From a PC that is attached to a Cisco Catalyst 3850 and Portchanneld to Cisco ISR I do a ping to a destination that is connected with BGP. That works for me.

The trace path looks like:

1: localhost (
2: gateway (
3: BGP Neigbhour (
4: destination IP (

On the ISR I configure a subdevice that works as IPSec Endpoint. Phase 1 comes up and the carrier confirm phase 1. Now I need to change my IP Route like that way for encryption:

1: localhost (
2: gateway (
3: IPSec subdevice (
4: BGP Neigbhour (
5: destination IP (

How can I reach this goal or anything wrong in my case?

The config of my Catalyst:

sh run int gi1/0/7
interface GigabitEthernet1/0/7
 description PC1
 switchport access vlan 30

sh run int gi1/0/4
interface GigabitEthernet1/0/4
 description carrier1
 switchport trunk allowed vlan 331
 switchport mode trunk

sh run int gi1/0/1    
interface GigabitEthernet1/0/1
 description PortChannel ISR
 switchport trunk native vlan 10
 switchport mode trunk
 channel-group 1 mode on

And this is the config of the ISR

sh run int po1.331
interface Port-channel1.331
 description carrier1
 encapsulation dot1Q 331
 ip address

sh run int po1.30 
interface Port-channel1.30
 encapsulation dot1Q 30
 ip address

sh run int po1.202
interface Port-channel1.202
 description IPsec Interconnect
 encapsulation dot1Q 202
 ip address
 no ip redirects
 no ip proxy-arp
 crypto map test

Maybe I need a static route that says destination Network via IPSec subdevice and then to BGP Neigbhour? How can I do that?

I try to add a static route but doesn't work:

ip route 

But ios told me that is invalid because it's this router. The issue is that the Port where the PC is connected only accept decrypted traffic but one customer wants to use a IPSec Tunnel for encryption. So the ISR should be the endpoint, decrypt the traffic and send it decrypted to the PC1 Port.

For explanation see this Visio chart:

enter image description here

This is the Cryptoconfig from ISR

crypto isakmp policy 1
 encr 3des
 hash md5
 authentication pre-share
 group 2
crypto isakmp key XXpeterpanXX address
crypto ipsec security-association lifetime seconds 86400
crypto ipsec transform-set ipcom esp-3des esp-md5-hmac 
 mode tunnel
crypto map test 10 ipsec-isakmp 
 description IPSec peer 
 set peer
 set transform-set ipcom 
 set pfs group2
 match address 120
 crypto map test
access-list 120 permit ip
  • What I understand is that your VPN tunnel works, and that you need to say is "the traffic intended to this destination should be routed to the VPN endpoint ( rather than to the router" Is that correct? – JFL Sep 6 '17 at 6:35
  • Yes through the and then encrypted to the BGP Neighbor – kockiren Sep 6 '17 at 6:49
  • Is this scenario possible or do I need to plug an physical device that is connected to this VLAN 202 with IP – kockiren Sep 6 '17 at 9:48
  • This is perfectly possible and there's several way to do it, but I'm not expert of ISR, since there's some people here with extended Cisco competencies, I hope they will answer you. – JFL Sep 6 '17 at 9:59
  • Oh great, nice to hear that is possible and I'am not on the wrong way. Do you have a Idea how to do that? Maybe I can figure out how to do this on ISR. As I understand I need to route the traffic only through this subdevice and the Traffic will be encrypted. But the static route can't create because of the Route Hop is the Router self. – kockiren Sep 6 '17 at 10:03

What you are asking doesn't make sense to me. Why do you want to see that IP address in your trace? The only thing I can think of is that you want to set up a tunnel interface at each end?

So you could do something like:

Your router:

interface tunnel 0
 ip address
 tunnel source po1.331
 tunnel destination
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile ENCRYPTTUNNEL

Other Router:

interface tunnel 0
 ip address
 tunnel source g1  !<--or whatever the source interface is on that router
 tunnel destination
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile ENCRYPTTUNNEL

Then you could add static routes on the ISR to networks:

ip route

Even with all of that, you will see as a hop in your trace, not

  • I can only configure my ISR and the PC that is physical connected has the network configured. If I send traffic from to than it pass the and than BGP Neighbor but it should pass before that is the IPSec endpoint so in this case the traffic is encrypted. – kockiren Sep 6 '17 at 12:20
  • It isn't because I want to see this IP in my trace, it is because of encryption. If the traffic pass this IP then it is encrypted. – kockiren Sep 6 '17 at 12:54
  • Is the other party only allowing traffic coming from Can you show your crypto map and crypto ACL configurations? Can you run show crypto isakmp sa details (I think), to see what you have now? I'm not sure if you can make the traffic within the router take a detour through I'm also curious for more detail since maybe NAT translation is what you need instead of another router interface. – Aaron D Sep 6 '17 at 21:41
  • The other Party has a endpoint for IPsec and allow only traffic from through this tunnel. I will add the crypto config above. – kockiren Sep 7 '17 at 8:24
  • Any suggestion? I do add a Device to VLAN 202 so I can take a route through and the device I connected has the but the peer IPSec endpoint allow only traffic from so I can't add any device that has this IP – kockiren Sep 12 '17 at 10:55

You could try applying NAT.

  1. I think you want to first remove the IP address and crypto map from interface po1.202. From what I can tell, you don't need that.
  2. Next create a NAT pool which only contains the one IP address you want to use:

    ip nat pool VPN-Accepted-Address netmask
  3. Now an ACL to match traffic going to

    ip access-list extended NAT
     permit ip
  4. Assign NAT outside:

    int po1.331
     ip nat outside
  5. Assign NAT inside:

    int po1.30
     ip nat inside
  6. NAT overload all traffic matching the ACL using the NAT pool which only contains

    ip nat inside source list NAT pool VPN-Accepted-Address overload
  7. Apply crypto map to outside interface:

     int po1.331
      crypto map test

show ip nat translations ping from

  • In case of NAT the source IP will be and not but the Carrier only accept traffic from and not from but is the endpoint for IPsec and Phase 1 of this tunnel is up. What I need is that the traffic from (gateway is on ISR) route through to the carrier – kockiren Sep 12 '17 at 15:33
  • Or am I wrong in this thinking? – kockiren Sep 12 '17 at 17:42
  • If it has to be then put that in the NAT pool instead? – Aaron D Sep 12 '17 at 17:45
  • I will try to implement this. – kockiren Sep 12 '17 at 17:46
  • Have you tried what I've suggested? Your communication with the carrier will be from and they will only see encrypted VPN traffic. The carrier will now see The other end of the VPN tunnel will decrypt the traffic and then see it is from I'm kind of guessing since I'm still not 100% clear what the outside vendor is requiring. Do they have requirements you can point me to that might help describe what they are looking for? – Aaron D Sep 12 '17 at 17:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.