Hello,
I have two Cisco 861 in different places connected to internet with fixed public IP, i wanna to make an encrypted tunnel between two routers to send and receive multicast traffic, knowing there's ping succeeded between 192.168.3.0 and 192.168.1.0, but can't send or receive multicast traffic! and can't apply 'ip multicast-routing' command. Below the configuration on routers :
#show ver
Cisco IOS Software, C860 Software (C860-UNIVERSALK9-M), Version 15.1(4)M4, RELEASE SOFTWARE (fc1)
---------------------------------------------------------------------------------------------------
hostname R1
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 10
!
!
ip source-route
!
!
ip cef
!
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 5
crypto isakmp key secretkey address y.y.y.2
!
!
crypto ipsec transform-set R1-R2 esp-aes 256 esp-sha-hmac
!
crypto map IPSEC-MAP 10 ipsec-isakmp
set peer y.y.y.2
set security-association lifetime seconds 86400
set transform-set R1-R2
set pfs group5
match address 100
!
!
!
!
!
interface FastEthernet0
switchport access vlan 300
!
interface FastEthernet1
switchport access vlan 300
!
interface FastEthernet2
switchport access vlan 300
!
interface FastEthernet3
switchport access vlan 300
!
interface FastEthernet4
ip address x.x.x.2 255.255.255.252
duplex auto
speed auto
crypto map IPSEC-MAP
!
interface Vlan1
no ip address
!
interface Vlan300
ip address 192.168.1.1 255.255.255.0
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
ip route 0.0.0.0 0.0.0.0 x.x.x.1
!
access-list 100 permit ip 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255
!
control-plane
!
!
line con 0
no modem enable
line aux 0
line vty 0 4
login
!
scheduler max-task-time 5000
end
--------------------------------------------------------------------------------------------------
hostname R2
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
memory-size iomem 10
crypto pki token default removal timeout 0
!
!
ip source-route
!
!
!
!
!
ip cef
!
!
license accept end user agreement
!
!
!
!
!
!
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 5
crypto isakmp key secretkey address x.x.x.2
!
!
crypto ipsec transform-set R2-R1 esp-aes 256 esp-sha-hmac
!
crypto map IPSEC-MAP 10 ipsec-isakmp
set peer x.x.x.2
set security-association lifetime seconds 86400
set transform-set R2-R1
set pfs group5
match address 100
!
!
!
!
!
interface FastEthernet0
switchport access vlan 301
no ip address
!
interface FastEthernet1
switchport access vlan 301
no ip address
!
interface FastEthernet2
switchport access vlan 301
no ip address
!
interface FastEthernet3
switchport access vlan 301
no ip address
!
interface FastEthernet4
ip address y.y.y.2 255.255.255.252
duplex auto
speed auto
crypto map IPSEC-MAP
!
interface Vlan1
no ip address
!
interface Vlan301
ip address 192.168.3.1 255.255.255.0
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
ip route 0.0.0.0 0.0.0.0 y.y.y.1
!
access-list 100 permit ip 192.168.3.0 0.0.0.255 192.168.1.0 0.0.0.255
!
line con 0
line aux 0
line vty 0 4
login
transport input all
!
end
