Solved: 'How to' Setup a VPN between a UC540 and a SR520 with remote IP extension

Jerry Collins · ‎05-01-2010

Hi All,

I need some help setting up a link between a Head Office UC540 and a remote SR520 which I want to use a PC and an IP Phone from. This remote site is the first of several.

I've found several examples of site to site IPsec VPNs, but none with references to voice and data VLANs, do I need to worry about this or will the phone just work.

All Advice and suggestions gratefully accepted,

Jerry

Jennifer Halim · ‎05-02-2010

Here is a LAN-to-LAN VPN sample configuration between 2 IOS routers:

http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a0080194650.shtml

Assuming from your example:

VLAN 1 - data - 192.168.19.0/24

VLAN 100 - voice - 10.1.1.0/24

And on the other side:

VLAN 1 - data - 192.168.20.0/24

VLAN 100 - voice: 10.2.2.0/24

The crypto ACL would:

access-list 150 permit ip 192.168.19.0 0.0.0.255 192.168.20.0 0.0.0.255

access-list 150 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255

Crypto ACL on the other side would be:

access-list 150 permit ip 192.168.20.0 0.0.0.255 192.168.19.0 0.0.0.255

access-list 150 permit ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255

View solution in original post

Jennifer Halim · ‎05-01-2010

Is your data vlan and phone vlan in the same subnet? Site-to-site VPN is configured based on specifying interesting traffic to be encrypted, ie: via access-list. If your data vlan and phone vlan is in different subnet, then you would need to configure the access-list accordingly in your crypto ACL.

Jerry Collins · ‎05-02-2010

Hi halijenn,

Vlan 1 is the data vlan and is setup as 192.168.19.X class c, the voice vlan is 100 and is setup as 10.1.1.0 also class c.

I'm using CCA to do the configuration work and this is, more or less, standard settings.

Could you give me an example of the access-list please.