Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations gkittelson on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

Simple site to site Cisco VPN problem?

Status
Not open for further replies.
Apr 3, 2003
180
US
Can someone please help me, I am tired of staring at these 2611 routers config trying to figure out why this vpn will not work. Both of these routers perform PAT for internet aaccess. I think it may have somthing to do with the routing of the internal adress's once the tunel is built. I have tried every static route but nothing workd. If run the crypto isakmp sa cpmmand it shows that the two routers are connected ie..
ohio2611#show crypto isakmp sa
dst src state conn-id slot
65.xx.xx.xx 68.xx.xx.xx QM_IDLE 1 0
Hope someone can help!
ROUTER A
Current configuration : 1409 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname ohio2611
!
boot-start-marker
boot-end-marker
!
memory-size iomem 15
no aaa new-model
ip subnet-zero
ip cef
!
no ip domain lookup
!
ip audit po max-events 100
!
username opandrea privilege 15 secret 5 $1$rDk1$NaRNm32hGP/wegh8fbqcp/
!
crypto isakmp policy 10
encr 3des
authentication pre-share
group 2
crypto isakmp key cisco1234 address 68.xx.xx.xx no-xauth
!
crypto ipsec transform-set transset esp-3des esp-md5-hmac
!
crypto map clientmap 100 ipsec-isakmp
set peer 68.xx.xx.xx
set transform-set transset
match address 100
!
interface Ethernet0/0
ip address 65.xx.xx.xx 255.255.255.128
ip nat outside
half-duplex
crypto map clientmap
!
interface Ethernet0/1
ip address 192.168.1.1 255.255.255.0
ip nat inside
half-duplex
!
ip nat inside source route-map nonat inter
ip http server
no ip http secure-server
ip classless
ip route 0.0.0.0 0.0.0.0 65.xx.xx.xx
!
access-list 100 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 101 deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 101 permit ip 192.168.1.0 0.0.0.255 any
!
route-map nonat permit 10
match ip address 101
!
line con 0
logging synchronous
line aux 0
line vty 0 4
login
end

ROUTER B
Current configuration : 1409 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname florida2611
!
boot-start-marker
boot-end-marker
!
memory-size iomem 15
no aaa new-model
ip subnet-zero
ip cef
!
no ip domain lookup
!
ip audit po max-events 100
!
username opandrea privilege 15 secret 5 $1$rDk1$NaRNm32hGP/wegh8fbqcp/
!
crypto isakmp policy 10
encr 3des
authentication pre-share
group 2
crypto isakmp key cisco1234 address 65.xx.xx.xx no
xauth
!
crypto ipsec transform-set transset esp-3des esp-md5-hmac
!
crypto map clientmap 100 ipsec-isakmp
set peer 65.xx.xx.xx
set transform-set transset
match address 100
!
interface Ethernet0/0
ip address 68.xx.xx.xx255.255.255.0
ip nat outside
half-duplex
crypto map clientmap
!
interface Ethernet0/1
ip address 192.168.2.1 255.255.255.0
ip nat inside
half-duplex
!
ip nat inside source route-map nonat inter
ip http server
no ip http secure-server
ip classless
ip route 0.0.0.0 0.0.0.0 68.xx.xx.xx
!
access-list 100 permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 101 deny ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 101 permit ip 192.168.2.0 0.0.0.255 any
!
route-map nonat permit 10
match ip address 101
!
line con 0
logging synchronous
line aux 0
line vty 0 4
login
!
end

"I hear and I forget. I see and I remember. I do and I understand."
- Confucius (551 BC - 479)
 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top