3

We currently have several locations where we have Point to Point T1s setup in a star fashion and since they're very low traffic and do not require the sort of high level of availability T1s provide, we want to switch some to VPN. I wish to be able to setup the VPNs in such a way as from the other routers' perspectives everything is the same, so I don't have to reconfigure locations which are just fine with the T1s.

Each location has a Point to Point T1 to central and a cable or DSL connection for all Internet traffic. All of the routers are Cisco 2801 and have VWIX T1 cards and are setup thusly:

The interfaces on either side have 192.168.[location].1 and 192.168.[location].2 for the Point to Point themselves. However the actual networks are 10.[location].x.x. Here's an outlying location and the central location:

[ Outside #5 ]

controller T1 0/1/0
 framing esf
 linecode b8zs
 channel-group 0 timeslots 1-24

interface FastEthernet0/0
 description $$$LAN CONNECTION$$$
 ip address 10.5.0.1 255.255.0.0
 ip nat inside
 duplex auto
 speed auto

interface FastEthernet0/1
 ip address [IP for ISP] 255.255.255.224
 ip access-group 102 out
 ip nat outside
 duplex auto
 speed auto

interface Serial0/1/0:0
 description $$$CONNECTION TO DOWNTOWN$$$
 ip address 192.168.5.2 255.255.255.252

ip route 0.0.0.0 0.0.0.0 [IP for ISP]
ip route 10.1.0.0 255.255.0.0 192.168.5.1
ip route 10.2.0.0 255.255.0.0 192.168.5.1
...
ip route 10.6.0.0 255.255.0.0 192.168.5.1
ip route 192.168.1.0 255.255.255.252 192.168.5.1
ip route 192.168.2.0 255.255.255.252 192.168.5.1
...
ip route 192.168.6.0 255.255.255.252 192.168.5.1

[ Central Location ]

controller T1 0/1/0
 framing esf
 clock source internal
 linecode b8zs
 channel-group 0 timeslots 1-24

controller T1 0/1/1
...
controller T1 0/2/0
...
controller T1 0/3/0
...

interface FastEthernet0/0
 description $$$LAN CONNECTION$$$
 ip address 10.1.1.1 255.255.0.0
 ip access-group 101 in
 ip nat inside
 speed 100
 full-duplex

interface FastEthernet0/1
 description $$$CONNECTION TO GATEWAY ROUTER$$$
 ip address 172.16.2.2 255.255.255.252
 ip nat outside
 speed 100
 full-duplex

interface Serial0/1/0:0
 description $$$CONNECTION TO LOCATION 1$$$
 ip address 192.168.1.1 255.255.255.252

interface Serial0/1/1:0
 description $$$CONNECTION TO LOCATION 2$$$
 ip address 192.168.2.1 255.255.255.252

...

ip classless
ip route 0.0.0.0 0.0.0.0 [gateway router sends to internet T1 or cable depending various things]
ip route 10.2.0.0 255.255.0.0 192.168.1.2
ip route 10.3.0.0 255.255.0.0 192.168.2.2
...
ip route 10.9.0.0 255.255.0.0 192.168.9.2

So, in what way could I setup the VPNs to where they function essentially the same as the T1s from a networking perspective (especially to other locations) where I do not have to renumber or do anything to locations which are fine? I should mention I've never setup a VPN on Cisco previously, I've only done this.

  • As long as you're other sites have routes to the other sites through the HQ statically or are running a dynamic routing protocol, then nothing will have to be changed on them. – codey Oct 11 '13 at 3:04
3

You can replace the T1 connections with site-to-site IPSEC VPN connections to the central location. This should not have to affect your current IP scheme.

I'm not sure if the 2801's you currently have support IPSEC (may depend on the image you're running) and if they're capable performance wise. Depending on the number of nodes connecting to the central location you may need something heavier on the central location.

  • You were correct, between each location and the central location I had to adjust the routes slightly, but other locations had no problems seeing the converted ones in the same manner, no changes needed. – simontemplar Oct 11 '13 at 10:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.