Hi all,
I have a Cisco C921-4PLTEGB currently connected to the EE network using its Cellular interface.
I have one VLAN (VLAN10) setup to connect back to our corporate network via a tunnel. All traffic by default should go down this tunnel for DHCP (10.11.18.0/24) and corporate services. This works perfectly.
I am then attempting to setup a separate voice VLAN (VLAN20). There is no point sending this traffic down the tunnel as its just going to be let out at the other end. So my aim is to allow all voice traffic out of the local internet gateway and avoid the tunnel. I have setup a separate VLAN for this and DHCP (192.168.1.0/24) will be allocated by the router.
My next question is, at what point (interface or cryptomap) do I tell any voice traffic (VLAN20) to not go down the tunnel?
Any suggestions would be greatly appreciated.
This is my current config:
Building configuration...
Current configuration : 5950 bytes
!
! Last configuration change at 11:31:19 gmt Sat Sep 18 2021 by administrator
!
version 15.8
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname myrouter
!
boot-start-marker
boot-end-marker
!
!
no logging console
!
aaa new-model
!
!
aaa authentication login default local
aaa authentication enable default enable
aaa authorization exec default local
!
!
!
!
!
!
aaa session-id common
clock timezone gmt 0 0
clock summer-time gmt recurring
!
!
!
!
!
!
!
!
ip dhcp excluded-address 192.168.1.254
!
ip dhcp pool vlan20
network 192.168.1.0 255.255.255.0
domain-name my-voice.local
dns-server 8.8.8.8 4.4.4.4
default-router 192.168.1.254
lease 5
!
!
!
ip domain name mydomain.local
ip name-server 10.11.2.5
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
chat-script lte "" "AT!CALL" TIMEOUT 20 "OK"
!
!
license udi pid C921-4PLTEGB sn PSZ25xxxx
!
!
object-group network My-IPs
host x.x.x.x
host x.x.x.x
!
!
vtp mode transparent
username administrator privilege 15 secret 5 $1$cqR4$NRzV5quieY0YCexxxx
username xx privilege 2 secret 5 $1$a0Wa$vTpgsppkDxxxxx
!
redundancy
!
crypto ikev2 proposal Prop-HQ-VPN
encryption aes-cbc-256
integrity sha256
group 21
!
crypto ikev2 policy POL-HQ-VPN
proposal Prop-HQ-VPN
!
crypto ikev2 keyring keyring-1
peer my-hq
address x.x.x.x
pre-shared-key local mykey
pre-shared-key remote mykey
!
!
!
crypto ikev2 profile PROFILE-HQ-VPN
match identity remote address x.x.x.x 255.255.255.255
identity local fqdn myrouter.mydomain.local
authentication remote pre-share
authentication local pre-share
keyring local keyring-1
!
no crypto ikev2 diagnose error
crypto ikev2 dpd 500 50 on-demand
no crypto ikev2 certificate-cache
!
!
controller Cellular 0
lte sim data-profile 1 attach-profile 1
lte modem crash-action boot-and-hold
!
vlan 10,20
!
!
crypto logging ikev2
!
crypto isakmp policy 1
encr aes 256
hash sha256
authentication pre-share
group 21
crypto isakmp keepalive 10 periodic
!
crypto ipsec security-association lifetime seconds 86400
!
crypto ipsec transform-set TS-HQ-VPN esp-aes 256 esp-sha256-hmac
mode tunnel
!
crypto ipsec profile PROFILE-ipsec
set pfs group21
set ikev2-profile PROFILE-HQ-VPN
!
!
!
crypto map CMAP-MY-HQ 1 ipsec-isakmp
set peer x.x.x.x
set security-association lifetime seconds 86400
set transform-set TS-HQ-VPN
set ikev2-profile PROFILE-HQ-VPN
match address VPN-TRAFFIC
!
!
!
!
!
interface Cellular0
ip address negotiated
encapsulation slip
dialer in-band
dialer idle-timeout 0
dialer string lte
dialer-group 1
async mode interactive
crypto map CMAP-MY-HQ
!
interface GigabitEthernet0
switchport mode trunk
no ip address
!
interface GigabitEthernet1
switchport access vlan 10
no ip address
!
interface GigabitEthernet2
switchport access vlan 20
no ip address
!
interface GigabitEthernet3
switchport mode trunk
no ip address
!
interface GigabitEthernet4
no ip address
shutdown
duplex auto
speed auto
!
interface GigabitEthernet5
no ip address
shutdown
duplex auto
speed auto
!
interface Vlan1
no ip address
shutdown
!
interface Vlan10
ip address 10.11.18.254 255.255.255.0
ip helper-address 10.11.202.1
no ip proxy-arp
ip nbar protocol-discovery
ip tcp adjust-mss 1452
load-interval 30
!
interface Vlan20
ip address 192.168.1.254 255.255.255.0
!
no ip forward-protocol nd
no ip http server
ip http authentication local
no ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
!
ip route 0.0.0.0 0.0.0.0 Cellular0
!
ip access-list extended LOCKDOWN-IN
permit udp any any eq bootps
permit udp any any eq bootpc
permit gre object-group MY-IPs any
permit esp object-group MYIPs any
permit ahp object-group MY-IPs any
permit ip object-group MY-IPs any
ip access-list extended VPN-TRAFFIC
permit ip 10.11.18.0 0.0.0.255 any
!
dialer-list 1 protocol ip permit
!
!
snmp-server community my-ro RO
snmp-server location My Office
snmp-server contact Me
snmp-server chassis-id myrouter
!
!
!
control-plane
!
privilege exec level 2 show startup-config
privilege exec level 2 show
banner motd ^C
*************************************************************
* *
* This device is owned and managed by Me. *
* Unauthorized access is strictly prohibited. *
* *
*************************************************************
^C
!
line con 0
privilege level 15
line 3
script dialer lte
no exec
rxspeed 100000000
txspeed 50000000
line vty 0 4
exec-timeout 1440 0
privilege level 15
transport input ssh
line vty 5 15
exec-timeout 1440 0
privilege level 15
transport input ssh
!
scheduler allocate 20000 1000
ntp server ntp.mydomain.local source Cellular0
!
end
