cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2105
Views
0
Helpful
3
Replies

crypto map applied to sub interface = partial encryption

martinbuffleo
Level 1
Level 1

I have a router on a stick configuration.

With sub interface .1 and .2

I have applied the crypto map to sub interface.2

When I ping across the tunnel replies from the .1 sub interface are encrypted.

But any traffic received from the vlan connected to the sub interface .1 appears to bypass the crypto map and goes across the wan in clear.

FYI main interface is a port channel connect to a stacked switch.

Thanks

Sent from Cisco Technical Support iPad App

3 Replies 3

Lei Tian
Cisco Employee
Cisco Employee

Hi,

This does seem to be right. What software version are you running on the router? Can you also post the config from the router?

HTH,
Lei Tian

Sent from Cisco Technical Support iPhone App

crypto isakmp policy 2

encr 3des

authentication pre-share

group 2

lifetime 3600

!

crypto isakmp policy 3

encr 3des

hash md5

authentication pre-share

group 2

lifetime 3600

crypto isakmp key password address 0.0.0.0

!

!

crypto ipsec transform-set SAL esp-aes 256 esp-md5-hmac

mode tunnel

!

!

!

crypto map VPN 10 ipsec-isakmp

set peer PeerIP

set security-association lifetime seconds 28800

set security-association idle-time 86400

set transform-set SAL

match address 105

!

!

!

!

!

interface Port-channel1

no ip address

hold-queue 150 in

!

interface Port-channel1.69

encapsulation dot1Q 69

ip address IPaddrs.2 255.255.255.0

no ip proxy-arp

standby 1 ip IPaddrs.1

standby 1 timers 1 4

standby 1 priority 105

standby 1 name VLAN69

crypto map VPN redundancy VLAN69

!

interface Port-channel1.70

encapsulation dot1Q 70

ip address otherNet.2 255.255.255.0

no ip proxy-arp

standby 1 ip otherNet.1

standby 1 timers 1 4

standby 1 priority 105

access-list 105 permit ip otherNet.0 0.0.0.255 Branch.0 0.0.0.255

martinbuffleo
Level 1
Level 1

Cancel that

Turns out my 3rd party VPN device althought it claims to packet capture its wan interface. It doesn't.

Note to self always use span ports or a hub.

Sent from Cisco Technical Support iPhone App

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: