0

I'm trying to setup IPSEC tunnels in a hub/spoke type fashion. I've emulated this in GNS3 by creating three sites. Each site uses an IOSv router as it's WAN router. I'm using site 2 as the hub and sites 1 and 3 are the spokes. I've been able to get the IPSEC tunnel up (ACTIVE/ACTIVE) between Site 1 and Site 2. But I can't stablish the IPSEC tunnel between Site 2 and Site 3.

I generally know how to do setup an IPSEC tunnel between two sites (point-to-point); such as what exists between Site 1 and Site 2. But as soon as I have to add an additional IPSEC tunnel to the hub router, my understanding falls apart.

Here is a diagram of how the simulation is built.

enter image description here

As you can see I'm using three layer 3 switches as a transport network between the three sites. I want both IPSEC tunnels to land on the same interface (gi0/0) on the Hub router.

The diagram above should show all of the relevant config.

Site1 IOSv config

crypto isakmp policy 10
 encr 3des
 hash md5
 authentication pre-share
 group 2
crypto isakmp key cisco1 address 195.89.28.249
!
crypto ipsec transform-set TSET1 esp-3des esp-md5-hmac
 mode tunnel
!
crypto map TST 10 ipsec-isakmp
 set peer 195.89.28.249
 set transform-set TSET1
 match address 101
!
ip route 0.0.0.0 0.0.0.0 195.89.28.194
ip route 192.168.15.64 255.255.255.252 195.89.28.194
!
access-list 101 permit ip 192.168.0.0 0.0.0.255 192.168.15.0 0.0.0.255
!
interface GigabitEthernet0/0
 ip address 195.89.28.193 255.255.255.252
 duplex auto
 speed auto
 media-type rj45
 crypto map TST
!
interface GigabitEthernet0/1
 ip address 192.168.0.65 255.255.255.252
 duplex auto
 speed auto
 media-type rj45

Site2 IOSv router

crypto isakmp policy 10
 encr 3des
 hash md5
 authentication pre-share
 group 2
!
crypto isakmp policy 20
 encr 3des
 hash md5
 authentication pre-share
 group 2
crypto isakmp key cisco1 address 195.89.28.193
crypto isakmp key cisco2 address 195.89.28.65
!
crypto ipsec transform-set TSET1 esp-3des esp-md5-hmac
 mode tunnel
crypto ipsec transform-set TSET2 esp-3des esp-md5-hmac
 mode tunnel
!
crypto map TST 10 ipsec-isakmp
 set peer 195.89.28.193
 set transform-set TSET1
 match address 101
crypto map TST 20 ipsec-isakmp
 set peer 195.89.28.65
 set transform-set TSET2
 match address 102
!
ip route 0.0.0.0 0.0.0.0 195.89.28.250
ip route 192.168.0.64 255.255.255.252 195.89.28.250
ip route 192.168.30.64 255.255.255.252 195.89.28.250
!
access-list 101 permit ip 192.168.15.0 0.0.0.255 192.168.0.0 0.0.0.255
access-list 102 permit ip 192.168.15.0 0.0.0.255 192.168.30.0 0.0.0.255
!
interface GigabitEthernet0/0
 ip address 195.89.28.249 255.255.255.252
 duplex auto
 speed auto
 media-type rj45
 crypto map TST
!
interface GigabitEthernet0/1
 ip address 192.168.15.65 255.255.255.252
 duplex auto
 speed auto
 media-type rj45

Site3 IOSv router

crypto isakmp policy 20
 encr 3des
 hash md5
 authentication pre-share
 group 2
crypto isakmp key cisco2 address 195.89.28.249
!
crypto ipsec transform-set TSET2 esp-3des esp-md5-hmac
 mode tunnel
!
crypto map TST 20 ipsec-isakmp
 set peer 195.89.28.249
 set transform-set TSET2
 match address 102
!
ip route 0.0.0.0 0.0.0.0 195.89.28.66
ip route 192.168.15.64 255.255.255.252 195.89.28.66
!
access-list 102 permit ip 192.168.30.0 0.0.0.255 192.168.15.0 0.0.0.255
!
interface GigabitEthernet0/0
 ip address 195.89.28.65 255.255.255.252
 duplex auto
 speed auto
 media-type rj45
 crypto map TST
!
interface GigabitEthernet0/1
 ip address 192.168.30.65 255.255.255.252
 duplex auto
 speed auto
 media-type rj45
Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer. – Ron Maupin♦ Dec 17 '20 at 20:50
1

On the hub you have different isakmp policies and keys for each spoke. Make them the same. Your maps look correct

Improve this answer
1

I've figured it out. The configs were mostly correct and I've updated the post with the correct configs.

However, the fix centered around the fact that my access-lists were constructed incorrectly.

The routers are now using the following access-lists.

Site1 IOSv Router

access-list 101 permit ip 192.168.0.0 0.0.0.255 192.168.15.0 0.0.0.255

Site2 IOSv Router

access-list 101 permit ip 192.168.15.0 0.0.0.255 192.168.0.0 0.0.0.255
access-list 102 permit ip 192.168.15.0 0.0.0.255 192.168.30.0 0.0.0.255

Site3 IOSv Router

access-list 102 permit ip 192.168.30.0 0.0.0.255 192.168.15.0 0.0.0.255
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.