What is the correct IOS to do IPsec VPN on Cisco 2811?

[closer152634]

Hi Team,

I have two Cisco router(2811) between 2 location datacenter. Lets name is as A & B. Both connection is using Point to Point leased line to establish connection. But recently, the Point-to-point leased line is down, and im not able to access the router in B connection from outside public IP. So right now, my task is to establish a second tunnel between this 2 router using a PPOE connection. So my question is:

1. How can i verify my running IOS in both router can support IPsec connection?

Current IOS is = System image file is "flash:c2800nm-adventerprisek9-mz.151-1.XB.bin"

License Info:

License UDI:

-------------------------------------------------
Device# PID SN
-------------------------------------------------
*0 CISCO2811 FHK0951F0Q3

2. What is the routing configuration that i need to add in both router?

[Richard Bradfield · Accepted solution]

advanced enterprise should support vpn, a quick check is to see if you can do "crypto" commands

this link should give you an idea of the configuration

http://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/22340-vpn-pppoe.html

[closer152634]

Hi Richard,

Thanks for your feedback. But I need to clarify 1 more question, If my router B have Dynamic PPPoe connection (not a FIX Public IP), and my router A have Fix Public IP, how can i establish a tunnel between them? Do i need to use DDNS in my router B?

And 2nd question, let say for my first routing in router A i point to leased line interface to router B, how can i make my second routing will go through to PPPoe Ipsec VPN that I've created, in case the primary leased line is down? below is the ip route configuration in my router A.

ip route 0.0.0.0 0.0.0.0 122.0.17.97
ip route 0.0.0.0 0.0.0.0 122.0.17.105 2
ip route 10.0.0.0 255.0.0.0 192.168.0.1 (this is the p2p routing)

[Richard Bradfield]

Please see this old document for dynamic to static VPN, might be pertinent in your case.

http://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/14131-ios-804.html

Re second question by using IP SLA and EEM scripts you can control the traffic

Use SLA to ping the remote end of your leased line. if it goes down then use an EEM script to change the default route thru the VPN