Set up tunnel from 1100 to 221

[huffditty]

Here is my situation, I have a contivity 1100 and a 221. I need to build a vpn tunnel from scratch for IP phones to work off the 221 side of the routers. I have no idea how to implement this it is my first tunnel I will be setting up. Can someone please give me some good directions on how to do this. Oh yes it is a BCM 400 phone system. Thanks much in advance.

 

[riteeh]

http://www.tek-tips.com/viewthread.cfm?qid=1294896&page=2

Take a look at my last post, second from the bottom. This is for a 1010 but the 1100 should be quite similar.

 

[huffditty]

Still cant get it to work!!!! I have tried everything, I have the 1050 as the responder, I can see it in the logs that it tries to negotiate the connection. Can you force the 221 to connect? I have enabled all the encryption on the responder 1050, but it still wont connect.

Anti-replay is enabled on the 1050, is that the same as enable replay detection, on the 221?

Here are my settings on the 221

active:checked
Keep alive:checked
key management:IKE
Negotiation mode:aggressive
Local ID type:email
content:email address
My IP address:0.0.0.0
Peer type ID:IP
content: this box is empty
secure gateway address:this is my remote public IP of the 1050
encapsulation mode:Tunnel
esp:unchecked
AH:checked
encryption algorithmES
authentication Algorithm:MD5 (on the AH side)
authentication Algorithm:MD5 (on the ESP side)
pre-shared key:XXXX
pre shared confirm:XXXX

I have my ip policy configured
Local IP address 192.168.2.0-192.168.2.30
Remote IP Address 192.168.255.50-192.168.255.254
Private IP is :N/A

Advanced section
enable replay detection:yes
ph1
negotiation mode:aggressive
pre:xxxx
confirm pre:xxxx
encryption algorithmES
Authentication algorithm:MD5
SA Life time:28800
Key groupH1

Ph2
Active protocol:AH
encryption algorithmES
Authentication Algorithm:MD5
SA Life timer:28800
encapsulation:tunnel
perfect forward secrecy(PFS):NONE

Thanks for any help, thinking about using another 1050, or a linksys (if I have to)

 

[biv343]

If compression is enabled on the 1100, that can cause issues with a 221 connecting.

Also make sure the local/remote networks match exactly on both sides of the tunnel. I'm not sure how you're subnetted, but if both sides are class C networks you could specify a subnet address of 192.168.2.0/24 as local to the 221, 192.168.255.0/24 as remote to the 221, and flip them on the 1100. I've always used DNS as the local ID type, call it remote1 or something like that on the 221, and make sure you have remote1 as the initator ID on the 1100.

 

[huffditty]

Help, I am just trying to set up Internet connection though 1100 to dsl actiontec gt701, what the heck do I need to do. I threw out the 221 for now!!!


Thanks in advance