VPN IPSEC between 3 sites 1

[Rod25]

Hi Guys,
I am currently configuring 3 routers for VPN IPSec. Does anyone have configurations that link all routers with each other. I will probably configure EIGRP between sites.

Thanks in Advance

Rod

 

[lgarner]

Well, it's the same as making one connection. Just use a higher policy number for successive links.

As for EIGRP, you won't be using it unless you create GRE links also. EIGRP requires connected neighbors.

 

[Rod25]

Hi Igarner,
Thanks for your quick reply. I will be using GRE to accomodate EIGRP.
Do I have this right:

Router A will have two crypto maps, one for each site. The same applies to Routers B and C.

Router A will also have the following config for GRE to Routers B and C:


interface Loopback0
description Local Loopback To Router B
ip address 192.168.1.2 255.255.255.255
!
interface Loopback1
description Local Loopback To Router C
ip address 192.168.2.2 255.255.255.255
!
interface Tunnel1
description GRE to Router B
ip address 10.1.1.1 255.255.255.252
no ip proxy-arp
ip mtu 1400
ip tcp adjust-mss 1340
ip ospf authentication
ip ospf authentication-key password
ip ospf cost 10
tunnel source Loopback0
tunnel destination 192.168.1.1
crypto map vpn
!
interface Tunnel2
description GRE to Router C
ip address 10.1.2.1 255.255.255.252
no ip proxy-arp
ip mtu 1400
ip tcp adjust-mss 1340
ip ospf authentication
ip ospf authentication-key password
ip ospf cost 10
tunnel source Loopback0
tunnel destination 192.168.2.1
crypto map vpn

Routers B and C will also have the same setup. Therefore I have IPSEC over GRE tunnels between all three sites.

Am I on the right track?

Thanks again
Rod

 

[lgarner]

Looks about like what we have, except we use the serial addresses instead of loopback since there's only one serial connection. Once that's set up, the GRE tunnel addresses will appear as neighbors.

 

[Rod25]

Hi Igarner,
These sites will be interconnected by DSL. How do I route private traffic 10.x.x.x using EIGRP out over the public internet to the other sites? I cant find any documents on this.

Thanks again,
Rod

 

[lgarner]

You don't. Your VPN devices have public IP addresses. You create VPN links, which provide tunnels for your private addresses. Once the tunnels are created, it will be similar to a private network like frame-relay or p-p links.

The public addresses will be used to create the IPSec links, and the private addresses can then be endpoints for GRE.

 

[Rod25]

Hi Igarner,
Thanks for that. Have you got a sample config for reference similiar to what I want i.e. Dsl with IPsec and GRE interconnecting 3 sites.

Thanks again,
Rod