I'm trying to setup IPSEC tunnels in a hub/spoke type fashion. I've emulated this in GNS3 by creating three sites. Each site uses an IOSv router as it's WAN router. I'm using site 2 as the hub and sites 1 and 3 are the spokes. I've been able to get the IPSEC tunnel up (ACTIVE/ACTIVE) between Site 1 and Site 2. But I can't stablish the IPSEC tunnel between Site 2 and Site 3.
I generally know how to do setup an IPSEC tunnel between two sites (point-to-point); such as what exists between Site 1 and Site 2. But as soon as I have to add an additional IPSEC tunnel to the hub router, my understanding falls apart.
Here is a diagram of how the simulation is built.
As you can see I'm using three layer 3 switches as a transport network between the three sites. I want both IPSEC tunnels to land on the same interface (gi0/0) on the Hub router.
The diagram above should show all of the relevant config.
Site1 IOSv config
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key cisco1 address 195.89.28.249
!
crypto ipsec transform-set TSET1 esp-3des esp-md5-hmac
mode tunnel
!
crypto map TST 10 ipsec-isakmp
set peer 195.89.28.249
set transform-set TSET1
match address 101
!
ip route 0.0.0.0 0.0.0.0 195.89.28.194
ip route 192.168.15.64 255.255.255.252 195.89.28.194
!
access-list 101 permit ip 192.168.0.0 0.0.0.255 192.168.15.0 0.0.0.255
!
interface GigabitEthernet0/0
ip address 195.89.28.193 255.255.255.252
duplex auto
speed auto
media-type rj45
crypto map TST
!
interface GigabitEthernet0/1
ip address 192.168.0.65 255.255.255.252
duplex auto
speed auto
media-type rj45
Site2 IOSv router
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
!
crypto isakmp policy 20
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key cisco1 address 195.89.28.193
crypto isakmp key cisco2 address 195.89.28.65
!
crypto ipsec transform-set TSET1 esp-3des esp-md5-hmac
mode tunnel
crypto ipsec transform-set TSET2 esp-3des esp-md5-hmac
mode tunnel
!
crypto map TST 10 ipsec-isakmp
set peer 195.89.28.193
set transform-set TSET1
match address 101
crypto map TST 20 ipsec-isakmp
set peer 195.89.28.65
set transform-set TSET2
match address 102
!
ip route 0.0.0.0 0.0.0.0 195.89.28.250
ip route 192.168.0.64 255.255.255.252 195.89.28.250
ip route 192.168.30.64 255.255.255.252 195.89.28.250
!
access-list 101 permit ip 192.168.15.0 0.0.0.255 192.168.0.0 0.0.0.255
access-list 102 permit ip 192.168.15.0 0.0.0.255 192.168.30.0 0.0.0.255
!
interface GigabitEthernet0/0
ip address 195.89.28.249 255.255.255.252
duplex auto
speed auto
media-type rj45
crypto map TST
!
interface GigabitEthernet0/1
ip address 192.168.15.65 255.255.255.252
duplex auto
speed auto
media-type rj45
Site3 IOSv router
crypto isakmp policy 20
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key cisco2 address 195.89.28.249
!
crypto ipsec transform-set TSET2 esp-3des esp-md5-hmac
mode tunnel
!
crypto map TST 20 ipsec-isakmp
set peer 195.89.28.249
set transform-set TSET2
match address 102
!
ip route 0.0.0.0 0.0.0.0 195.89.28.66
ip route 192.168.15.64 255.255.255.252 195.89.28.66
!
access-list 102 permit ip 192.168.30.0 0.0.0.255 192.168.15.0 0.0.0.255
!
interface GigabitEthernet0/0
ip address 195.89.28.65 255.255.255.252
duplex auto
speed auto
media-type rj45
crypto map TST
!
interface GigabitEthernet0/1
ip address 192.168.30.65 255.255.255.252
duplex auto
speed auto
media-type rj45