1

I'm trying to configure VPN between 2 routers:

  1. R1: public IP is 200.0.0.6/30 on S0/0/1, private IP are 10.0.0.0/8 and 20.0.0.0/8
  2. R3: public IP is 210.10.0.6/30 on S0/0/0, private IP is 192.168.3.0/24

Configuration:

  1. On R1:
crypto isakmp policy 10
 encr aes
 authentication pre-share
 group 2
!
crypto isakmp key SECRET_KEY address 210.10.0.6
!
!
!
crypto ipsec transform-set VPN-TRANSFORM esp-aes esp-sha-hmac
!
crypto map VPN-MAP 10 ipsec-isakmp 
 set peer 210.10.0.6
 set transform-set VPN-TRANSFORM 
 match address VPN-TRAFFIC
!
!
!
!
!
!
spanning-tree mode pvst
!
!
!
!
!
!
interface FastEthernet0/0
 ip address 10.0.0.1 255.0.0.0
 duplex auto
 speed auto
!
interface FastEthernet0/1
 no ip address
 duplex auto
 speed auto
 shutdown
!
interface Serial0/0/0
 ip address 20.0.0.1 255.0.0.0
 clock rate 2000000
!
interface Serial0/0/1
 ip address 200.0.0.6 255.255.255.252
 crypto map VPN-MAP
!
interface Vlan1
 no ip address
 shutdown
!
router eigrp 10
 network 10.0.0.0
 network 20.0.0.0
 auto-summary
!
ip classless
ip route 0.0.0.0 0.0.0.0 Serial0/0/1 
!
ip flow-export version 9
!
!
ip access-list extended VPN-TRAFFIC
 permit ip 10.0.0.0 0.255.255.255 192.168.3.0 0.0.0.255
 permit ip 20.0.0.0 0.255.255.255 192.168.3.0 0.0.0.255
 permit ip 192.168.3.0 0.0.0.255 10.0.0.0 0.255.255.255
 permit ip 192.168.3.0 0.0.0.255 20.0.0.0 0.255.255.255
  1. On R3:
crypto isakmp policy 10
 encr aes
 authentication pre-share
 group 2
!
crypto isakmp key SECRET_KEY address 200.0.0.6
!
!
!
crypto ipsec transform-set VPN-TRANSFORM esp-aes esp-sha-hmac
!
crypto map VPN-MAP 10 ipsec-isakmp 
 set peer 200.0.0.6
 set transform-set VPN-TRANSFORM 
 match address VPN-TRAFFIC
!
!
!
!
!
!
spanning-tree mode pvst
!
!
!
!
!
!
interface FastEthernet0/0
 ip address 192.168.3.1 255.255.255.0
 duplex auto
 speed auto
!
interface FastEthernet0/1
 no ip address
 duplex auto
 speed auto
 shutdown
!
interface Serial0/0/0
 ip address 210.10.0.6 255.255.255.252
 crypto map VPN-MAP
!
interface Serial0/0/1
 no ip address
 clock rate 2000000
 shutdown
!
interface Vlan1
 no ip address
 shutdown
!
ip classless
ip route 0.0.0.0 0.0.0.0 Serial0/0/0 
!
ip flow-export version 9
!
!
ip access-list extended VPN-TRAFFIC
 permit ip 192.168.3.0 0.0.0.255 10.0.0.0 0.255.255.255
 permit ip 192.168.3.0 0.0.0.255 20.0.0.0 0.255.255.255
 permit ip 10.0.0.0 0.255.255.255 192.168.3.0 0.0.0.255
 permit ip 20.0.0.0 0.255.255.255 192.168.3.0 0.0.0.255

But there was nothing when I entered sh crypto isakmp sa and sh crypto ipsec sa. I could not ping 2 routers also. Plz help me out. Thankyou!

Improve this question
4
  • 1
    The two routers need a shared network on the link between them.
    – Ron Maupin ♦
    Apr 9 at 8:11
  • These 2 routers don't have physical connection. I tried to connect them by using gre tunnel interface but it didn't work. Do you have any other idea?
    – chancuockhanh
    Apr 9 at 15:31
  • You don't have NAT setup and are attempting to use non-routable (RFC1918) IP addresses. Aside from that, you need to debug the crypto process and initiate some qualified traffic and see if the VPN tunnel attempts phase 1 or phase 2, and what goes wrong.
    – FrameHowitzer
    Apr 9 at 22:56
  • So you mean (1) I don't have to use GRE tunnel, (2) instead use NAT and (3) debug crypto [isakmp, ipsec], right?
    – chancuockhanh
    Apr 10 at 0:31

1 Answer 1

Reset to default
0

I solved it!

Here is my network model:

network model

There are some changes in configurations. About routing, I used OSPF for public routing (single area). I still keep EIGRP for private routing I did before. Then redistribute them. About access-lists, I deleted last 2 unnecessary lines in each one on each router. And some changes in crypto policy, key, transform-set, map as below:

On R1:

crypto isakmp policy 10
 encr 3des
 hash md5
 authentication pre-share
 group 5
 lifetime 50000
!
crypto isakmp key cisco123 address 210.10.0.6
!
!
!
crypto ipsec transform-set tset esp-3des esp-md5-hmac
!
crypto map smap 1 ipsec-isakmp 
 set peer 210.10.0.6
 set transform-set tset 
 match address vpn
!
!
!
!
!
!
spanning-tree mode pvst
!
!
!
!
!
!
interface FastEthernet0/0
 ip address 10.0.0.1 255.0.0.0
 duplex auto
 speed auto
!
interface FastEthernet0/1
 no ip address
 duplex auto
 speed auto
 shutdown
!
interface Serial0/0/0
 ip address 20.0.0.1 255.0.0.0
 clock rate 2000000
!
interface Serial0/0/1
 ip address 200.0.0.6 255.255.255.252
 crypto map smap
!
interface Vlan1
 no ip address
 shutdown
!
router eigrp 10
 redistribute ospf 1 metric 1 1 1 1 1 
 network 10.0.0.0
 network 20.0.0.0
 network 0.0.0.0
 auto-summary
!
router ospf 1
 log-adjacency-changes
 redistribute eigrp 10 
 network 200.0.0.4 0.0.0.3 area 0
!
ip classless
ip route 0.0.0.0 0.0.0.0 Serial0/0/1 
!
ip flow-export version 9
!
!
ip access-list extended vpn
 permit ip 10.0.0.0 0.255.255.255 192.168.3.0 0.0.0.255
 permit ip 20.0.0.0 0.255.255.255 192.168.3.0 0.0.0.255

On R3:

crypto isakmp policy 10
 encr 3des
 hash md5
 authentication pre-share
 group 5
 lifetime 50000
!
crypto isakmp key cisco123 address 200.0.0.6
!
!
!
crypto ipsec transform-set tset esp-3des esp-md5-hmac
!
crypto map smap 1 ipsec-isakmp 
 set peer 200.0.0.6
 set transform-set tset 
 match address vpn
!
!
!
!
!
!
spanning-tree mode pvst
!
!
!
!
!
!
interface FastEthernet0/0
 ip address 192.168.3.1 255.255.255.0
 duplex auto
 speed auto
!
interface FastEthernet0/1
 no ip address
 duplex auto
 speed auto
 shutdown
!
interface Serial0/0/0
 ip address 210.10.0.6 255.255.255.252
 crypto map smap
!
interface Serial0/0/1
 no ip address
 clock rate 2000000
 shutdown
!
interface Vlan1
 no ip address
 shutdown
!
router eigrp 10
 redistribute ospf 1 metric 1 1 1 1 1 
 network 192.168.3.0
 auto-summary
!
router ospf 1
 log-adjacency-changes
 redistribute eigrp 10 
 network 210.10.0.4 0.0.0.3 area 0
!
ip classless
!
ip flow-export version 9
!
!
ip access-list extended vpn
 permit ip 192.168.3.0 0.0.0.255 10.0.0.0 0.255.255.255
 permit ip 192.168.3.0 0.0.0.255 20.0.0.0 0.255.255.255

I realize 2 routers R1 and R3 need to be routed.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.