Hello,
we have a cisco 2821 and need to build a VPN access gateway. There following requirements:
1. user L2TP protocol in oder to use the native window IPSec client ( I tested it and it works perfect for a single user)
2. every user should use different IP address (a single VPN router for different customers and every customer is terminated in its own VRF.)
3. every user should user different PSK key
the first requirement is quite easy - use L2TP tunnel with authentication over RADIUS, it works without big problems.
But I can't apply 2 and 3 requirements. I tried the foillowing:
1. create an interface SubIF1 with a IP for Customer1 and SubIF2 for Customer2
2. cretated 2 ipsec profiles, where I defined local-address of those interfces and connect them to appropriate key-rings
In order this work I should place a static route which points to a source IP of a connected customer over the appropriate subinterface, if I do it - it works. But the problem is that the customers are "road-warriors", which mean they use everytime a new source IP address.
I tried it with a "local route-map", the result was that the VPN connection was established, and I could reach the remote VPN IP, but the traffic was stuck in VPN gateway - I can't reach from remote VPN anything else. It looks like (according to debug) that transit traffic didn't match my "local route-map" and tried the reach the source IP via default gateway and not wia correct subif with a crypto policy.
I tried as well a light-VRF, where I put the public SubIF in its own local VRF and then I define the default static in this VRF, but it didn't work at all, the traffic caouldn't match the correct profile and coudn't find the correct PSK key.
My question - Is there any possibility to build a VPN topology where all my 3 requirements are applied?
