1

I have this setup configured where an IPSEC tunnel is established between 10.15.10.2(ROUTER) and 10.16.70.2(LINUX machine) . Now I want pass traffic through the same tunnel from two more diffrent network ip's. So for that, i have created 3 VLAN interfaces so that will make Feth1 as trunk mode but i was not able to use switchport command on that interface. What other solution I can look for? Router Device-Cisco 1800

Set up diagram

Router COnfigurations
----------------------------
Building configuration...

Current configuration : 7269 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname SYSTEM74
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 warnings
!
no aaa new-model
clock timezone IST 5 30
!
crypto pki trustpoint TP-self-signed-3437774698
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-3437774698
 revocation-check none
 rsakeypair TP-self-signed-3437774698
!
!
crypto pki certificate chain TP-self-signed-3437774698
 certificate self-signed 01
  30820255 308201BE A0030201 02020101 300D0609 2A864886 F70D0101 04050030
  31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
  69666963 6174652D 33343337 37373436 3938301E 170D3130 30323035 31323433
  31375A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
  4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D33 34333737
  37343639 3830819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
  81009569 6E1C913C A3678C3D 946ABFC9 51E4684F E0B528EC 8EACCF2D F17E99A9
  8BBE38C3 A9802B37 5DB22C30 36CBA715 2B342327 27C69124 8249C9B3 1D7A92E4
  BC59516B F1F7DCAF CBA322E0 E82E84AB 073ABAAB 0B4DA09D FA11B2E6 CC348931
  D0AC0ACC 2013BBF0 D6F51103 842EFD95 9161CC53 59AC40D4 2BDA2BC3 FF3D5C7F
  56C50203 010001A3 7D307B30 0F060355 1D130101 FF040530 030101FF 30280603
  551D1104 21301F82 1D535953 54454D37 342E6C61 622E696E 6469612E 61727961
  6B612E63 6F6D301F 0603551D 23041830 16801484 8473E828 8FCF6E76 EC899091
  44F750CB E00BDC30 1D060355 1D0E0416 04148484 73E8288F CF6E76EC 89909144
  F750CBE0 0BDC300D 06092A86 4886F70D 01010405 00038181 0035D6D9 BB2CC8B5
  E27D6DDF B13380EE DE61B886 0DE7661D A3799500 4CDAD07F A5F5E2AE 397897CE
  BB4138D8 6A3B062B B569A171 AB7BC9E6 6B88CB53 DB4277A0 11995570 0159AE7F
  1DE587B2 A52170FF 70551219 33AEDD58 238DD2B2 CFD553DF 5C14D9EA C38ED718
  52246C7B 3AAFB00F EA6E25B5 283D2F73 74243F36 A88F7BD1 DC
        quit
dot11 syslog
!
!
ip cef
!
!
no ip domain lookup
ip name-server 172.16.1.20
ip name-server 172.16.1.39
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
multilink bundle-name authenticated
!
!
vtp domain cisco
vtp mode transparent
username aryaka privilege 15 password 0 aryaka
!
!
crypto isakmp policy 1
 encr aes
 authentication pre-share
 group 2
 lifetime 3600
crypto isakmp key aryaka address 10.16.70.2
crypto isakmp key aryaka address 10.16.70.3
!
crypto isakmp peer address 10.16.70.2
!
crypto isakmp peer address 10.16.70.3
!
!
crypto ipsec transform-set strong esp-3des esp-md5-hmac
!
crypto map vpn 10 ipsec-isakmp
 set peer 10.16.70.2
 set peer 10.16.70.3
 set transform-set strong
 match address BP_HP
!
archive
 log config
  hidekeys
!
!
vlan 100,110,150,160,210,250,260
!
!
class-map match-all class1
 match any
!
!
policy-map policy1
 class class1
  set dscp af31
!
!
!
!
interface Loopback1
 ip address 192.168.74.2 255.255.255.255
!
interface Tunnel1
 description Tunnel1
 ip address 1.1.1.74 255.255.255.0
 keepalive 10 3
 tunnel source Loopback1
 tunnel destination 192.168.75.2
!
interface Tunnel2
 ip address 3.3.3.3 255.255.255.0
 tunnel source Loopback1
 tunnel destination 192.168.76.1
!
interface FastEthernet0
 ip address 172.19.8.74 255.255.254.0
 duplex auto
 speed auto
!
interface FastEthernet1
 ip address 10.15.10.2 255.255.255.0
 duplex auto
 speed auto
 vlan-range dot1q 209 261
  exit-vlan-config
 !
 crypto map vpn
 service-policy output policy1
!
interface BRI0
 no ip address
 encapsulation hdlc
 shutdown
!
interface FastEthernet2
 switchport mode trunk
!
interface FastEthernet3
 switchport access vlan 160
!
interface FastEthernet4
 switchport mode trunk
!
interface FastEthernet5
!
interface FastEthernet6
!
interface FastEthernet7
 switchport access vlan 110
!
interface FastEthernet8
 switchport access vlan 110
!
interface FastEthernet9
 switchport access vlan 110
!
interface Vlan1
 no ip address
!
interface Vlan110
 ip address 10.20.10.1 255.255.255.0
!
interface Vlan100
 no ip address
!
interface Vlan160
 ip address 10.20.60.3 255.255.255.0
!
interface Vlan150
 ip address 10.20.50.3 255.255.255.0
!
interface Vlan260
 ip address 10.15.60.2 255.255.255.0
!
interface Vlan250
 ip address 10.15.50.2 255.255.255.0
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 172.19.8.1
ip route 10.5.20.0 255.255.255.0 Tunnel2
ip route 10.15.0.0 255.255.0.0 FastEthernet1
ip route 10.16.70.0 255.255.255.0 10.15.10.1
ip route 10.20.30.0 255.255.255.0 Tunnel1
ip route 10.20.50.0 255.255.255.0 Tunnel1
ip route 10.20.60.0 255.255.255.0 Tunnel1
ip route 10.20.60.0 255.255.255.0 10.20.10.2
ip route 10.32.201.2 255.255.255.255 10.15.10.1
ip route 192.168.75.2 255.255.255.255 10.15.10.1
ip route 192.168.76.1 255.255.255.255 10.15.10.1
!
!
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip access-list extended BP_HP
 permit gre host 192.168.74.2 host 192.168.75.2
 permit gre host 192.168.74.2 host 192.168.76.1
 permit gre host 192.168.74.2 host 10.32.201.2
!
!
!
!
!
!
!
control-plane
!
banner exec ^C
% Password expiration warning.
-----------------------------------------------------------------------

Cisco Router and Security Device Manager (SDM) is installed on this device and
it provides the default username "cisco" for  one-time use. If you have already
used the username "cisco" to login to the router and your IOS image supports the
"one-time" user option, then this username has already expired. You will not be
able to login to the router with this username after you exit this session.

It is strongly suggested that you create a new username with a privilege level
of 15 using the following command.

username <myuser> privilege 15 secret 0 <mypassword>

Replace <myuser> and <mypassword> with the username and password you want to
use.

-----------------------------------------------------------------------
^C
banner login ^C
-----------------------------------------------------------------------
Cisco Router and Security Device Manager (SDM) is installed on this device.
This feature requires the one-time use of the username "cisco"
with the password "cisco". The default username and password have a privilege level of 15.

Please change these publicly known initial credentials using SDM or the IOS CLI.
Here are the Cisco IOS commands.

username <myuser>  privilege 15 secret 0 <mypassword>
no username cisco

Replace <myuser> and <mypassword> with the username and password you want to use.

For more information about SDM please follow the instructions in the QUICK START
GUIDE for your router or go to http://www.cisco.com/go/sdm
-----------------------------------------------------------------------
^C
!
line con 0
 login local
line aux 0
line vty 0 4
 session-timeout 15
 access-class 23 in
 exec-timeout 0 0
 privilege level 15
 login local
 transport input telnet ssh
line vty 5 15
 access-class 23 in
 privilege level 15
 login local
 transport input telnet ssh
!
ntp clock-period 17180293
ntp server 172.17.1.1 prefer
end

SYSTEM74#
4
  • 1
    The diagram did not show the other end for IPsec and it is not clear why you want to use switchport commad on the router interface,which type of routers did you have? – Mr.lock Feb 11 '17 at 15:18
  • You need to provide a lot more information. For example, the network device models and configurations. Router interfaces cannot be switch ports. – Ron Maupin Feb 11 '17 at 17:15
  • @Mr.lock Sorry about that I have updated question.Here tunnel is between a 10.15.10.2(ROUTER) and 10.16.70.2(LINUX machine). I want to pass two more networks 10.15.60.2 and 10.15.50.2 traffic through the same tunnel. Device type used -CISCO-1800 router – Amar Feb 14 '17 at 3:52
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 16 '17 at 21:41
2

You can use OTV, L2TP or VXLAN.

3
  • Care to explain what OTP is, as I have not heard about it previously? At least L2TP and VXLAN are applicable to this problem. – juhist Feb 13 '17 at 14:37
  • It seems my phone doing sometimes weird spell check corrections. I was thinking about overlay transport virtualization - OTV cisco proprietary protocol for relaying layer 2 over layer 3. – Datagram.Network Feb 13 '17 at 15:02
  • @Datagram.Network Actually sorry but this tunnel is between a router and the Linux machine. Where on the router I did some modification as added extra VLANs(two more networks) to allow to pass the traffic through the same tunnel.Now when I saw I noticed this SYSTEM74#show crypto isakmp sa IPv4 Crypto ISAKMP SA dst src state conn-id slot status 10.15.60.2 10.16.70.2 AG_INIT_EXCH 2247 0 ACTIVE 10.15.10.2 10.16.70.2 QM_IDLE 2246 0 ACTIVE – Amar Feb 14 '17 at 3:43
0

Why are you looking to make a trunk port on your router? If you want traffic from other vlans to cross the tunnel you will need to modify the Crypto ACL on both sides of the tunnel to reflect those vlans.

1
  • could you please help me on this I am new to this – Amar Feb 14 '17 at 3:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.