Hello VPN gurus,
I need help here. I trying setup a 3 routers vpn. the R2 as hub. So far i can every network, but the encap,decap packets is all empy.
that mean the tunnel is not established. I even do ping -t xxxx.xx.xxx and do a show crypto ipsec sa on each routers and still shows empty no packets was forwards. Here is my config file for all 3 router.. Im sure I missing some parameter, but I don't know where.
R1
version 12.4
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
hostname R1
no ip cef
no ipv6 cef
crypto isakmp policy 10
encr aes
authentication pre-share
group 2
crypto isakmp key cisco123 address 10.0.0.2
crypto ipsec transform-set TRANSFORM_SET esp-aes esp-sha-hmac
crypto map VPN-MAP 10 ipsec-isakmp
set peer 10.0.0.2
set transform-set TRANSFORM_SET
match address VPN-TO-R2
spanning-tree mode pvst
interface FastEthernet0/0
ip address 192.168.1.1 255.255.255.0
duplex auto
speed auto
crypto map VPN-MAP
!
interface FastEthernet0/1
no ip address
duplex auto
speed auto
shutdown
interface Serial0/0/0
ip address 10.0.0.1 255.255.255.252
clock rate 2000000
interface Serial0/1/0
no ip address
clock rate 2000000
shutdown
interface Vlan1
no ip address
shutdown
ip classless
ip route 192.168.3.0 255.255.255.0 10.0.0.2
ip flow-export version 9
ip access-list extended VPN-TO-R2
permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
permit ip 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255
!
line con 0
line aux 0
line vty 0 4
login
R2:
Current configuration : 1256 bytes
!
version 12.4
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
hostname R2
!
!
no ip cef
no ipv6 cef
crypto isakmp policy 10
encr aes
authentication pre-share
group 2
crypto isakmp key cisco123 address 10.0.0.1
crypto ipsec transform-set TRANSFORM_SET esp-aes esp-sha-hmac
crypto map VPN-MAP 10 ipsec-isakmp
set peer 10.0.0.1
set transform-set TRANSFORM_SET
match address VPN-TO-R1
!
spanning-tree mode pvst
!
!
interface FastEthernet0/0
ip address 192.168.2.1 255.255.255.0
duplex auto
speed auto
crypto map VPN-MAP
interface FastEthernet0/1
no ip address
duplex auto
speed auto
shutdown
interface Serial0/0/0
ip address 10.0.0.2 255.255.255.252
interface Serial0/1/0
ip address 10.0.1.1 255.255.255.252
clock rate 2000000
interface Vlan1
no ip address
shutdown
ip classless
ip route 192.168.1.0 255.255.255.0 10.0.0.1
ip route 192.168.3.0 255.255.255.0 10.0.1.2
ip flow-export version 9
ip access-list extended VPN-TO-R1
permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
permit ip 192.168.3.0 0.0.0.255 192.168.1.0 0.0.0.255
!
line con 0
line aux 0
line vty 0 4
login
R3:
version 12.4
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
hostname Router
no ip cef
no ipv6 cef
crypto isakmp policy 10
encr aes
authentication pre-share
group 2
crypto isakmp key cisco123 address 10.0.1.1
crypto isakmp key cisco123 address 10.0.1.2
crypto ipsec transform-set TRANSFORM_SET esp-aes esp-sha-hmac
crypto map VPN-MAP 10 ipsec-isakmp
set peer 10.0.1.1
set transform-set TRANSFORM_SET
match address VPN-TO-R1
crypto map VPN-MAP 20 ipsec-isakmp
set peer 10.0.1.2
set transform-set TRANSFORM_SET
match address VPN-TO-R3
spanning-tree mode pvst
interface FastEthernet0/0
ip address 192.168.3.1 255.255.255.0
duplex auto
speed auto
crypto map VPN-MAP
interface FastEthernet0/1
no ip address
duplex auto
speed auto
shutdown
interface Serial0/0/0
ip address 10.0.1.2 255.255.255.252
interface Serial0/1/0
no ip address
clock rate 2000000
shutdown
interface Vlan1
no ip address
shutdown
ip classless
ip route 192.168.1.0 255.255.255.0 10.0.1.1
ip flow-export version 9
ip access-list extended VPN-TO-R2
permit ip 192.168.3.0 0.0.0.255 192.168.2.0 0.0.0.255
permit ip 192.168.3.0 0.0.0.255 192.168.1.0 0.0.0.255
!
line con 0
line aux 0
line vty 0 4
login
