink) using ipsec site to site vpn with crypto-cards.

  the problem is that vpn ensuring shows '#send error' if command "crypto isakmp identity dn" is used (we use it for authentication of certificate based for cisco vpn clients). When I remove the command, vpn works great with noncisco devices.

  Please can you advice if there is no option on cisco ios to fix the problem.

  Thank you

  Giga

  good,

  try to use the isakmp profile something like below:

  crypto isakmp profile test
  function identity address 1.1.1.1 255.255.255.255

  under card crypto profiles isakmp as below:

  test 1 test ipsec-isakmp crypto map

  -Altaf

• Site to site VPN question: passing a public IP with IPSEC

  Hi all

  I need to create a VPN tunnel site to site using IPSEC between two offices on the Internet. The offices belong to two different companies.

  They gave me a series of 16 public IP addresses. One of these IP addresses is used on the ISP router and this is the next hop for my router. Another IP in the range is used on my router? s external interface (which is a Cisco 851) and he is also my site VPN endpoint. So far so good...

  Here's my problem: the IP source of encrypted traffic, is a public address from within the IPs public 16 I (not the one on my router interface). The actual application that needs to send the encrypted data is a server in my local network, and it has a private IP address. The other site, expects to receive data, however, the public IP address. I used NAT between the private IP address of the server and its public IP address, but no data goes through the tunnel. Moreover, the tunnel between the two end points established without problem. The problem is that the source of my encrypted data is the public IP address and I don't know how to get through the tunnel. I enclose my router configuration.

  Any help is appreciated.

  The access list "natted-traffic" should say:

  extended traffic natted IP access list

  deny ip host 192.168.0.160 BB. ABM ABM BD

  deny ip host 192.168.0.160 BB. ABM BB.BE

  output

  I hope this helps.

  -Kanishka

• Star redirect speaks IPSEC traffic on hub site

  I'm sure it can be done. I have Cisco PIX appliances in a few branches as well as a main to the central PIX firewall. I'm all talk to each other via IPSEC tunnels. I would like to direct all IP traffic from the branches to go through the IPSEC tunnels and on the Internet from Headquarters. Basically Disable tunneling split at all locations and force traffic into the main office using IPSEC tunnels and road back to the Internet. I hope this makes sense and I'm not sure how the routing part will work. Could someone please help me understand this part.

  Thank you.

  This is possible on the v7, not v6.x.

  Take a look on this cisco doc:

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a00804675ac.shtml#diag

• Site talk multihomed won't neighborships EIGRP on both lines

  Hi all

  This problem has been stripping my cabbage for about a week now. I have a lot of sites spoke on the seat. We have two routers in hub acting as primary and backup for all sites, a 13Mb SDSL and a 2 MB SDSL respectively. Exclusively use the GRE and IPSEC tunnels on (most) tunnels. All websites spoke (except one) are connecting using the standard ADSL.

  I have a site that has a very bad connection to improve things for them, I try to use two ADSL connections and balance their.

  To keep things simple, I try only to enable connections to our main router at this time and I do not use IPSEC, but either.

  Here is the problem.

  I get only a close relationship, forming a tunnel at the same time. If I stopped this tunnel, the other neighbor is shaping up and I can re - turn on the first tunnel, but it will not form a new neighbourhood.

  The info that tells me more about what goes wrong is the following:

  SH ip strategy nei

  Neighbors of the EIGRP intellectual property for process 6001

  H address Interface Hold Uptime SRTT RTO Q Seq

  (s) (ms) NTC Num

  1 172.20.64.1 Tu0 13 00:00:01 1 2000 2-0

  0 172.20.65.1 Tu2 11 18:41:07 55 390 0 752649

  The number of queue for the tunnel where the neighborhood is trying to shape and fault is always 2. No Hellos are received at the end. Hellos are received from the other end and, in fact, the neighborhood to do, but then it gets expired after receipt without Hellos. OTN goes to 5000 and then after the retry timer is sinking, the relationship fell, a new Hello is received and the relationship is recalculated. This causes my hell EIGRP as you can imagine.

  Ive applied lists to distribute to the tunnels and tried to use static routes. I also tried statically assigning the neighbors with the neighbor command. No dice.

  The two ADSL connections have the same IP next - hop to the ISP. This would prevent neighbors forming?

  I downloaded the relevant parts of the config and the routing table also the router (cleaned). For completeness, Ive included all distribution-list commands that Ive tried but Ive used in combination and all together, as well as without them at all.

  Your help will be greatly appreciated.

  Your slow-going-mad network administrator,

  Paul

  Paul,

  When you add these commands to key tunnel , could you at least check that the tunnels will work, i.e. were you able to ping to the opposite tunnel address?

  I don't think that you can debug the EIGRP queue directly. You can debug are packages individual EIGRP, i.e. broadcasts of update, Ack, request, response, and EIGRP. It would be eigrp packets laconic retry to debug

  If you're ready to make debugging more involved, I would suggest creating an ACL extended with entries of the corresponding permit GRE traffic between your router and the router of the headquarters in a sense is and EIGRP traffic on this tunnel and execution to debug the package ip N where N is the number of this ACL. Please note that if these GRE tunnels are currently all traffic beyond EIGRP, this debugging is not recommended because there is a LOT of output.

  I wonder... is - this by all possible means that some of the addresses of the tunnel endpoint (i.e. tunnel source and tunnel destination) are advertised to EIGRP through these tunnels? This would cause a recursive routing entry, enough like the beat you are currently experiencing. How is the accessibility of endpoints tunnel completed in your routing table - is it via a default route? In order to foolproofness, I suggest you add static/32 routes for both routers (talks and head of bed) that contains the IP address of endpoint opposite tunnel, via the appropriate next hop.

  Strange problem indeed!

  Best regards

  Peter

• VPN clients cannot access remote sites - PIX, routing problem?

  I have a problem with routing to remote from our company websites when users connect via their VPN client remotely (i.e. for home workers)

  Our headquarters contains a PIX 515E firewall. A number of remote sites to connect (via ADSL) to head office using IPSEC tunnels, ending the PIX.

  Behind the PIX is a router 7206 with connections to the seat of LANs and connections to a number of ISDN connected remote sites. The default route on 7206 points to the PIX from traffic firewall which sits to ADSL connected remote sites through the PIX. Internal traffic for LAN and ISDN connected sites is done via the 7206.

  Very good and works very well.

  When a user connects remotely using their VPN client (connection is interrupted on the PIX) so that they get an IP address from the pool configured on the PIX and they can access resources located on local networks to the office with no problems.

  However, the problem arises when a remote user wants access to a server located in one of the remote sites ADSL connected - it is impossible to access all these sites.

  On the remote site routers, I configured the access lists to allow access from the pool of IP addresses used by the PIX. But it made no difference. I think that the problem may be the routes configured on the PIX itself, but I don't know what is necessary to solve this problem.

  Does anyone have suggestions on what needs to be done to allow access to remote sites for users connected remotely via VPN?

  (Note: I suggested a workaround, users can use a server on LAN headquarters as a "jump point" to connect to remote servers from there)

  with pix v6, no traffic is allowed to redirect to the same interface.

  for example, a remote user initiates an rdp session for one of the barns adsl. PIX decrypts the packet coming from the external interface and looks at the destination. because the destination is one of adsl sites, pix will have to return traffic to the external interface. Unfortunately, pix v6.x has a limitation that would force the pix to drop the packet.

  with the v7, this restriction has been removed with the "same-security-traffic control intra-interface permits".

  http://www.Cisco.com/en/us/partner/products/HW/vpndevc/ps2030/products_configuration_example09186a008046f307.shtml

• Pass UDP from a site through the vpn

  I have an IPsec tunnel from site to site on the Wan to an 1841 to a 2811 router. I need a udp port for the other side, but he is not. I have the ip Protocol to the front and tried to support ip, but it does not work. I should have support on the LAN or WAN interface address? I have a phone to switch on the LAN of each subnet tries to communicate with each other.

  Hello Eric,

  Is your UDP unicast or multicast traffic? If it is multicast it won't work until you replace the IPSec by GRE tunnel encapsulation. You can still add security using IPSec profile on this tunnel.

  Good luck.

• Site to Site VPN links

  Hi guys, I am currently configuring a VPN connection between 2 sites, I replaced a few cryptographic cards with ipsec tunnel interfaces instead.   However I do not know what configuration lines are always required following is excerpts from the configuration, both sites have similar configurations but the documentation I found does not show the use of the online political isakmp crypto, but when I remove it the link is unable to implement.

  crypto isakmp policy 3 encr 3des hash md5  authentication pre-sharegroup 2 lifetime 20000!!crypto isakmp key keygoeshere address xxx.xxx.xxx.xxxcrypto ipsec transform-set ESP-3DES-SHA1 esp-3des esp-sha-hmac !crypto ipsec profile Site-to-Siteset transform-set ESP-3DES-SHA1 !!interface Tunnel0 description --- Connection to WA --- ip address 192.168.250.1 255.255.255.252 tunnel source Dialer1 tunnel destination xxx.xxx.xxx.xxx tunnel mode ipsec ipv4 tunnel path-mtu-discovery tunnel protection ipsec profile Site-to-Site!router rip version 2 passive-interface Vlan1 network 192.168.1.0 network 192.168.250.0!

  Andrew,

  If you plan to use IPsec as the VPN Protocol, you cannot remove the crypto isakmp policy (because it is used for negotiation of phase 1 between VPN endpoints).

  You use IPsec profiles, it's because you are establishing VTI or GRE VPN tunnels?

  Of VPN are what type you trying to set up?

  Federico.

• 2 one-Site VPN Cisco 2801 and with crossing NAT

  Hi guys,.

  I would like to configure two Cisco 2801 using IPSEC/IKE. Both routers are connected to the internet through DSL lines. The DSL line have RFC1918 address side LAN where routers connected to the internet face. I can do NAT on DSL modems.

  Cisco IOS 2801 routers allow to configure site-2-site VPN with NAT crossing?

  Here is a model of physics/IP configuration:

  LAN<->2801 Modem DSL<-Internet->DSL modem<-Priv ip-=""> 2801<-Priv ip-=""><-> LAN

  Thank you

  Gonçalo

  Yes, you're good to go only if one or both of the sites has an IP address which is natted with private IP address statically. The implementation of IPSec on SRI NAT support in most crosses so that shouldn't be a concern