Does anyone have a workable configuration for a ISR43xx that provides IPSec VPN connectivity to multiple sites over the Internet using NAT? I can't seem to get mine working. I'm I missing something? One tunnel comes up but the other one doesn't. Please share if you have one
Thank you
crypto isakmp policy 1
encr aes 256
authentication pre-share
group 14
crypto isakmp key xxxxx address 24.x.x.x
crypto isakmp key xxxxx address 208.x.x.x
crypto ipsec transform-set TS-S2S-VPN esp-aes 256 esp-sha-hmac
mode transport
crypto ipsec profile IPSEC-S2S-VPN
set security-association lifetime seconds 86400
set transform-set TS-S2S-VPN
!
!
!
crypto map IPSEC-SITE-TO-SITE-VPN 10 ipsec-isakmp
set peer 24.x.x.x
set transform-set TS-S2S-VPN
match address SITE1
crypto map IPSEC-SITE-TO-SITE-VPN 20 ipsec-isakmp
set peer 208.x.x.x
set transform-set TS-S2S-VPN
match address SITE2
nterface GigabitEthernet0/0/0
description Outside LAN Interface
ip address 197.x.x.x 255.255.255.252
ip nat outside
negotiation auto
crypto map IPSEC-SITE-TO-SITE-VPN
ip nat inside source route-map NAT-SELF-RMAP interface GigabitEthernet0/0/0 overload
access-list 101 remark ---- Outbound NAT Rules ----
access-list 101 deny ip 192.168.0.0 0.0.0.255 192.168.10.0 0.0.0.255
access-list 101 deny ip 192.168.0.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 101 deny ip 192.168.0.0 0.0.0.255 192.168.3.0 0.0.0.255
access-list 101 deny ip 192.168.0.0 0.0.0.255 192.168.92.0 0.0.0.255
access-list 101 deny ip 192.168.0.0 0.0.0.255 192.168.93.0 0.0.0.255
access-list 101 deny ip 192.168.91.0 0.0.0.255 192.168.10.0 0.0.0.255
access-list 101 permit ip 192.168.0.0 0.0.0.255 any
access-list 101 permit ip 192.168.10.0 0.0.0.255 any
access-list 101 permit ip 192.168.11.0 0.0.0.255 any
access-list 101 permit ip 192.168.91.0 0.0.0.255 any
access-list 101 permit ip 10.168.11.0 0.0.0.255 any
access-list 101 deny ip any any
route-map NAT-SELF-RMAP permit 1
match ip address 101
match interface GigabitEthernet0/0/0
GW
