Cisco Community
English
Register
Register
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
146
Views
0
Helpful
0
Replies
MaDe
Beginner
Beginner
‎06-12-2013 07:07 AM
‎06-12-2013 07:07 AM

best practise / site-2-site VPN / ppp connection / secondary public ip space

Good day all,

today I saw this setup in one of our branch offices.

           ISP

    T1 |          | T1

    S1 |          | S2

     Branch Router

fe0/0 |          | fe0/1

                   |

         Switch

              |

              |

           Client

The ISP gave us two T1 connection. We terminate the T1's on our Router and configured it with ppp encapsulation and mutlilink, this works.

Also the ISP gave us a secondary public IP space. We configured the public IP on the fe0/0 interface.

So now the Branch office is requesting for a Site-2-Site VPN. VPN terminates in our HQ on a ASA 5510.

At the moment I have this setups:

1. Crypto map is added to fe0/0 -> VPN tunnel is up. But traffic flows only from ASA to branch offices. No packets from branch to ASA.

2. Crypto map is added to Multilink 1 interface -> VPN tunnel is up. Traffic flows in both directions.

So Ok VPN works and is stable. But is this best practise?

I would like to configure the VPN to work with the second public ip space but I'm struggling with the config. I dont know why packet are not routed through the VPN.

Any Ideas to point me in the right direction.

Thanks Markus

Labels:
0 Helpful
0 REPLIES 0
Latest Contents
Email Security - QuoVadis Root Certificate Decommission Migh...
Created by dmccabej on 03-30-2021 09:32 AM
0
0
0
0
Problem Description For all versions of the Email Security Appliance (ESA) and Security Management Appliance (SMA), some Secure Sockets Link (SSL) certificates issued from the QuoVadis root certificate authority (CA) trust chain before 2021-03-31 cannot b... view more
ISE REST APIs Webinar: April 6/7, 2021
Created by thomas on 03-25-2021 07:57 PM
1
5
1
5
  Register Now Automation and programmability for networking and security are increasingly important topics. Every release since ISE 1.2 has included new REST API capabilities to better automate and integrate ISE with the rest of your network, appli... view more
FMT 2.3.4 adding ASA migrations of S2S VPN in public beta
Created by William_Hansch on 03-22-2021 08:00 AM
1
10
1
10
The latest iteration (v2.3.4) of the Cisco Secure Firewall Migration Tool adds public beta support for S2S VPN migrations from ASA: Policy-based (crypto map) Pre-Shared key authentication type VPN configuration to Firepower Management Center VP... view more
What's New for Cisco Defense Orchestrator (CDO)
Created by Andrew Mallio on 03-22-2021 04:40 AM
1
40
1
40
Cisco Defense Orchestrator (CDO) is a cloud-based, multi-device manager that manages security products like Adaptive Security Appliance (ASA), Firepower Threat Defense next-generation firewall, and Meraki devices, to name a few.  We make improvement... view more
ISE Data limiting best practices
Created by Jonathan Casillas on 03-18-2021 04:34 PM
0
5
0
5
Intro This document presents the ISE data limiting best practices that can dramatically improve the system performance on ISE. Symptoms Your deployment may be impacted if the alarms tab on ISE shows High load average, high CPU or high memoy usage alarm... view more
Content for Community-Ad