0

I have a problem with VPN configuration. This is the topology I created:

enter image description here

First updated licenses to make the VPN available:

license boot module c1900 technology-package securityk9

IPsec Router NetworkA configuration:

ip route 0.0.0.0 0.0.0.0 200.100.100.2 
!
access-list 100 permit ip 192.168.10.0 0.0.0.255 103.168.30.0 0.0.0.255
access-list 100 permit ip 192.168.10.0 0.0.0.255 103.168.40.0 0.0.0.255
access-list 100 permit ip 192.168.20.0 0.0.0.255 103.168.30.0 0.0.0.255
access-list 100 permit ip 192.168.20.0 0.0.0.255 103.168.40.0 0.0.0.255
!
crypto isakmp policy 10
encryption aes 256
authentication pre-share
group 5
!
crypto isakmp key VPN address 200.200.100.1
crypto ipsec transform-set VPN esp-aes 256 esp-sha-hmac
crypto map VPN 10 ipsec-isakmp 
set peer 200.200.100.1
set pfs group5
set security-association lifetime seconds 86400
set transform-set VPN
match address 100
!
interface gigabitEthernet 0/0
 crypto map VPN
!

Ipsec Router NetworkB:

ip route 0.0.0.0 0.0.0.0 200.200.100.2 
access-list 100 permit ip 192.168.30.0 0.0.0.255 103.168.10.0 0.0.0.255
access-list 100 permit ip 192.168.30.0 0.0.0.255 103.168.20.0 0.0.0.255
access-list 100 permit ip 192.168.40.0 0.0.0.255 103.168.10.0 0.0.0.255
access-list 100 permit ip 192.168.40.0 0.0.0.255 103.168.20.0 0.0.0.255
crypto isakmp policy 10
encryption aes 256
authentication pre-share
group 5
!
crypto isakmp key VPN address 200.100.100.1
crypto ipsec transform-set VPN esp-aes 256 esp-sha-hmac
crypto map VPN 10 ipsec-isakmp 
set peer 200.200.100.1
set pfs group5
set security-association lifetime seconds 86400
set transform-set VPN
match address 100
!
interface gigabitEthernet 0/0
 crypto map VPN
!

VLAN Router NetworkA

interface gigabitEthernet 0/1.1
 encapsulation dot1Q 10 
 ip address 192.168.10.1 255.255.255.0 
!
interface gigabitEthernet 0/1.2
 encapsulation dot1Q 20 
 ip address 192.168.20.1 255.255.255.0
!

VLAN Router NetworkB

interface gigabitEthernet 0/1.1
 encapsulation dot1Q 30 
 ip address 192.168.30.1 255.255.255.0 
!
interface gigabitEthernet 0/1.2
 encapsulation dot1Q 40 
 ip address 192.168.40.1 255.255.255.0
!

Switch1

interface gigabitEthernet 0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20
!
interface range fastEthernet 0/1-11
 switchport access vlan 10
!
interface range fastEthernet 0/11-20
 switchport access vlan 20
!

Switch2

interface gigabitEthernet 0/1
 switchport mode trunk
 switchport trunk allowed vlan 30,40
!
interface range fastEthernet 0/1-11
 switchport access vlan 30
!
interface range fastEthernet 0/11-20
 switchport access vlan 40
!

I would like VLANs to communicate with each other, however there is a problem with the VPN tunnel.

I think I need to configure NAT but don`t know how.

output "show crypto isakmp sa" is the same on both routers :

IPv4 Crypto ISAKMP SA
dst             src             state          conn-id slot status
!
IPv6 Crypto ISAKMP SA
!
Improve this question
11
  • Network topology prnt.sc/whchw3
    – perelt
    Jan 6, 2021 at 8:30
  • Let's start with some basics. Please edit your question to include the output of "show crypto isakmp sa" on both routers. You shouldn't need NAT.
    – Ron Trunk
    Jan 6, 2021 at 13:44
  • I added the output. I don't think it looks like it should ;/
    – perelt
    Jan 6, 2021 at 14:06
  • Can router A ping router B?
    – Ron Trunk
    Jan 6, 2021 at 14:07
  • Yes they can do it.
    – perelt
    Jan 6, 2021 at 14:12

1 Answer 1

Reset to default
1

You have a typo in your access-list that was not allowing traffic to enter the VPN tunnel:

access-list 100 permit ip 192.168.30.0 0.0.0.255 103.168.10.0 0.0.0.255
access-list 100 permit ip 192.168.30.0 0.0.0.255 103.168.20.0 0.0.0.255
access-list 100 permit ip 192.168.40.0 0.0.0.255 103.168.10.0 0.0.0.255
access-list 100 permit ip 192.168.40.0 0.0.0.255 103.168.20.0 0.0.0.255

Note 103.168.10.0 instead of 192.168.10.0

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.