site-to-site vpn behind provider router (adsl)

[danielscharf]

Hi,

we have a working gre/ipsec vpn connection between branch office (2 x cisco 1800 series) and headquarter. Now we have to change on branch site from provider with static ip addresses for our routers to an adsl-internet access using private ip addresses on the adsl-router's private site... what change are neccessary to get the vpn working?

I there a cisco documentation / configuration example available. I cannot find some thing like this.

thank you a lot!

kind regards

Daniel Scharf

[rosscourtnell]

Hi Daniel

If I am reading your post correctly, the only thing that would need to be changed is the peer ip of the remote site on your headquarters VPN device. This would be the public IP of your new adsl connection.

HTH

Ross

[Latchum Naidu]

Hi Daniel,

If I understand correctly, your internet connection at branch will be changed to ADSL where you dont have public IP.

You can set up a site-to-site between both sites but regular configuration assumes static public IPs on both ends.

Since one side is having a dynamic IP, then you have two options:

1. Site-to-Site Static-to-Dynamic configuration between both routers
2. EzVPN configuration
Also, I've seen people doing DDNS to create a tunnel when the IP changes.

And also you have some options...

For example if R1 modem can be configured to statically redirect IPsec traffic to the internal private IP of R1, then you can set a regular site-to-site VPN using NAT on the modem.

Most of the times this is not done and instead you configure either of the two options that I told you.

You can definitely configure a Site-to-Site tunnel between both sides, the tweak is that you must adapt it to Static-to-Dynamic configuration or implement an EzVPN configuration.

Hope the below link will help you more.
http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a0080093f86.shtml

Please rate the helpful posts.
Regards,
Naidu.

[danielscharf]

Hi guys,

thank you for your replies!

The branch site will use an adsl with one dynamic ip-address instead of a sdsl with multiple static adresses that is the current situation. So at the moment our branch routers both has public ip addresses and I have configured a site-to-site vpn (2 headquarter-routers, 2 branch routers = 4 public ip addresses). In future the two branch routers will have private ip addresse (behind the adsl router) and the router has one dynamic public ip address...

So I will try the two options written by Latchum Naidu.

Thank you a lot !!!

Kind regards

Daniel Scharf

[Latchum Naidu]

Hi Daniel,

The two options what I gave wil definetly will work out as I did the same at one of my site.
And Please remember to rate the helpfull posts.

Please rate the helpful posts.
Regards,
Naidu.