VPN over ADSL

[theo Bogatsu]

Hi

I have a two 512Mb ADSL connections to my ISP two of my offices in different locations. I want to purchase 2 cisco routers and connect them on both ends so that I can have a VPN between the two places. I havent yet decided on the routers but I was thinking of buying eithe the Cisco 861 or the Cisco 881.

My first question is wether this would work over an ADSL connection, if so I noticed that my home modem has 1 RJ11 connection to the Telephony network, do I replace my modem with the router when I get it if so then the router hasnt got that particular port or do I connect my router to the modem through one of the fast ethernet connections?

My second question is wether this would be the best router for the connection Im trying to achieve, if not what would be the best router because all I need is a Lan2Lan VPN connection?

or basically if there is a better/cheaper solution to connect two geographically separated locations, with the currentsetup.

Thanks

[Federico Coto Fajardo]

Hi,

The 800 series routers will work (just need to check which model specifically).

Also, Cisco has a SMB line (cheaper).... that will work as well.

http://www.cisco.com/cisco/web/solutions/small_business/index.html

Federico.

[theo Bogatsu]

Hi

yes I checked the SMB line which is where I found the 800 series, I just wanted to confirm the port connectivity because I didnt want to purchase the hardware and only find out that it wont work.

So in terms of connectivty do you think its something I would be able to achieve through an ADSL connection? I mean besides the default ports that come with the router, would I need to perhaps purchase a router with certain interfaces? I have been looking at the cisco 880 and 860 range but today I found the 827-H and 1700 which apparently support ADSL. I am looking to deploy the best solution based on cost, security and ease of maintenance.

[Federico Coto Fajardo]

Some of these routers have a DSL port, other have an Ethernet port to connect to the DSL modem.

Others have a built-in switch to connect more computers.

All of them will work in terms of handling the connection... just need to purchase the model you need in terms of hardware.

If you want, let us know exactly what you have on both sides.

DSL modem or only DSL line, etc.

Federico.

[theo Bogatsu]

Hi

I have a DSL modem, more specifically:

http://www.speedguide.net/routers/technicolor-thomson-speedtouch-585-residential-71

My basic need is VPN connectivity between two sites.

[theo Bogatsu]

Hi Federico

Any more advice on this? The link you sent me was very usefull I found the cisco 827-H, I was wondering if there is a product similar to that 1 but supports wireless? Also would it be possible to connect a router with just a fast ethernet port to the ADSL modem in the link below without having to replace the whole modem??

[Federico Coto Fajardo]

Some routers are DSL modems (have a built-in DSL port) that can be directly connected to the phone line.

If the router also include wireless capabilities it could function as an all-in-one (DSL, Wireless, Router, security-features, etc).

Other routers don't have DSL port but have Ethernet ports that can be plugged to the DSL modem.

Some of these models have as well wireless and other capabilities.

Can compare available models here:

http://www.cisco.com/en/US/products/hw/routers/ps380/prod_models_comparison.html

Federico.

[theo Bogatsu]

Hi Frederico

I finally got a cisco 881 router for the solution I was talking about. I have been wrecking my brain for the past three days tryng to get it to work. Im pretty confident that I got the VPN configuration correct, butthe problem is I can connect via cisco VPN client, and my biggest suspicion is the connectivity/port configurations on my router. Please assist. I have the Router connected behind the modem, I  have pasted my config below:

Building configuration...

Current configuration : 5907 bytes

!

! Last configuration change at 17:52:40 UTC Tue Apr 12 2011

!

version 15.0

no service pad

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

!

hostname TRL_GABS

!

boot-start-marker

boot-end-marker

!

logging buffered 51200 warnings

enable secret 5 $1$pN/L$WlMQKwn7bVx9WAA702CNw1

!

aaa new-model

!

!

aaa authentication login default local enable

aaa authentication login TELNET local enable

aaa authentication login CONSOLE none

aaa authentication login ciscocp_vpn_xauth_ml_1 local

aaa authentication login ciscocp_vpn_xauth_ml_2 local

aaa authorization network ciscocp_vpn_group_ml_1 local

aaa authorization network ciscocp_vpn_group_ml_2 local

!        

!        

!        

!        

!        

aaa session-id common

memory-size iomem 10

!        

crypto pki trustpoint TP-self-signed-2781363022

enrollment selfsigned

subject-name cn=IOS-Self-Signed-Certificate-2781363022

revocation-check none

rsakeypair TP-self-signed-2781363022

!        

!        

crypto pki certificate chain TP-self-signed-2781363022

certificate self-signed 02

  3082024F 308201B8 A0030201 02020102 300D0609 2A864886 F70D0101 04050030

  31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274

  69666963 6174652D 32373831 33363330 3232301E 170D3131 30343039 31343237

  30325A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649

  4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D32 37383133

  36333032 3230819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281

  8100C662 F68B840A 2D21884F ACCECEA1 16C63C56 433E24F8 C9CD4F75 9EC17A02

  FA18AA95 8B9A0E92 BFC1E9E7 413E48B4 46C22563 F05CFF21 9C1A2ABA 16FC6C0F

  B9262F0A B669DE58 47E5EC8B B7A5839E CF0FFDA9 B744A44C C49AE154 2F1DDF9D

  73BDF233 257A8686 0623731B 6282ED49 5FF08D85 5212BD0C F8A0C798 4986D393

  ACFB0203 010001A3 77307530 0F060355 1D130101 FF040530 030101FF 30220603

  551D1104 1B301982 1754524C 5F474142 532E796F 7572646F 6D61696E 2E636F6D

  301F0603 551D2304 18301680 1439DF23 B9BA96E8 E33631BA 20FB12D2 64D77732

  EC301D06 03551D0E 04160414 39DF23B9 BA96E8E3 3631BA20 FB12D264 D77732EC

  300D0609 2A864886 F70D0101 04050003 8181007E 28E80330 CC819A5B 853B5E19

  2EF8DA55 0EA828FA C5AE6109 45AACD3D DFF12D12 4CAF33A6 BF1E666C 5176D316

  B6A0E236 A34E5866 D38F8E29 81D700EA 2B4B0991 58314D47 5822C248 5F69B8CA

  C0EF2C59 ACB578FC C64032E5 36B613FB BA121E95 7E3F0E92 45F5B951 4E26857F

  E998FAE9 F3BD0716 58028E1D 54F470CF 6482B1

        quit

ip source-route

!        

!        

ip dhcp excluded-address 10.10.10.1

!        

ip dhcp pool TRL_POOL

   import all

   network 10.10.10.0 255.255.255.0

   default-router 10.10.10.1

   lease infinite

!        

!        

ip cef   

no ip domain lookup

ip domain name yourdomain.com

no ipv6 cef

!        

!        

license udi pid CISCO881-K9 sn FCZ1510C0MN

license agent notify http://10.10.10.2:9710/clm/servlet/HttpListenServlet dummy dummy 2.0

!        

!        

username trl_gabs privilege 15 secret

username test password 0 test

!        

!        

!        

!        

crypto isakmp policy 1

encr 3des

authentication pre-share

group 2 

!        

crypto isakmp policy 2

hash md5

authentication pre-share

group 2 

!        

crypto isakmp client configuration group TRL_STAFF

key **********

pool SDM_POOL_1

max-users 4

netmask 255.255.255.0

!        

crypto isakmp client configuration group Administrators

key trladmin2011

pool SDM_POOL_2

max-users 2

netmask 255.255.255.0

!        

crypto isakmp client configuration group TEST

key test

pool SDM_POOL_3

save-password

max-users 10

max-logins 2

crypto isakmp profile ciscocp-ike-profile-1

   match identity group TEST

   client authentication list ciscocp_vpn_xauth_ml_2

   isakmp authorization list ciscocp_vpn_group_ml_2

   client configuration address respond

   virtual-template 1

!        

!        

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac

!        

crypto ipsec profile CiscoCP_Profile1

set transform-set ESP-3DES-SHA

set isakmp-profile ciscocp-ike-profile-1

!        

!        

!        

!        

!        

!        

interface FastEthernet0

!        

interface FastEthernet1

!        

interface FastEthernet2

!        

interface FastEthernet3

!        

interface FastEthernet4

ip address dhcp

ip nat outside

ip virtual-reassembly

duplex auto

speed auto

!        

interface Virtual-Template1 type tunnel

ip unnumbered FastEthernet4

tunnel mode ipsec ipv4

tunnel protection ipsec profile CiscoCP_Profile1

!        

interface Vlan1

description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$

ip address 10.10.10.1 255.255.255.0

ip nat inside

ip virtual-reassembly

ip tcp adjust-mss 1452

!        

ip local pool SDM_POOL_2 10.10.10.100 10.10.10.110

ip local pool SDM_POOL_1 192.168.100.1 192.168.100.254

ip local pool SDM_POOL_3 10.10.10.20 10.10.10.30

ip forward-protocol nd

ip http server

ip http access-class 23

ip http authentication local

ip http secure-server

ip http timeout-policy idle 60 life 86400 requests 10000

!        

ip nat inside source list 15 interface FastEthernet4 overload

!        

access-list 15 permit 10.10.10.0 0.0.0.255

access-list 23 permit 10.10.10.0 0.0.0.7

no cdp run

!        

!        

!        

!        

!        

control-plane

!    

!        

line con 0

logging synchronous

login authentication CONSOLE

no modem enable

line aux 0

line vty 0 4

access-class 23 in

privilege level 15

login authentication TELNET

transport input telnet ssh

!        

scheduler max-task-time 5000

end

[theo Bogatsu]

please help. :-(