I'm trying to configure VPN between 2 routers:
- R1: public IP is 200.0.0.6/30 on S0/0/1, private IP are 10.0.0.0/8 and 20.0.0.0/8
- R3: public IP is 210.10.0.6/30 on S0/0/0, private IP is 192.168.3.0/24
Configuration:
- On R1:
crypto isakmp policy 10
encr aes
authentication pre-share
group 2
!
crypto isakmp key SECRET_KEY address 210.10.0.6
!
!
!
crypto ipsec transform-set VPN-TRANSFORM esp-aes esp-sha-hmac
!
crypto map VPN-MAP 10 ipsec-isakmp
set peer 210.10.0.6
set transform-set VPN-TRANSFORM
match address VPN-TRAFFIC
!
!
!
!
!
!
spanning-tree mode pvst
!
!
!
!
!
!
interface FastEthernet0/0
ip address 10.0.0.1 255.0.0.0
duplex auto
speed auto
!
interface FastEthernet0/1
no ip address
duplex auto
speed auto
shutdown
!
interface Serial0/0/0
ip address 20.0.0.1 255.0.0.0
clock rate 2000000
!
interface Serial0/0/1
ip address 200.0.0.6 255.255.255.252
crypto map VPN-MAP
!
interface Vlan1
no ip address
shutdown
!
router eigrp 10
network 10.0.0.0
network 20.0.0.0
auto-summary
!
ip classless
ip route 0.0.0.0 0.0.0.0 Serial0/0/1
!
ip flow-export version 9
!
!
ip access-list extended VPN-TRAFFIC
permit ip 10.0.0.0 0.255.255.255 192.168.3.0 0.0.0.255
permit ip 20.0.0.0 0.255.255.255 192.168.3.0 0.0.0.255
permit ip 192.168.3.0 0.0.0.255 10.0.0.0 0.255.255.255
permit ip 192.168.3.0 0.0.0.255 20.0.0.0 0.255.255.255
- On R3:
crypto isakmp policy 10
encr aes
authentication pre-share
group 2
!
crypto isakmp key SECRET_KEY address 200.0.0.6
!
!
!
crypto ipsec transform-set VPN-TRANSFORM esp-aes esp-sha-hmac
!
crypto map VPN-MAP 10 ipsec-isakmp
set peer 200.0.0.6
set transform-set VPN-TRANSFORM
match address VPN-TRAFFIC
!
!
!
!
!
!
spanning-tree mode pvst
!
!
!
!
!
!
interface FastEthernet0/0
ip address 192.168.3.1 255.255.255.0
duplex auto
speed auto
!
interface FastEthernet0/1
no ip address
duplex auto
speed auto
shutdown
!
interface Serial0/0/0
ip address 210.10.0.6 255.255.255.252
crypto map VPN-MAP
!
interface Serial0/0/1
no ip address
clock rate 2000000
shutdown
!
interface Vlan1
no ip address
shutdown
!
ip classless
ip route 0.0.0.0 0.0.0.0 Serial0/0/0
!
ip flow-export version 9
!
!
ip access-list extended VPN-TRAFFIC
permit ip 192.168.3.0 0.0.0.255 10.0.0.0 0.255.255.255
permit ip 192.168.3.0 0.0.0.255 20.0.0.0 0.255.255.255
permit ip 10.0.0.0 0.255.255.255 192.168.3.0 0.0.0.255
permit ip 20.0.0.0 0.255.255.255 192.168.3.0 0.0.0.255
But there was nothing when I entered sh crypto isakmp sa
and sh crypto ipsec sa
. I could not ping 2 routers also. Plz help me out. Thankyou!
debug crypto [isakmp, ipsec]
, right?