I tried to setup VPN site to site but failed. The VPN tunnel couldn't be up.
My network diagram:
Please take a look into my configuration and give me an advice.
VietNam Router:
service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname Router ! boot-start-marker boot-end-marker ! ! ! no aaa new-model ethernet lmi ce ! ! ! mmi polling-interval 60 no mmi auto-configure no mmi pvc mmi snmp-timeout 180 ! ! ! ! ! no ip icmp rate-limit unreachable ! ! ! ! ! ! no ip domain lookup ip cef no ipv6 cef ! multilink bundle-name authenticated ! ! ! ! ! redundancy ! no cdp log mismatch duplex ! ip tcp synwait-time 5 ! ! ! ! ! crypto isakmp policy 10 encr aes authentication pre-share group 2 crypto isakmp key XVNdcegX4fkXE6hN address 192.168.40.160 no-xauth ! ! crypto ipsec transform-set ESP-AES128-SHA esp-aes esp-sha-hmac mode tunnel ! ! ! crypto map VPNMap 10 ipsec-isakmp set peer 192.168.40.160 set transform-set ESP-AES128-SHA set pfs group2 match address ACL-TunnelVietnamNetherlands ! ! ! ! ! interface GigabitEthernet0/0 ip address 192.168.40.150 255.255.255.0 ip nat outside ip virtual-reassembly in duplex auto speed auto media-type rj45 crypto map VPNMap ! interface GigabitEthernet0/1 ip address 10.10.10.1 255.255.255.0 ip nat inside ip virtual-reassembly in duplex auto speed auto media-type rj45 ! interface GigabitEthernet0/2 no ip address shutdown duplex auto speed auto media-type rj45 ! interface GigabitEthernet0/3 no ip address shutdown duplex auto speed auto media-type rj45 ! ip forward-protocol nd ! ! no ip http server no ip http secure-server ip nat inside source list 100 interface GigabitEthernet0/0 overload ip route 0.0.0.0 0.0.0.0 192.168.40.2 ! ip access-list extended ACL-TunnelVietnamNetherlands permit ip 10.10.10.0 0.0.0.255 20.20.20.0 0.0.0.255 ! ! ! access-list 100 permit ip 10.10.10.0 0.0.0.255 any ! control-plane ! ! line con 0 exec-timeout 0 0 privilege level 15 logging synchronous line aux 0 exec-timeout 0 0 privilege level 15 logging synchronous line vty 0 4 login transport input none ! no scheduler allocate ! end
Netherlands Router:
service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname Router ! boot-start-marker boot-end-marker ! ! ! no aaa new-model ethernet lmi ce ! ! ! mmi polling-interval 60 no mmi auto-configure no mmi pvc mmi snmp-timeout 180 ! ! ! ! ! no ip icmp rate-limit unreachable ! ! ! ! ! ! no ip domain lookup ip cef no ipv6 cef ! multilink bundle-name authenticated ! ! ! ! ! redundancy ! no cdp log mismatch duplex ! ip tcp synwait-time 5 ! ! ! ! ! crypto isakmp policy 10 encr aes authentication pre-share group 2 crypto isakmp key XVNdcegX4fkXE6hN address 192.168.40.150 no-xauth ! ! crypto ipsec transform-set ESP-AES128-SHA esp-aes esp-sha-hmac mode tunnel ! ! ! crypto map VPNMap 10 ipsec-isakmp set peer 192.168.40.150 set transform-set ESP-AES128-SHA set pfs group2 match address ACL-TunnelNetherlandsVietNam ! ! ! ! ! interface GigabitEthernet0/0 ip address 192.168.40.160 255.255.255.0 ip nat outside ip virtual-reassembly in duplex auto speed auto media-type rj45 ! interface GigabitEthernet0/1 ip address 20.20.20.1 255.255.255.0 ip nat inside ip virtual-reassembly in duplex auto speed auto media-type rj45 ! interface GigabitEthernet0/2 no ip address shutdown duplex auto speed auto media-type rj45 ! interface GigabitEthernet0/3 no ip address shutdown duplex auto speed auto media-type rj45 ! ip forward-protocol nd ! ! no ip http server no ip http secure-server ip nat inside source list 100 interface GigabitEthernet0/0 overload ip route 0.0.0.0 0.0.0.0 192.168.40.2 ! ip access-list extended ACL-TunnelNetherlandsVietNam permit ip 20.20.20.0 0.0.0.255 10.10.10.0 0.0.0.255 ! ! ! access-list 100 permit ip 20.20.20.0 0.0.0.255 any ! control-plane ! ! line con 0 exec-timeout 0 0 privilege level 15 logging synchronous line aux 0 exec-timeout 0 0 privilege level 15 logging synchronous line vty 0 4 login transport input none ! no scheduler allocate ! end
Thank you !
