Hello!
i've got some Problems with a Cisco 1941 running 15.2...
I've got two DSL (PPPoE Dialer) WAN-interfaces. I want the normal Internet traffic go through DSL-1 and the VPN go through DSL-2. So i set the default route through Dialer1 and the route heading to the IP of the Brach-Site (R.R.R.R) through Dialer2.
on R1: Ping R.R.R.R -> works fine
on R2: Ping Y.Y.Y.Y -> works fine
on R2: ssh Y.Y.Y.Y -> works fine
so i guess routing should work?
but the VPN wont be established:
router-wi#show cry sess
Crypto session current status
Interface: Dialer1
Session status: DOWN-NEGOTIATING
Peer: B.B.B.B port 500
IKEv1 SA: local X.X.X.X/500 remote B.B.B.B/500 Inactive
IPSEC FLOW: permit ip 172.20.100.0/255.255.255.0 172.20.110.0/255.255.255.0
Active SAs: 0, origin: crypto map
IPSEC FLOW: permit ip 192.168.100.0/255.255.255.0 192.168.40.0/255.255.255.0
Active SAs: 0, origin: crypto map
Interface: Dialer2
Session status: DOWN
Peer: B.B.B.Bport 500
IPSEC FLOW: permit ip 172.20.100.0/255.255.255.0 172.20.110.0/255.255.255.0
Active SAs: 0, origin: crypto map
IPSEC FLOW: permit ip 192.168.100.0/255.255.255.0 192.168.40.0/255.255.255.0
Active SAs: 0, origin: crypto map
Even when i remove the VPN-D1 Crypto map, no VPN can be established. Only when i shutdown the Dialer1 interface and the default Route also goes throug Dialer2 the VPN is established correctly...
R1 config:
.....
track 1 ip sla 1
delay down 5 up 2
!
track 2 ip sla 2
delay down 5 up 2
!
crypto isakmp policy 1
encr aes 256
hash sha512
authentication pre-share
!
crypto isakmp key xxxxx address R.R.R.R
crypto isakmp xauth timeout 10
!
crypto ipsec transform-set VPN_TS esp-aes 256 esp-sha512-hmac
!
crypto map VPN-D1 10 ipsec-isakmp
set peer R.R.R.R
set transform-set VPN_TS
match address VPN_1
crypto map VPN-D1 20 ipsec-isakmp
set peer R.R.R.R
set transform-set VPN_TS
match address VPN_2
!
crypto map VPN-D2 10 ipsec-isakmp
set peer R.R.R.R
set transform-set VPN_TS
match address VPN_1
crypto map VPN-D2 20 ipsec-isakmp
set peer R.R.R.R
set transform-set VPN_TS
match address VPN_2
!
interface GigabitEthernet0/0
description green
no ip address
ip virtual-reassembly in
ip tcp adjust-mss 1412
duplex auto
speed auto
!
interface GigabitEthernet0/0.1
description Wlan (VPN_1 Network)
encapsulation dot1Q 2 native
ip address 192.168.100.2 255.255.255.0
ip nbar protocol-discovery
ip flow ingress
ip flow egress
ip nat inside
ip virtual-reassembly in
!
interface GigabitEthernet0/1
description orange
no ip address
ip tcp adjust-mss 1412
duplex auto
speed auto
!
interface GigabitEthernet0/1.1
description VPN_2 Network
encapsulation dot1Q 1 native
ip address 172.20.100.2 255.255.255.0
ip nbar protocol-discovery
ip flow ingress
ip flow egress
ip virtual-reassembly in
!
interface FastEthernet0/0/0
description -= to DSL-1 =-
no ip address
duplex auto
speed auto
pppoe enable group global
pppoe-client dial-pool-number 1
!
interface FastEthernet0/0/1
description -= to DSL-2 =-
no ip address
ip virtual-reassembly in
duplex auto
speed auto
pppoe enable group global
pppoe-client dial-pool-number 2
!
interface Dialer1
description -= DSL-1 (Vdsl) =-
ip address negotiated
ip mtu 1452
ip nbar protocol-discovery
ip flow ingress
ip flow egress
ip nat outside
ip virtual-reassembly in
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication chap pap callin
ppp chap hostname feste-ip7/xxx@t-online-com.de
ppp chap password 0 xxx
ppp pap sent-username feste-ip7/xxx@t-online-com.de password 0 xxx
crypto map VPN-D1
!
interface Dialer2
description -= DSL-2 (T-DSL) =-
ip address negotiated
ip mtu 1452
ip nbar protocol-discovery
ip flow ingress
ip flow egress
ip nat outside
ip virtual-reassembly in
encapsulation ppp
dialer pool 2
dialer-group 2
ppp authentication chap pap callin
ppp chap hostname feste-ip2/xxx@t-online-com.de
ppp chap password 0 xxx
ppp pap sent-username feste-ip2/xxx@t-online-com.de password 0 xxx
crypto map VPN-D2
!
.......
!
ip dns server
ip nat inside source route-map DSL-1 interface Dialer1 overload
ip nat inside source route-map DSL-2 interface Dialer2 overload
ip route B.B.B.B 255.255.255.255 Dialer2 10 track 2
ip route 0.0.0.0 0.0.0.0 Dialer1 30 track 1
ip route 0.0.0.0 0.0.0.0 Dialer2 50 track 2
!
ip access-list extended VPN_2
permit ip 172.20.100.0 0.0.0.255 172.20.110.0 0.0.0.255
ip access-list extended VPN_1
permit ip 192.168.100.0 0.0.0.255 192.168.40.0 0.0.0.255
!
ip radius source-interface GigabitEthernet0/0.1
ip sla 1
icmp-echo X.X.X.X
tag Check DSL-1
threshold 300
timeout 500
frequency 5
ip sla schedule 1 life forever start-time now
ip sla 2
icmp-echo Y.Y.Y.Y
tag Check DSL-2
threshold 300
timeout 500
frequency 1
ip sla schedule 2 life forever start-time now
access-list 100 remark -= NAT Route-Map DSL-1 ACL =-
access-list 100 deny ip 192.168.100.0 0.0.0.255 192.168.40.0 0.0.0.255
access-list 100 permit ip 192.168.100.0 0.0.0.255 any
access-list 101 remark -= NAT Route-Map DSL-2 ACL =-
access-list 101 deny ip 192.168.100.0 0.0.0.255 192.168.40.0 0.0.0.255
access-list 101 permit ip 192.168.100.0 0.0.0.255 any
dialer-list 1 protocol ip permit
dialer-list 2 protocol ip permit
!
route-map DSL-2 permit 10
match ip address 101
match interface Dialer2
route-map DSL-1 permit 10
match ip address 100
match interface Dialer1
R2 config:
....
crypto map VPN 10 ipsec-isakmp
set peer Y.Y.Y.Y
set peer X.X.X.X
set transform-set VPN_TS
match address VPN_1
crypto map VPN 20 ipsec-isakmp
set peer Y.Y.Y.Y
set peer X.X.X.X
set transform-set VPN_TS
match address VPN_2
...
