2

I'm new here. I am facing a problem in which I can't apply my Site to Site VPN successfully on Packet Tracer, and I'm really baffled. Tried to consult youtube and all but can't get it running.

Where have I gone wrong with the commands? This is the link to my packet tracer file: Version 2.pkt

HQ CONFIG:

crypto isakmp enable
crypto isakmp policy 1
authentication pre-share
encryption 3des
hash sha
group 2
exit
crypto isakmp key 0 address 200.0.0.9 0.0.0.0
crypto ipsec transform-set VPN-MAP esp-3des esp-sha-hmac 
ip access-list extended vpns2s
permit ip 192.168.3.0 0.0.0.255 192.168.1.0 0.0.0.255
exit
crypto map VPN-MAP 1 ipsec-isakmp
description VPN connection to BRANCH
match address vpns2s
set peer 200.0.0.9
set pfs group2
set transform-set VPN-MAP
exit
interface S0/0/0
crypto map VPN-MAP

BRANCH CONFIG:

crypto isakmp enable
crypto isakmp policy 1
authentication pre-share
encryption 3des
hash sha
group 2
exit
crypto isakmp key 0 address 200.0.0.1 0.0.0.0
crypto ipsec transform-set VPN-MAP esp-3des esp-sha-hmac
ip access-list extended vpns2s
permit ip 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255
exit 
crypto map VPN-MAP 10 ipsec-isakmp
description VPN connection to HQ
match address vpns2s
set peer 200.0.0.1
set pfs group2
set transform-set VPN-MAP
exit
interface S0/0/1
crypto map VPN-MAP

After applying the commands it apparently doesn't work..

Improve this question
6
  • 1
    "it doesn't work" doesn't tell us much. What do you observe? What do logs tell you? What debugging commands have you tried?
    – Teun Vink ♦
    Feb 16, 2016 at 12:24
  • If your site-to-site means HQ-to-Branch, there seem to be two problems: 1) for some reason the peers are interfaces of ISP, not those of HQ and Branch; 2) the ACL-s should be "swapped" ( "permit ip 192.168.3.0 0.0.0.255 192.168.1.0 0.0.0.255" on HQ side and "permit ip 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255" on Branch)
    – Muti Onu
    Feb 16, 2016 at 13:40
  • Sorry, vice versa: "permit ip 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255" in HQ and "permit ip 192.168.3.0 0.0.0.255 192.168.1.0 0.0.0.255" on Branch
    – Muti Onu
    Feb 16, 2016 at 13:49
  • Thanks, I realised my ACLs were backwards; this was a group work hence some of the config was weird. Also, I just learnt that for NAT, only extended-list ACLs will work, not basic; or am I wrong?
    – M.Shah
    Feb 19, 2016 at 0:17
  • Can you please share the show isakmp SA & show isakmp ipsec SA output
    – shailendra harinkhede
    Feb 12, 2017 at 7:02

2 Answers 2

Reset to default
2

You should assign an IP addresses to your serial interfaces. 200.0.0.1 and 200.0.0.9

Currently your routers have crypto-maps, which set up to look on each other by IP addresses, but this addresses actually not assigned to any router interfaces. On router 1 (HQ) enter in configuration mode: 

interface S0/0/0 
 ip address 200.0.0.1 255.255.255.0

And same on other router (branch): 

interface S0/0/1
 ip address 200.0.0.9 255.255.255.0
Improve this answer
2
  • Could you expand on your answer, it is lacking in details. Perhaps you could explain "why" and "how"?
    – Baldrick
    May 17, 2017 at 11:02
  • Modified my answer
    – Andrey Prokhorov
    May 18, 2017 at 12:20
0

You need to remove the quad zero mask on the crypto isakmp key line.

Also, you may want to try and use dynamic crypto maps, just to see if your ACL's are backwards.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.