06-08-2012 04:06 PM - edited 03-11-2019 04:17 PM
Hi folks,
My routers at two different sites are connected through GRE tunnels. I want to configure IPSec over it, but throug easy vpn server and client setup. Is it possible???? Apparently the most reasonable configuration for the mentioned scenario is site-to-site vpn, but I want to configure it through easy vpn. I would also appreciate if some one can refer to any configuration example of such kind of setup.The GRE tunnel is up and pings are successful but the traffic which passess through is not encryted.
Thanks
Solved! Go to Solution.
06-20-2012 03:25 PM
"means the async interface and internal LAN???"
To create a proof of concept, you can remove stub-zone EIGRP proccess ID for now.
adversties local inside network segment and loopback0 from both side.
thanks
06-20-2012 03:32 PM
hi,
I tried this nothing happen when a directly connected interface (async) does'nt becomes neighbor how the routes will exchnage.
06-20-2012 03:36 PM
I hope you copied the these lines as well.
ip route 192.168.255.4 255.255.255.252 Dialer0 track 123
ip route 192.168.255.4 255.255.255.252 Async1 250
As per above two lines, the neighbor will com up, only when ASDL fails.
As you can see, tunnel source is being pushed to Dialer0 interface instead.
06-20-2012 03:57 PM
Yes rizwan,
The async came up when the tracking default route went down still but there is no neighbor relationship,
06-20-2012 04:02 PM
Please post the config from both HO and branch router.
along with
debug eigrp packets query reply.
thanks
06-20-2012 04:37 PM
Rizwan,
There are no eigrp packets seen in the debugs. Also there is a problem in tracking the default route because the router is not installing a default route once we add the track command to the ip route.
The tracking is the culprit this is the reason dialup was initiating everytime. if have a look the adsl interface receive public IP but the tracking route is no t failling back to the routing table once the ADSL comes up.
TEST(config)#do sh ip route
Gateway of last resort is not set
101.0.0.0/24 is subnetted, 1 subnets
C 101.127.98.0 is directly connected, Vlan1
192.168.10.0/30 is subnetted, 1 subnets
C 192.168.10.0 is directly connected, Loopback0
92.0.0.0/32 is subnetted, 2 subnets
C 92.178.232.1 is directly connected, Dialer0
C 92.178.239.92 is directly connected, Dialer0
Please tell me do i shld advertise the async interface in eigrp
Thanks
router eigrp 10
network 101.127.98.1 0.0.0.0
network 192.168.10.1 0.0.0.0
no auto-summary
eigrp router-id 192.168.10.1
interface Tunnel0
ip address 172.17.1.2 255.255.255.0
delay 16000000
tunnel source Loopback0
tunnel destination 192.168.10.5
end
TEST#sh ip eigrp neighbors
IP-EIGRP neighbors for process 10
###############################################
HO
nterface Tunnel0
ip address 172.17.1.1 255.255.255.0
delay 16000000
tunnel source Loopback1
tunnel destination 192.168.10.1
end
router eigrp 10
network 10.1.1.26 0.0.0.0
network 192.168.10.5 0.0.0.0
no auto-summary
eigrp router-id 192.168.10.5
ip route 192.168.10.4 255.255.255.252 Dialer0 track 123
ip route 0.0.0.0 0.0.0.0 Dialer0 track 123
ip route 0.0.0.0 0.0.0.0 Async1 250
ip route 192.168.10.4 255.255.255.252 Async1 250
06-20-2012 05:31 PM
"Please tell me do i shld advertise the async interface in eigrp" Answer is no.
However, you should adverties tunnel interface's ip segment in the EIGRP, that makes the peering.
I do not see, from neither side, the tunnel's ip segment is being adverties, which you should.
----------------------------------------------------------------------
I assume based your input that this config from HO.
HO
nterface Tunnel0
ip address 172.17.1.1 255.255.255.0
delay 16000000
tunnel source Loopback1
tunnel destination 192.168.10.1
end
router eigrp 10
network 10.1.1.26 0.0.0.0
network 192.168.10.5 0.0.0.0
no auto-summary
eigrp router-id 192.168.10.5
ip route 192.168.10.4 255.255.255.252 Dialer0 track 123
ip route 0.0.0.0 0.0.0.0 Dialer0 track 123
ip route 0.0.0.0 0.0.0.0 Async1 250
ip route 192.168.10.4 255.255.255.252 Async1 250
You do not need IP-SLA from HO side but rather from branch side only.
You say tunnel destination is: "192.168.10.1" from HO side, but your static route for remote-branch's local loopback is different IP.
Network address for this ip: 192.168.10.1, is 192.168.10.0/30
In correct network address in the static-route, beside you do not need IP-SLA on HO side.
"ip route 192.168.10.4 255.255.255.252 Async1 250"
Please adverstie tunnel's ip address on HO router.
router eigrp 10
172.17.1.1 0.0.0.0
----------------------------------------------------------------------
This is for Branch.
router eigrp 10
network 101.127.98.1 0.0.0.0
network 192.168.10.1 0.0.0.0
no auto-summary
eigrp router-id 192.168.10.1
interface Tunnel0
ip address 172.17.1.2 255.255.255.0
delay 16000000
tunnel source Loopback0
tunnel destination 192.168.10.5
end
TEST#sh ip eigrp neighbors
IP-EIGRP neighbors for process 10
Please adverties tunnel's interface on the EIGRP processor.
router eigrp 10
172.17.1.2 0.0.0.0
Here you have to incorprate tunnel destination address into IP SLA
----------------------------------------------------------------------
Let me know.
thanks
06-21-2012 06:16 AM
Dear Rizwan,
Please find the attached Debug file1 and debug file 2,
Debug File 1 is when the dialer 0 is down,, manualy shutting down becz tracking is not working. Async interface are not advertised in eigrp only tunnel interface are advertised according to ur instruction.
Debug File 2 is when the dialer 0 is up and the async interface are advertised in eigrp, the async interface initiates a backup connection though the dialer is up.
Branch Configuration
int lo0
ip add 192.168.10.1 255.255.255.252
router eigrp 10
network 101.127.98.1 0.0.0.0
network 192.168.10.1 0.0.0.0
network 172.17.1.2 0.0.0.0
no auto-summary
eigrp router-id 192.168.10.1
interface Tunnel0
ip address 172.17.1.2 255.255.255.0
delay 16000000
tunnel source Loopback0
tunnel destination 192.168.10.5
end
############################################
HO Configuration
int lo1
ip add 192.168.10.5 255.255.255.252
interface Tunnel0
ip address 172.17.1.1 255.255.255.0
delay 16000000
tunnel source Loopback1
tunnel destination 192.168.10.1
end
router eigrp 10
network 10.1.1.26 0.0.0.0
network 192.168.10.5 0.0.0.0
network 172.17.1.1 0.0.0.0
no auto-summary
eigrp router-id 192.168.10.5
#####################################################
Route Tracking on Branch routers.
ip route 192.168.10.4 255.255.255.252 Dialer0 track 123
ip route 0.0.0.0 0.0.0.0 Dialer0 track 123
ip route 0.0.0.0 0.0.0.0 Async1 250
ip route 192.168.10.4 255.255.255.252 Async1 250
06-21-2012 07:18 AM
Hi Jack,
the config looks much better this time but it is still missing a static-route on the HO router.
So, please add a static-route one shown below.
ip route 192.168.10.0 255.255.255.252 Async1
I assume, "Async1" one is where modem connected, please correct according to your config.
let me know.
thanks.
06-21-2012 11:57 AM
Dear Rizwan,
On Branch
BUT AGAIN I CAME UP WITH NEW ISSUE:
#########################################
ON HO
I have pointed a static route as such :
ip route 192.168.10.0 255.255.255.252 172.16.1.2 ------>Branch is a next-hop
I dont have below option for next hop
ip route 192.168.10.0 255.255.255.252 group-async 0 -----> i dont have a group-async0 option
interface Group-Async0
ip unnumbered Loopback0
encapsulation ppp
dialer in-band
dialer idle-timeout 300
dialer-group 5
async mode dedicated
no peer default ip address
ppp authentication chap
group-range 0/386 0/396
routing dynamic
06-22-2012 01:02 PM
Hi Jack,
"when dialer 0 come up again the async routes vanishes from the routing table"
When EIGRP peer is not reachable, routes will be delted from routing table, however it should be able to reache via ADSL connection.
"still the dial backup remains up and eigrp neighbor remains up."
On Dialer0 (i.e. for ADSL) interface please apply this command on branch router and I assume Async1 interface modem is connectedd.
Interface Dialer0
backup interface tunnel0
backup delay 3 15
Now, on the Async1 interface please apply this two lines.
Interface Async1
dialer idle-timeout 15
dialer watch-disable 15
Let me know, how this coming along.
thanks
06-22-2012 04:07 PM
Hello,
Rizwan ur solution is perfect but i have some issues that i have noticed, I divide this in 2 PART
PART I :----------THERE IS NO PROBLEM WORKS FINE
when command in the running config:
ip route 0.0.0.0 0.0.0.0 Dialer0
ip route 0.0.0.0 0.0.0.0 Async1 89
ip route 192.168.10.4 255.255.255.252 Dialer0
ip route 192.168.10.4 255.255.255.252 Async1 89
If you see above there are no track commands to remove the route so i m removing manualy
no ip route 0.0.0.0 0.0.0.0 Dialer0
no ip route 192.168.10.4 255.255.255.252 Dialer0
It failover to async interface and everything work perfect without any issues,,
PINGS are 100%
Async disconnects as soon as we apply the dialer 0 route back and when the dialer interface comes up.
EVERYTHING IS OK IN ABSENCE OF TRACK COMMAND WITH STATIC ROUTE.
#####################################################################################################################
PART II:----------- EVERYTHING FAILS WITH TRACK COMMANDS
when command in the running config:
ip route 192.168.10.4 255.255.255.252 Dialer0 track 123
ip route 0.0.0.0 0.0.0.0 Dialer0 track 123
ip route 0.0.0.0 0.0.0.0 Async1 89
ip route 192.168.10.4 255.255.255.252 Async1 89
sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 0.0.0.0 to network 0.0.0.0
101.0.0.0/24 is subnetted, 1 subnets
C 101.127.98.0 is directly connected, Vlan1
192.168.10.0/30 is subnetted, 2 subnets
C 192.168.10.0 is directly connected, Loopback0
S 192.168.10.4 is directly connected, Dialer0
172.17.0.0/24 is subnetted, 1 subnets
C 172.17.1.0 is directly connected, Tunnel0
172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks
C 172.16.1.1/32 is directly connected, Async1
C 172.16.1.0/24 is directly connected, Async1
10.0.0.0/24 is subnetted, 1 subnets
D 10.1.1.0 [90/4121600256] via 172.17.1.1, 00:01:16, Tunnel0
92.0.0.0/32 is subnetted, 2 subnets
C 92.61.172.239 is directly connected, Dialer0
C 92.61.160.1 is directly connected, Dialer0
S* 0.0.0.0/0 is directly connected, Dialer0
################################################################################################################
According to ur previous mail instructions:
There is no backup command on dialer interface
.TEST(config)#interface dialer 0
TEST(config-if)#backu?
% Unrecognized command
TEST(config-if)#?
Interface configuration commands:
access-expression Build a bridge boolean access expression
arp Set arp type (arpa, probe, snap) or timeout or log options
ase Configure ASE on an interface
autodetect Autodetect Encapsulations on Serial interface
bandwidth Set bandwidth informational parameter
bgp-policy Apply policy propagated by bgp community string
bridge-group Transparent bridging interface parameters
carrier-delay Specify delay for interface transitions
cdp CDP interface subcommands
clock Configure serial interface clock
############################################################################
And Also there is no dialer watch-disable 15 command under async interface
##########################################################################
06-22-2012 06:53 PM
"EVERYTHING IS OK IN ABSENCE OF TRACK COMMAND WITH STATIC ROUTE."
Try with different IOS on the branch router, I am not sure whether this particular IOS on your branch router has a bug related IP-SLA and tracking.
If that does not help, you have to go back to ISDN-style DDR (Demand Dial Routing), which you can use "watch-list" basically a way of tracking.
http://www.cisco.com/en/US/tech/tk801/tk379/technologies_configuration_example09186a0080094143.shtml
---------------------------------------------------------------
dialer map ip xxx.xxx.xxx.xx HeadOffic broadcast 5555555555
dialer map ip 0.0.0.0 HeadOffic broadcast 5555555555
dialer watch-list 100 ip 0.0.0.0 0.0.0.0
access-list 101 deny EIGRP any any
access-list 101 permit any any
dialer-list 1 protocol ip list 101
Interface Async1
dialer idle-timeout 30
dialer watch-disable 15
dialer map ip xxx.xxx.xxx.xxx HeadOffic broadcast 5555555555
dialer map ip 0.0.0.0 HeadOffic broadcast 5555555555
dialer watch-group 100
dialer-group 1
-------------------------------
In this setup you have to keep the each IP-SLA tracking for each remote-branch office on HO router, you would not need a dynamic-routing protocol.
Look forward to hear from you.
thanks
Message was edited by: Rizwan Mohamed
06-23-2012 09:14 AM
Rizwan
In this setup you have to keep the each IP-SLA tracking for each remote-branch office on HO router, you would not need a dynamic-routing protocol.
What i understand by above line is below.Please correct me if i m wrong.
Int BVI
descriotion to ISP ***** link 8 MB**********
ip add 1.1.1.1. 255.255.255.255.252 ------fixed public ip
ip route 0.0.0.0 0.0.0.0 BVI0
ip route 10.10.0.0 255.255.0.0 BVI0 track 123
ip route 10.10.0.0 255.255.0.0 172.16.1.2 250 -------> to async interface of branch router.
ip sla monitor 1---for branch A
type echo protocol ipIcmpEcho 10.10.10.1---this will be for branch A
timeout 1000
frequency 3
threshold 2
track 123 rtr 1 reacheability
The above configuration what i wrote will not work becz if u remember in previous thread i told you about RRI routes which are not deleted from the routing table though the client has disconnected from the EASY VPN SERVER connection.
For example:
suppose branch ADSL fails and the branch async comes up the branch ASYNC will send traffic ,,but the return traffic from HO will hit to BVI becz the RRI route is still present in routing table and the AD is also less,,so all traffic will drop.
Thanks
06-23-2012 09:43 AM
Hi Jack,
Administrative Distance can be change and you can force to delete security-association idle-time to the least value of 60 seconds from both location HO and branch, when security-assocation is deleted, there is nothing left.
crypto ipsec security-association idle-time
set reverse-route distance
set reverse-route distance 90
--------------------------------------------
When you creat IP-SLA on HO router for each branch office, please use exact network and mask what is set at branch office.
ip route 0.0.0.0 0.0.0.0 BVI0
ip route 10.10.10.0 255.255.255.0 BVI0 track 123
ip route 10.10.10.0 255.255.255.0 172.16.1.2 20
when route fails for branch "A" at HO router, only the IP-SLA for branch "A" must failover to dial interface.
http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a0080094823.shtml
Please update.
thanks
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide