From a PC that is attached to a Cisco Catalyst 3850 and Portchanneld to Cisco ISR I do a ping to a destination that is connected with BGP. That works for me.
The trace path looks like:
1: localhost (10.1.1.22)
2: gateway (10.1.1.18)
3: BGP Neigbhour (10.1.2.101)
4: destination IP (10.1.3.205)
On the ISR I configure a subdevice that works as IPSec Endpoint. Phase 1 comes up and the carrier confirm phase 1. Now I need to change my IP Route like that way for encryption:
1: localhost (10.1.1.22/28)
2: gateway (10.1.1.18/28)
3: IPSec subdevice (10.1.1.37/30)
4: BGP Neigbhour (10.1.2.101/30)
5: destination IP (10.1.3.205/27)
How can I reach this goal or anything wrong in my case?
The config of my Catalyst:
sh run int gi1/0/7
!
interface GigabitEthernet1/0/7
description PC1
switchport access vlan 30
end
sh run int gi1/0/4
!
interface GigabitEthernet1/0/4
description carrier1
switchport trunk allowed vlan 331
switchport mode trunk
end
sh run int gi1/0/1
!
interface GigabitEthernet1/0/1
description PortChannel ISR
switchport trunk native vlan 10
switchport mode trunk
channel-group 1 mode on
end
And this is the config of the ISR
sh run int po1.331
!
interface Port-channel1.331
description carrier1
encapsulation dot1Q 331
ip address 10.1.2.102 255.255.255.252
end
sh run int po1.30
!
interface Port-channel1.30
encapsulation dot1Q 30
ip address 10.1.1.18 255.255.255.240
end
sh run int po1.202
!
interface Port-channel1.202
description IPsec Interconnect
encapsulation dot1Q 202
ip address 10.1.1.37 255.255.255.252
no ip redirects
no ip proxy-arp
crypto map test
end
Maybe I need a static route that says destination Network via IPSec subdevice and then to BGP Neigbhour? How can I do that?
I try to add a static route but doesn't work:
ip route 10.1.3.192 255.255.255.224 10.1.1.37
But ios told me that is invalid because it's this router. The issue is that the Port where the PC is connected only accept decrypted traffic but one customer wants to use a IPSec Tunnel for encryption. So the ISR should be the endpoint, decrypt the traffic and send it decrypted to the PC1 Port.
For explanation see this Visio chart:
This is the Cryptoconfig from ISR
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key XXpeterpanXX address 10.1.3.238
crypto ipsec security-association lifetime seconds 86400
crypto ipsec transform-set ipcom esp-3des esp-md5-hmac
mode tunnel
crypto map test 10 ipsec-isakmp
description IPSec peer
set peer 10.1.3.238
set transform-set ipcom
set pfs group2
match address 120
crypto map test
access-list 120 permit ip 10.1.1.36 0.0.0.3 10.1.3.192 0.0.0.31