Dynamic and Static crypto map on one interface

[filip00011]

I need to apply dynamic and static crypto map to one interface. is it possible?

crypto isakmp policy 10
 hash md5
 authentication pre-share
!
crypto isakmp policy 11
 encr 3des
 hash md5
 authentication pre-share
 group 5
crypto isakmp key hronov address 50.76.65.124
crypto isakmp key pardubice address 0.0.0.0 0.0.0.0
!
!
crypto ipsec transform-set DYN-TS esp-3des esp-md5-hmac
crypto ipsec transform-set ESP_3DES_MD5 esp-3des esp-md5-hmac
 mode transport
!
crypto dynamic-map DYN 10
 set transform-set DYN-TS
!
!
!
crypto map IPSEC 10 ipsec-isakmp dynamic DYN
!
crypto map GRE_AND_IPSEC 11 ipsec-isakmp
 set peer 50.76.65.124
 set transform-set ESP_3DES_MD5
 match address GRE

[Philip D'Ath · Accepted solution]

Yes.  Slightly changed.

Make the site to site key so it can not be used for xauth (aka client authentication).

crypto isakmp key hronov address 50.76.65.124 no-xauth

Make the specific site to site crypto map come first (priority 10 in this case).

crypto map IPSEC 10 ipsec-isakmp
 set peer 50.76.65.124
 set transform-set ESP_3DES_MD5
 match address GRE

Make the dynamic map low priority (60000) in this case.

crypto map IPSEC 60000 ipsec-isakmp dynamic DYN

[filip00011]

thank you so much. it's working

can you please explain me what does no-xauth do?

[Philip D'Ath]

If you enabled a dynamic crypto map, and a connection comes in, the router challenges it asking for a username/password. Site to site VPN connections have no such concept. no-xauth says don't challenge for a username/password for this specific IP address and key.

[filip00011]

thanks