Hi jon

thanks for your reply .

i tried to ping from 192.168.1.250 to 192.168.2.10

please find the attached file for R1&R2 config

regards

Mohamed,

I can say that I've never seen a config like this. Generally, you want your crypto map installed on the public interface (BVI20 in your case). Theoretically, I guess the private address could be on the same interface as the public, but I'm not sure how well that would work.

Try to move the crypto map to BVI20 and see if it helps.

I've never seen this type of config before where they put the public address as a secondary and then the private address as the primary. This looks odd to me, but I've not been around a lot of ISP configs. :-)

HTH,

John

Hi John

thanks for your mail .

really i tried to do that . i mean i tried to install crypto map on the BVI20 interface but the vpn tunnel couldnot be established.

regards

Mohamed

Could you perhaps draw us a quick topology map so we can understand where the BVI interface fits in.

Also is it correct to assume that L3 connectivity is working fine ie. each router can ping the other router on the public IP address ?

Jon

Hi jon

the topology is very simple as following:

Layer2 switch---->R1---->Internet---->R2---->Layer2 switch.

The users who are connected on the switch behind R1 are in the same vlan (vlan1).their default gateway is the router and the same solution in site 2.

Yes , each router can ping the other router on the public ip address.

regards

Mohamed

I have looked at the configs and I believe that there are at least 3 issues in them that impact your attempt to do VPN.

I agree that the BVI is a complication but I believe that it is not really a problem. Since there is only one interface in each config with the bridge-group configured I do wonder why the BVI is there and do not see that it is doing any good in the config. But I do not believe that it is necessarily the problem with VPN.

The first problem is that the crypto map is on the wrong interface (unless the topology of the network is different from what it seems (FastEthernet0/0 inside and serial/BVI outside). The crypto map needs to be on the interface where traffic enters and leaves the router. So John was correct to suggest moving the crypto map.

But that is not the only problem. By default the router defaults to using the address of the outbound interface as the IP address of the IPSec packet. So R1 is expecting to receive a packet from its peer at 64.x.x.177 but receives a packet with source address of 10.177.8.70. This is a problem. Normally you can use the option in the crypto map to specify the address to use.

But that brings us to the third problem. When it generates a packet the router uses its primary address (when there is a secondary address configured). So even if you use the option in the crypto map to specify the address to use, it would use the primary address of FastEthernet0/0 but your peer address is the secondary address. So I do not see a way to get the router, as currently configured, to use the address you really want as the peer address.

If you want the VPN to work I believe that you need to make the 64.x.x.177 be the primary address on its interface, and you need the command in the crypto map to specify the interface address to use.

HTH

Rick

Hi Rick

Thanks for your reply.

i want to understand something in your reply that what do you mean by " Normally you can use the option in the crypto map to specify the address to use " ????

If you can , please send me the configuration that should be applied on the router to understand you more.

Thanks Rick for your help

regards

Mohamed

There is a command like this to specify the local address to be used:

crypto map s-crypto local-address FastEthernet0/0

As I explained in my post the default behavior of the router is to use the address of the outbound interface. You can use this command to specify an address to be used, which is especially useful if the address you want to use is not the address of the outbound interface (and in your config the address you want to use is configured on the inside interface and not the outside interface).

HTH

Rick