03-04-2005 01:47 PM
I've got two pixes with a site-to-site shared secret ipsec vpn set up and working.
I'm now adding a third site, and wished to create a second tunnel on each of the existing pixes to the third pix.
I THINK it's just as easy as adding a new peer and access-list to the crypto map, but would appreciate a sanity check.
Here's the current config of PIX A, talking to PIX B.
crypto map hrcpo-map 20 ipsec-isakmp
crypto map hrcpo-map 20 match address dc-vpn
crypto map hrcpo-map 20 set pfs group2
crypto map hrcpo-map 20 set peer 10.164.2.30
crypto map hrcpo-map 20 set transform-set hrcpo-transform
crypto map hrcpo-map 20 set security-association lifetime seconds 3600 kilobytes 4608000
crypto map hrcpo-map interface external
I think all need to do is define a new access list (ntc-vpn)for the traffic to the third site, and then add the following lines:
crypto map hrcpo-map 30 ipsec-isakmp
crypto map hrcpo-map 30 match address ntc-vpn
crypto map hrcpo-map 30 set pfs group2
crypto map hrcpo-map 30 set peer 10.164.9.94
crypto map hrcpo-map 30 set transform-set hrcpo-transform
crypto map hrcpo-map 30 set security-association lifetime seconds 3600 kilobytes 4608000
This adds a new access-list and peer to the existing crypto map.
Of course, I have to do the same thing on PIX B, and add entries on PIX C for A&B.
I'd appreciate someone confirming or denying that this works - I couldn't find any multi-tunnel examples on CCO.
03-04-2005 03:04 PM
check out this example , this is what you need to do
http://www.cisco.com/warp/public/110/pixmeshed.html
basically your idea is correct .
crypto map newmap 20 ipsec-isakmp
crypto map newmap 20 match address 120
crypto map newmap 20 set peer 172.18.124.154
crypto map newmap 20 set transform-set myset
crypto map newmap 30 ipsec-isakmp
crypto map newmap 30 match address 130
crypto map newmap 30 set peer 172.18.124.157
crypto map newmap 30 set transform-set myset
crypto map newmap interface outside
you will need to have wo different acls fo the interesting traffic also keep in mind the no nat
cheers!!
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide