is it possible to implement bot VPN site to Site with interface tunnel and crypto maps

[Lasandro Lopez]

Hi there!
i've currently a site to site vpn with another cisco router with interface tunnels

i've such configuration:

interface Tunnel 22

description :SITE-TO-SITE

ip address 10.1.1.1 255.255.255.252

tunnel source 1.1.1.1

tunnel destination 1.1.1.2

Now i want to add some other sites with Mikrotik

which is the best way to proceed?

i'm planning to create isakmp policy, crypto tranform set, crypto map...and finally, to apply the crypto map to outside interface, that is fa0/0

R1(config)#int fa 0/0

R1(config-if)#crypto map VPN_MAP

will it work??? or will it destroy the actual site to site that i've with tunnel 22?

regards!

[Jeff Van Houten]

There can only be one crypto map statement installed on an interface. There can be multiple sites and policies attached to that one crypto map.

Sent from Cisco Technical Support iPad App

[Lasandro Lopez]

Hi Jeff!

But how to implement vpn with multiple sites, where in interface, could be applied only one crypto map???

Hi Blau!

could you please suggest some more details regarding your scenario...network topology and configuration?

regards!

[Jouni Forss]

Hi,

Here is one site describing a setup where a single Crypto Map is used for L2L VPN and Client VPN (though in my opinion the Crypto Map name used in the configuration example could be missleading)

http://www.networklabs.info/2013/02/cisco-site-to-site-remote-access-vpn.html

The key thing with Cisco routers as with ASAs with such setup is that you need to keep the

crypto map

staments so that the "crypto map" statement meant for the VPN Clients (dynamic sessions) is kept at the very bottom by having a high value in the section. Think the ASA defaults to use 65535 if you configure it through the VPN wizard. In the example the value used is 100 which would permit the user to use values between 1 - 99 for different L2L VPN configurations.

I can't personally comment on the current connection with the Tunnel interface. I barely configure VPNs with Cisco routers. Most is done with ASAs and Routers mostly have L2L VPN connections only with Crypto Map configurations.

- Jouni

[blau grana]

Hi Lasandro,

combination of VTIs and crypto map should work fine, I use this type of configuration all the time.

Best Regards

Please rate all helpful posts and close solved questions