From a PC that is attached to a Cisco Catalyst 3850 and Portchanneld to Cisco ISR I do a ping to a destination that is connected with BGP. That works for me.
The trace path looks like:
1: localhost (10.1.1.22) 2: gateway (10.1.1.18) 3: BGP Neigbhour (10.1.2.101) 4: destination IP (10.1.3.205)
On the ISR I configure a subdevice that works as IPSec Endpoint. Phase 1 comes up and the carrier confirm phase 1. Now I need to change my IP Route like that way for encryption:
1: localhost (10.1.1.22/28) 2: gateway (10.1.1.18/28) 3: IPSec subdevice (10.1.1.37/30) 4: BGP Neigbhour (10.1.2.101/30) 5: destination IP (10.1.3.205/27)
How can I reach this goal or anything wrong in my case?
The config of my Catalyst:
sh run int gi1/0/7 ! interface GigabitEthernet1/0/7 description PC1 switchport access vlan 30 end sh run int gi1/0/4 ! interface GigabitEthernet1/0/4 description carrier1 switchport trunk allowed vlan 331 switchport mode trunk end sh run int gi1/0/1 ! interface GigabitEthernet1/0/1 description PortChannel ISR switchport trunk native vlan 10 switchport mode trunk channel-group 1 mode on end
And this is the config of the ISR
sh run int po1.331 ! interface Port-channel1.331 description carrier1 encapsulation dot1Q 331 ip address 10.1.2.102 255.255.255.252 end sh run int po1.30 ! interface Port-channel1.30 encapsulation dot1Q 30 ip address 10.1.1.18 255.255.255.240 end sh run int po1.202 ! interface Port-channel1.202 description IPsec Interconnect encapsulation dot1Q 202 ip address 10.1.1.37 255.255.255.252 no ip redirects no ip proxy-arp crypto map test end
Maybe I need a static route that says destination Network via IPSec subdevice and then to BGP Neigbhour? How can I do that?
I try to add a static route but doesn't work:
ip route 10.1.3.192 255.255.255.224 10.1.1.37
But ios told me that is invalid because it's this router. The issue is that the Port where the PC is connected only accept decrypted traffic but one customer wants to use a IPSec Tunnel for encryption. So the ISR should be the endpoint, decrypt the traffic and send it decrypted to the PC1 Port.
For explanation see this Visio chart:
This is the Cryptoconfig from ISR
crypto isakmp policy 1 encr 3des hash md5 authentication pre-share group 2 crypto isakmp key XXpeterpanXX address 10.1.3.238 crypto ipsec security-association lifetime seconds 86400 crypto ipsec transform-set ipcom esp-3des esp-md5-hmac mode tunnel crypto map test 10 ipsec-isakmp description IPSec peer set peer 10.1.3.238 set transform-set ipcom set pfs group2 match address 120 crypto map test access-list 120 permit ip 10.1.1.36 0.0.0.3 10.1.3.192 0.0.0.31