I have a problem with VPN configuration. This is the topology I created:
First updated licenses to make the VPN available:
license boot module c1900 technology-package securityk9
IPsec Router NetworkA configuration:
ip route 0.0.0.0 0.0.0.0 200.100.100.2
!
access-list 100 permit ip 192.168.10.0 0.0.0.255 103.168.30.0 0.0.0.255
access-list 100 permit ip 192.168.10.0 0.0.0.255 103.168.40.0 0.0.0.255
access-list 100 permit ip 192.168.20.0 0.0.0.255 103.168.30.0 0.0.0.255
access-list 100 permit ip 192.168.20.0 0.0.0.255 103.168.40.0 0.0.0.255
!
crypto isakmp policy 10
encryption aes 256
authentication pre-share
group 5
!
crypto isakmp key VPN address 200.200.100.1
crypto ipsec transform-set VPN esp-aes 256 esp-sha-hmac
crypto map VPN 10 ipsec-isakmp
set peer 200.200.100.1
set pfs group5
set security-association lifetime seconds 86400
set transform-set VPN
match address 100
!
interface gigabitEthernet 0/0
crypto map VPN
!
Ipsec Router NetworkB:
ip route 0.0.0.0 0.0.0.0 200.200.100.2
access-list 100 permit ip 192.168.30.0 0.0.0.255 103.168.10.0 0.0.0.255
access-list 100 permit ip 192.168.30.0 0.0.0.255 103.168.20.0 0.0.0.255
access-list 100 permit ip 192.168.40.0 0.0.0.255 103.168.10.0 0.0.0.255
access-list 100 permit ip 192.168.40.0 0.0.0.255 103.168.20.0 0.0.0.255
crypto isakmp policy 10
encryption aes 256
authentication pre-share
group 5
!
crypto isakmp key VPN address 200.100.100.1
crypto ipsec transform-set VPN esp-aes 256 esp-sha-hmac
crypto map VPN 10 ipsec-isakmp
set peer 200.200.100.1
set pfs group5
set security-association lifetime seconds 86400
set transform-set VPN
match address 100
!
interface gigabitEthernet 0/0
crypto map VPN
!
VLAN Router NetworkA
interface gigabitEthernet 0/1.1
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0
!
interface gigabitEthernet 0/1.2
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0
!
VLAN Router NetworkB
interface gigabitEthernet 0/1.1
encapsulation dot1Q 30
ip address 192.168.30.1 255.255.255.0
!
interface gigabitEthernet 0/1.2
encapsulation dot1Q 40
ip address 192.168.40.1 255.255.255.0
!
Switch1
interface gigabitEthernet 0/1
switchport mode trunk
switchport trunk allowed vlan 10,20
!
interface range fastEthernet 0/1-11
switchport access vlan 10
!
interface range fastEthernet 0/11-20
switchport access vlan 20
!
Switch2
interface gigabitEthernet 0/1
switchport mode trunk
switchport trunk allowed vlan 30,40
!
interface range fastEthernet 0/1-11
switchport access vlan 30
!
interface range fastEthernet 0/11-20
switchport access vlan 40
!
I would like VLANs to communicate with each other, however there is a problem with the VPN tunnel.
I think I need to configure NAT but don`t know how.
output "show crypto isakmp sa" is the same on both routers :
IPv4 Crypto ISAKMP SA
dst src state conn-id slot status
!
IPv6 Crypto ISAKMP SA
!