Hi,
I have configured two LANs with NAT. There is an ISP router inbetween these routers to emulate the internet.
I would like to configure a site-to-site VPN between these two routers.
Here is the configuration of R1 and R3:
R1:
hostname R1
no ip cef
no ipv6 cef
!
crypto isakmp policy 1
encr aes
authentication pre-share
group 2
!
crypto isakmp key 0 address 209.123.123.33
!
crypto ipsec security-association lifetime seconds 86400
!
crypto ipsec transform-set yasser esp-aes esp-sha-hmac
!
crypto map auda 100 ipsec-isakmp
set peer 209.123.123.33
set pfs group2
set security-association lifetime seconds 86400
set transform-set yasser
match address ramzy
!
spanning-tree mode pvst
!
interface FastEthernet0/0
ip address 172.16.1.21 255.255.248.0
duplex auto
speed auto
!
interface FastEthernet0/0.10
encapsulation dot1Q 10
ip address 172.16.8.99 255.255.248.0
ip nat inside
!
interface Serial0/3/0
ip address 209.123.123.1 255.255.255.240
ip nat outside
clock rate 128000
crypto map auda
!
router ospf 1
router-id 15.15.15.15
log-adjacency-changes
network 172.16.8.0 0.0.7.255 area 1
network 209.123.123.0 0.0.0.15 area 0
!
ip nat inside source list ADDRESSES interface Serial0/3/0 overload
ip classless
!
ip flow-export version 9
!
ip access-list standard ADDRESSES
permit 172.16.8.0 0.0.7.255
ip access-list extended ramzy
permit ip 172.16.8.0 0.0.7.255 172.16.40.0 0.0.7.255
!
line con 0
!
line aux 0
!
line vty 0 4
login
!
end
R3:
hostname R3
!
no ip cef
no ipv6 cef
!
crypto isakmp policy 1
encr aes
authentication pre-share
group 2
!
crypto isakmp key 0 address 209.123.123.1
!
crypto ipsec security-association lifetime seconds 86400
!
crypto ipsec transform-set yasser esp-aes esp-sha-hmac
!
crypto map auda 100 ipsec-isakmp
set peer 209.123.123.1
set pfs group2
set security-association lifetime seconds 86400
set transform-set yasser
match address ramzy
!
spanning-tree mode pvst
!
interface FastEthernet0/0
ip address 172.16.1.22 255.255.248.0
duplex auto
speed auto
!
interface FastEthernet0/0.40
encapsulation dot1Q 40
ip address 172.16.40.99 255.255.248.0
ip nat inside
!
interface Serial0/3/1
ip address 209.123.123.33 255.255.255.240
ip nat outside
crypto map auda
!
router ospf 1
router-id 25.25.25.25
log-adjacency-changes
network 172.16.40.0 0.0.7.255 area 2
network 209.123.123.32 0.0.0.15 area 0
!
ip nat inside source list ADDRESSES interface Serial0/3/1 overload
ip classless
!
ip flow-export version 9
!
ip access-list standard ADDRESSES
permit 172.16.40.0 0.0.7.255
ip access-list extended ramzy
permit ip 172.16.40.0 0.0.7.255 172.16.8.0 0.0.7.255
!
line con 0
!
line aux 0
!
line vty 0 4
login
!
end
Attempting to ping from PC-A (172.16.8.1) to PC-C (172.16.40.1) doesn't work.
I have tried numerous times to get traffic to flow through the tunnel with no succes. Can anyone tell me where I am going wrong?
Thanks,
Josh
