Site to Site VPN Tunnel using 800 Series??

Unanswered Question
Jan 15th, 2009
User Badges:

Im trying to create a VPN tunnel between the office and home and planning on getting ADSL at both sites for this. Question is, can the tunnel be configured on the 800 series router if it is connected to a "normal" broadband ADSL router first (IE one from O2 for example)OR does the 800 series have to be an ADSL one that is connected directly via the ADSL port...

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 3 (1 ratings)
kwillacey Fri, 01/16/2009 - 09:40
User Badges:
  • Bronze, 100 points or more

It does not have to be directly connected but you might have to bridge the modem so that the public ip address appears on the router.

Remember with a site to site at least one side must have a static ip.

Urfan Khaliq Fri, 01/16/2009 - 10:35
User Badges:

Thanks for that kwillacey. Could you elaborate on that a bit more? An example config would be helpful? Never come across that before in ios.

Would it be any better using one with the adsl directly connected or is the bridging not a big issue?

Also any example configs for the gre tunnels and options for encryption would be really usefull.



kwillacey Fri, 01/16/2009 - 11:01
User Badges:
  • Bronze, 100 points or more

The bridging should not be a big issue as long as you know how to do it on the DSL modem that you have, but I have always preferred having the DSL line directly connected to the router and do all the configurations myself.

The link below will show you how to configure the dynamic to static VPN.

Why would you need GRE? Are you planning to do routing across the VPN? If that's the case you could try DVTIs they work well.

Urfan Khaliq Fri, 01/16/2009 - 11:08
User Badges:

Yeh I am planning on running a routing protocol between both sites so I can have PC's in the remote site be connected to the active directory/exchange in the office.

Once set up the PC at remote site should be connected to the AD/Exchange all the time making it no different to the office, so i would imagine a routing protocol needs to be run to allow the two sites to be in contact all the time.

PS the link does not work

kwillacey Fri, 01/16/2009 - 11:29
User Badges:
  • Bronze, 100 points or more

Oh sorry about that

If you just want the tunnel to be up all the time there are other ways to accomplish that, but unless the router is not the default gateway and you have multiple subnets at the branch then I don't think you would need routing.

Even then just having a default route that points to your Internet router, whether it be on your core switch or any other switch or router behind the Internet router, would be enough.

Urfan Khaliq Fri, 01/16/2009 - 11:48
User Badges:

Im not sure if im making myself very clear...What I am attempting is this...

Office has ADSL and the exchange server and 3 client PC's (small office and network)...I would have an 800 series as the default gateway for everything in the office to the outside world...

I also have an 800 series at home with my one pc at home, that one pc needs to be a part of the same windows domain and active directory set up on the server in the office...

What I thought is that the PC at home will have a default gateway (to get to the general Internet etc) of the 800 series and also have a route to the office server via the tunnell...

So I would need to have a different subnet in the home to the one in the office (so the 800 series at home can distinguish between traffic for the office and traffic that stays in the house?)

so example would be in the office and at home. I see what you mean though about using a static route that simply points out the tunnell from home and vice versa from the office to home, (and everything else out the DSL port)

If a GRE tunnell isnt the only option, any ideas what else I could use?

Thanks for helping


kwillacey Fri, 01/16/2009 - 12:09
User Badges:
  • Bronze, 100 points or more

I get what you're saying but you still don't need GRE to facilitate dynamic routing to accomplish that, the default static route pointing to the Internet on both routers will be fine.

Assuming your home network will have the dynamic public IP and your office will have the static public IP, the VPN connection can only be initiated from the home network.

So what will happen is your PC at home '' will try to contact the server at the office '' that traffic will be sent to the default gateway on the PC '' which is the router.

The router will realize, based on the crypto map, that this traffic must be encrypted and sent across the VPN, if everything is configured properly the tunnel will come up, and traffic will be sent over the tunnel via the default route on the router pointing to the Internet.

When the traffic reaches the other end it will be the same scenario in reverse. All traffic that hits the router not destined for the LAN for which that router is apart of will be sent out the Internet and if the traffic matches the crypto map it will be sent over the VPN. So a regular site to site VPN is all you need.

Hope that helps.

Urfan Khaliq Fri, 01/16/2009 - 12:15
User Badges:

Ok cool, I get what you mean...I also have a static IP at home as well as the office. Can you explain or point me towards where I can find the difference between GRE tunnel and a site to site VPN?

Also an example config would be VERY usefull! :-)


kwillacey Fri, 01/16/2009 - 12:34
User Badges:
  • Bronze, 100 points or more

This should be a better link to configure your site to site.

This will link you to information on GRE.

The simple explanation is multicast can't go across a VPN tunnel which routing protocols use to form relationships.

Hope this helps.

ashwinmarch Sun, 01/18/2009 - 05:16
User Badges:

If u just want to access things from your home only ..then u can go for remote access vpn. or if you want to access both side I mean from office to home and home to office go for site to site VPN for that both end needs public IP(static). For remote access just one end need public other end just need internet only. You can access the server using vpn client from remote site. Cisco 800 series RTR will support both site to site and Remote access VPN.Hope things are clear for you. For any clarification contact me on [email protected] Thank you.


This Discussion