2

I'm new here. I am facing a problem in which I can't apply my Site to Site VPN successfully on Packet Tracer, and I'm really baffled. Tried to consult youtube and all but can't get it running.

Where have I gone wrong with the commands? This is the link to my packet tracer file: Version 2.pkt

HQ CONFIG:

crypto isakmp enable
crypto isakmp policy 1
authentication pre-share
encryption 3des
hash sha
group 2
exit
crypto isakmp key 0 address 200.0.0.9 0.0.0.0
crypto ipsec transform-set VPN-MAP esp-3des esp-sha-hmac 
ip access-list extended vpns2s
permit ip 192.168.3.0 0.0.0.255 192.168.1.0 0.0.0.255
exit
crypto map VPN-MAP 1 ipsec-isakmp
description VPN connection to BRANCH
match address vpns2s
set peer 200.0.0.9
set pfs group2
set transform-set VPN-MAP
exit
interface S0/0/0
crypto map VPN-MAP

BRANCH CONFIG:

crypto isakmp enable
crypto isakmp policy 1
authentication pre-share
encryption 3des
hash sha
group 2
exit
crypto isakmp key 0 address 200.0.0.1 0.0.0.0
crypto ipsec transform-set VPN-MAP esp-3des esp-sha-hmac
ip access-list extended vpns2s
permit ip 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255
exit 
crypto map VPN-MAP 10 ipsec-isakmp
description VPN connection to HQ
match address vpns2s
set peer 200.0.0.1
set pfs group2
set transform-set VPN-MAP
exit
interface S0/0/1
crypto map VPN-MAP

After applying the commands it apparently doesn't work..

6
  • 1
    "it doesn't work" doesn't tell us much. What do you observe? What do logs tell you? What debugging commands have you tried?
    – Teun Vink
    Feb 16 '16 at 12:24
  • If your site-to-site means HQ-to-Branch, there seem to be two problems: 1) for some reason the peers are interfaces of ISP, not those of HQ and Branch; 2) the ACL-s should be "swapped" ( "permit ip 192.168.3.0 0.0.0.255 192.168.1.0 0.0.0.255" on HQ side and "permit ip 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255" on Branch)
    – Muti Onu
    Feb 16 '16 at 13:40
  • Sorry, vice versa: "permit ip 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255" in HQ and "permit ip 192.168.3.0 0.0.0.255 192.168.1.0 0.0.0.255" on Branch
    – Muti Onu
    Feb 16 '16 at 13:49
  • Thanks, I realised my ACLs were backwards; this was a group work hence some of the config was weird. Also, I just learnt that for NAT, only extended-list ACLs will work, not basic; or am I wrong?
    – M.Shah
    Feb 19 '16 at 0:17
  • Can you please share the show isakmp SA & show isakmp ipsec SA output Feb 12 '17 at 7:02
2

You should assign an IP addresses to your serial interfaces. 200.0.0.1 and 200.0.0.9

Currently your routers have crypto-maps, which set up to look on each other by IP addresses, but this addresses actually not assigned to any router interfaces. On router 1 (HQ) enter in configuration mode:

interface S0/0/0 
 ip address 200.0.0.1 255.255.255.0 

And same on other router (branch):

interface S0/0/1
 ip address 200.0.0.9 255.255.255.0
2
  • Could you expand on your answer, it is lacking in details. Perhaps you could explain "why" and "how"?
    – jwbensley
    May 17 '17 at 11:02
  • Modified my answer May 18 '17 at 12:20
0

You need to remove the quad zero mask on the crypto isakmp key line.

Also, you may want to try and use dynamic crypto maps, just to see if your ACL's are backwards.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.