1

I want to build a gns3 site-to-site IPsec VPN between two CISCO routers. My question is, do I have to configure the clients behind each router in a specific way so that they will be aware of the tunnel? From what I understood in a site-to-site VPN I don't have to install any software on the end-devices, correct ?

Thanks

Adam

| improve this question | |
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin♦ Aug 15 '17 at 15:50
2

Yes that is correct, you do not need any software on the devices that communicate through the tunnel. Of course you need to make sure your routing is ok but that is usually not done on the hosts. And you may need to consider that a tunnel potentially decreases the path MTU, see e.g. this doc for an extensive explanation and potential issues.

| improve this answer | |
  • Thank you. Just to be sure. If I have two sites with a CISCO router at the edge of each network, and they have Public IP assigned to their corresponding WAN interfaces, IPsec is used to authenticate and encrypt everything that is exchange between this two sites, right ? Without IPsec VPN it would still work but all the packets would be transferred in clear, yes ? – cyzczy Dec 6 '16 at 10:46
  • @adam86: To be more precise: IPsec is used to authenticate and/or encrypt some or all of the traffic between the 2 sites (typically all, but it depends on how you configure it). Wether it would still work without IPsec VPN depends on whether you have routable IP addresses at the sites, or use NAT. – hertitu Dec 7 '16 at 20:28
  • hmm but is it possible to connect two sites if we don't have public IPs / NAT in place ? I don't think so, so I guess that network connectivity should be already in place between this two sites before thinking of applying IPsec VPN. – cyzczy Dec 8 '16 at 9:59
2

Your site-to-site tunnel will be transparent to the client devices. When the traffic hits each router from the 'inside' clients, it will be tagged as 'interesting traffic' against an access list and sent through the tunnel. There is no software or configuration requirements on the hosts. This is a great use case for two locations that do not have a direct leased line but need to share resources between each other.

For more information, see Cisco's configuration guide here

| improve this answer | |
  • Thank you. So in case of a site-to-site VPN/tunnel the encryption is handled purely on the router ? When you talk about ACLs I assume that one ACL will match packets from the internal network that should be sent to the remote site and encrypt this, and another ACL for standard Internet activity, without going through the tunnel right ? – cyzczy Dec 6 '16 at 15:34
  • The router will handle all encryption mechanisms and setting up and tearing down the connection. There should only be one access-list needed for a site to site configuration. See the section Creating Crypto Access Lists in the link I posted. – stets Dec 6 '16 at 16:00
  • The source and destination are specified, so that only traffic sourced from the local host/s and destined to the other 'side' are sent through the tunnel. – stets Dec 6 '16 at 16:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.