Re: VPN Between two CISCO 877 Routers

simonsellen · ‎12-14-2012

Hi,

Trying to set up a very simply IPSec VPN connection from my Head Office to a couple of remote sites. I want to use CISCO 877 Routers both at head office and at each remote location. This means the head office 877 needs to be set up for multiple VPNs. I already have the CISCO 877 at both ends working as ADSL routers. Does anyone have a simple configuration that works or can point me in the right direction? I did look at the CISCO manuals and there is mostly good stuff in there but a few things I think are not very clear and therefore confusing.

Thanks very much,

Simon

Jeff Van Houten · ‎12-14-2012

Doc Id 41940 is a good reference for DMVPN.

Sent from Cisco Technical Support iPad App

johnlloyd_13 · ‎12-15-2012

Hi,

I've encountered this article about DVTI while studying for my CCNP SECURE. I was able to labbed it flawlessly using couple of our 877s and ran OSPF.

You can use a hub-and-spoke topology and run dynamic routing protocols. Make sure you've got a K9 IOS image.

Sent from Cisco Technical Support iPhone App

Syed Siraj Uddin · ‎12-16-2012

Hello, Below is the sample configuration for Head Office and Branch Office (Hub and spoke).

Head Office:

hostname HEADOFFICE-RTR

!

crypto isakmp policy 10

encr aes

hash md5

authentication pre-share

group 2

crypto isakmp key xyz@key address X.X.X.X no-xauth

!

crypto ipsec transform-set encrypt-des esp-des

!

crypto map vpn 10 ipsec-isakmp

set peer X.X.X.X

set transform-set encrypt-des

match address 100

!

interface ATM0

description ADSL Connected to ISP

no ip address

no ip redirects

no ip unreachables

no ip proxy-arp

ip route-cache flow

no atm ilmi-keepalive

dsl operating-mode auto

!

interface ATM0.1 point-to-point

pvc 0/35

pppoe-client dial-pool-number 1

!

interface Vlan1

description Head Office LAN

ip address 192.168.1.254 255.255.255.0

ip nat inside

ip virtual-reassembly

!

interface Dialer0

crypto map vpn

!

ip route 0.0.0.0 0.0.0.0 Dialer0

!

ip nat inside source list 101 interface Dialer0 overload

!

access-list 100 permit ip 192.168.1.0 0.0.0.255 10.10.10.0 0.0.0.255

access-list 101 deny ip 192.168.1.0 0.0.0.255 10.10.10.0 0.0.0.255

access-list 101 permit ip 192.168.1.0 0.0.0.255 any

Branch Office:

hostname BRANCH-RTR

!

crypto isakmp policy 10

encr aes

hash md5

authentication pre-share

group 2

crypto isakmp key xyz@key address Y.Y.Y.Y no-xauth

!

crypto ipsec transform-set encrypt-des esp-des

!

crypto map vpn 10 ipsec-isakmp

set peer Y.Y.Y.Y

set transform-set encrypt-des

match address 100

!

interface ATM0

description ADSL Connected to ISP

no ip address

no ip redirects

no ip unreachables

no ip proxy-arp

ip route-cache flow

no atm ilmi-keepalive

dsl operating-mode auto

!

interface ATM0.1 point-to-point

pvc 0/35

pppoe-client dial-pool-number 1

!

interface Vlan1

description Head Office LAN

ip address 10.10.10.1 255.255.255.0

ip nat inside

ip virtual-reassembly

!

interface Dialer0

crypto map vpn

!

ip route 0.0.0.0 0.0.0.0 Dialer0

!

ip nat inside source list 101 interface Dialer0 overload

!

access-list 100 permit ip 10.10.10.0 0.0.0.255 192.168.1.0 0.0.0.255

access-list 101 deny ip 10.10.10.0 0.0.0.255 192.168.1.0 0.0.0.255

access-list 101 permit ip 10.10.10.0 0.0.0.255 any

HTH

adnane dakna · ‎12-16-2012

Hello ,

You will found the toplogy of DMVPN in attached .zip file using GNS3 with two Spokes and Hub .

simonsellen · ‎12-16-2012

Thank you very much for your replies, most helpful even though it is not working yet.

I don't understnad this line:

crypto isakmp key xyz@key address X.X.X.X no-xauth

What do I set for the IP address? in the recommended article, Doc Id 41940, it has it as 0.0.0.0 as ip address.

Also, what would I have to do to add more than one spoke on the hub?

Thanks,

Simon

Here is the configuration for the SPOKE:

version 12.4

no service pad

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

!

hostname SPOKE

!

boot-start-marker

boot-end-marker

!

enable secret 5 xxxxxx

!

no aaa new-model

!

dot11 syslog

ip cef

no ip dhcp use vrf connected

ip dhcp excluded-address 192.168.2.254

!

ip dhcp pool DHCP_POOL

import all

network 192.168.2.0 255.255.255.0

dns-server 87.194.255.154 87.194.255.155 8.8.8.8

default-router 192.168.2.254

!

ip name-server 87.194.255.154

ip name-server 87.194.255.155

ip name-server 8.8.8.8

!

username xxxxx

!

crypto isakmp policy 1

authentication pre-share

crypto isakmp key xxxxx address 0.0.0.0 0.0.0.0

!

crypto ipsec transform-set trans2 esp-des esp-md5-hmac

mode transport

!

crypto map vpnmap1 local-address ATM0.1

crypto map vpnmap1 10 ipsec-isakmp

set peer 94.193.xx.xxx

set transform-set trans2

match address 101

!

archive

log config

hidekeys

!

bridge irb

!

interface Tunnel10

bandwidth 1000

ip address 10.0.0.2 255.255.255.0

ip mtu 1400

delay 1000

tunnel source ATM0.1

tunnel destination 94.193.xx.xxx

!

interface ATM0

no ip address

no ip redirects

no ip unreachables

no ip proxy-arp

no atm ilmi-keepalive

dsl operating-mode adsl2+

!

interface ATM0.1 point-to-point

description Link to BE

ip address 188.220.xx.xx 255.255.248.0

ip nat outside

ip virtual-reassembly

atm route-bridged ip

pvc 0/101

encapsulation aal5snap

!

crypto map vpnmap1

!

interface FastEthernet0

!

interface FastEthernet1

!

interface FastEthernet2

!

interface FastEthernet3

!

interface Vlan1

no ip address

bridge-group 1

!

interface BVI1

description Local LAN

ip address 192.168.2.254 255.255.255.0

ip nat inside

ip virtual-reassembly

!

ip forward-protocol nd

ip route 0.0.0.0 0.0.0.0 188.220.xx.xx

ip route 192.168.1.0 255.255.255.0 Tunnel10

!

ip http server

no ip http secure-server

ip nat inside source list 1 interface ATM0.1 overload

ip nat inside source static tcp 192.168.2.250 22 interface ATM0.1 22

ip nat inside source static tcp 192.168.2.250 21 interface ATM0.1 21

ip nat inside source static tcp 192.168.2.250 20 interface ATM0.1 20

!

access-list 1 permit 192.168.1.0 0.0.0.255

access-list 1 permit 192.168.2.0 0.0.0.255

access-list 101 permit gre host 188.200.xx.xx host 94.193.xx.xxx

!

control-plane

!

bridge 1 protocol ieee

bridge 1 route ip

!

line con 0

no modem enable

line aux 0

line vty 0

password xxx

login

line vty 1 4

login

!

scheduler max-task-time 5000

end

Can anyone see what the problem is?

Jeff Van Houten · ‎12-16-2012

On the hub the 0.0.0.0 address indicates that you will accept connections from any external DMVPN client that presents the proper authentication credentials.

Sent from Cisco Technical Support iPad App

simonsellen · ‎12-16-2012

oh ok, thanks for this, makes sense. On the hub I now have this configuration:

version 12.4

no service pad

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

!

hostname HUB

!

boot-start-marker

boot-end-marker

!

logging buffered 51200 warnings

!

no aaa new-model

!

crypto pki trustpoint TP-self-signed-3208576596

enrollment selfsigned

subject-name cn=IOS-Self-Signed-Certificate-3208576596

revocation-check none

rsakeypair TP-self-signed-3208576596

!

crypto pki certificate chain TP-self-signed-3208576596

certificate self-signed 01 nvram:IOS-Self-Sig#3.cer

dot11 syslog

ip cef

no ip dhcp use vrf connected

ip dhcp excluded-address 10.10.10.1

!

ip dhcp pool sdm-pool

import all

network 10.10.10.0 255.255.255.248

default-router 10.10.10.1

lease 0 2

!

ip dhcp pool DHCP_POOL

import all

network 192.168.1.0 255.255.255.0

dns-server 87.194.255.154 87.194.255.155 8.8.8.8

default-router 192.168.1.254

!

ip domain name yourdomain.com

ip name-server 87.194.255.154

ip name-server 87.194.255.155

ip name-server 8.8.8.8

!

username xxxx privilege 15 secret xxxxx

!

crypto isakmp policy 1

authentication pre-share

crypto isakmp key ciscotest address 188.220.xx.xx

!

crypto ipsec transform-set trans2 esp-des esp-md5-hmac

mode transport

!

crypto map vpnmap1 local-address ATM0.1

crypto map vpnmap1 10 ipsec-isakmp

set peer 188.220.xx.xx

set transform-set trans2

match address 101

!