Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

IPSec Site To Site VPN from Cisco 837 Router to FortiGate 200A Firewall

I had a challege for a site to site vpn scenario that might need some brainstorm from you guys.

So far i had a configuration pre-planned for this scenario but i'm not very sure if the tunnel i created will work as I haven't test it before with this scenario. I'll be going on the execution of this project next week and hope to get some brainstorm solution by u guys. Thanks in advance!

Network Diagram:

http://cjunhan.multiply.com/photos/hi-res/5/3?xurl=%2Fphotos%2Fphoto%2F5%2F3

Challenge:

1) configure CISCO R3 IPSec Site to Site VPN between 172.20.10.0 and 10.20.20.0 using crypto maps

2) IKE Phase I MainMode, des, lifetime 28000, md5, DH-Group1

IKE Phase II: des-esp, hmac-md5, tunnel mode

PSK: sitetositevpn

Here is my configuration for review:

crypto isakmp policy 10

encr des

authentication pre-share

group 1

hash md5

crypto isakmp key sitetositevpn address 210.x.x.66

!

crypto ipsec transform-set ciscoset esp-des esp-md5-hmac

!

crypto map infotelmap 10 ipsec-isakmp

set peer 210.x.x.66

set transform-set ciscoset

match address 111

!

!

interface Ethernet0

description LAN 3

ip address 10.20.20.1 255.255.255.0

ip nat inside

service-policy output servers-policy

hold-queue 100 out

!

interface ATM0

no ip address

atm vc-per-vp 64

no atm ilmi-keepalive

dsl operating-mode auto

!

interface ATM0.1 point-to-point

ip address 210.x.20.x.255.255.252

no ip redirects <-- Disable ICMP

no ip unreachables <-- Disable ICMP host unreachable messages

no ip proxy-arp <-- disables IP directed broadcasts

ip nat outside

pvc 8/35

encapsulation aal5snap

!

!

ip nat inside source list 102 interface ATM0.1 overload

ip classless

ip route 0.0.0.0 0.0.0.0 ATM0.1

ip route 0.0.0.0 0.x.0.x.190.60.66

no ip http secure-server

!

access-list 102 remark Traffic to NAT

access-list 102 permit ip 10.20.20.0 0.0.0.255 any

!

access-list 111 remark Site to Site VPN from LAN 3 to LAN 2 Network

access-list 111 permit ip 10.20.20.0 0.0.0.x.x.10.0 0.0.0.255

Regards,

Junhan

2 ACCEPTED SOLUTIONS

Accepted Solutions
New Member

Re: IPSec Site To Site VPN from Cisco 837 Router to FortiGate 20

Hi,

Three changes required in this configuration.

(1) change the NAT access-list 102 as below:

access-list 102 deny ip 10.20.20.0 0.0.0.255 172.20.10.0 0.0.0.255

access-list 102 permit ip 10.20.20.0 0.0.0.255 any

(2) apply the crypto map on ATM point-to-point interface.

(3) Remote the any of one default-route.

Thanks,

Mustafa

New Member

Re: IPSec Site To Site VPN from Cisco 837 Router to FortiGate 20

Your config appears correct except for the

default route :

ip route 0.0.0.0 0.0.0.0 210.190.60.66

The first default route is sufficient.

Thanks

Karar Sudi

4 REPLIES
New Member

Re: IPSec Site To Site VPN from Cisco 837 Router to FortiGate 20

Hi,

Three changes required in this configuration.

(1) change the NAT access-list 102 as below:

access-list 102 deny ip 10.20.20.0 0.0.0.255 172.20.10.0 0.0.0.255

access-list 102 permit ip 10.20.20.0 0.0.0.255 any

(2) apply the crypto map on ATM point-to-point interface.

(3) Remote the any of one default-route.

Thanks,

Mustafa

New Member

Re: IPSec Site To Site VPN from Cisco 837 Router to FortiGate 20

Hi Mustafa,

Thanks for your great advice!

Here are the changes, hope I got it right this time. :)

crypto isakmp policy 10

encr des

authentication pre-share

group 1

hash md5

crypto isakmp key sitetositevpn address 210.190.60.66

!

crypto ipsec transform-set ciscoset esp-des esp-md5-hmac

!

crypto map ciscomap 10 ipsec-isakmp

set peer 210.190.60.66

set transform-set ciscoset

match address 111

!

!

interface Ethernet0

description LAN 3

ip address 10.20.20.1 255.255.255.0

ip nat inside

service-policy output servers-policy

hold-queue 100 out

!

interface ATM0

no ip address

atm vc-per-vp 64

no atm ilmi-keepalive

dsl operating-mode auto

!

interface ATM0.1 point-to-point

ip address 210.190.20.62 255.255.255.252

crypto map ciscomap

no ip redirects <-- Disable ICMP

no ip unreachables <-- Disable ICMP host unreachable messages

no ip proxy-arp <-- disables IP directed broadcasts

ip nat outside

pvc 8/35

encapsulation aal5snap

!

!

ip nat inside source list 102 interface ATM0.1 overload

ip classless

ip route 0.0.0.0 0.0.0.0 ATM0.1

ip route 0.0.0.0 0.0.0.0 210.190.60.66

no ip http secure-server

!

access-list 102 remark Traffic to NAT

access-list 102 deny ip 10.20.20.0 0.0.0.255 172.20.10.0 0.0.0.255

access-list 102 permit ip 10.20.20.0 0.0.0.255 any

!

access-list 111 remark Site to Site VPN from LAN 3 to LAN 2 Network

access-list 111 permit ip 10.20.20.0 0.0.0.255 172.20.10.0 0.0.0.255

Regards,

Junhan

New Member

Re: IPSec Site To Site VPN from Cisco 837 Router to FortiGate 20

Your config appears correct except for the

default route :

ip route 0.0.0.0 0.0.0.0 210.190.60.66

The first default route is sufficient.

Thanks

Karar Sudi

New Member

Re: IPSec Site To Site VPN from Cisco 837 Router to FortiGate 20

Hi Karar Sudi,

Thanks for your great advise!

Hopefully I got it working this time round. :)

crypto isakmp policy 10

encr des

authentication pre-share

group 1

hash md5

crypto isakmp key sitetositevpn address 210.x.x.66

!

crypto ipsec transform-set ciscoset esp-des esp-md5-hmac

!

crypto map ciscomap 10 ipsec-isakmp

set peer 210.x.x.66

set transform-set ciscoset

match address 111

!

!

interface Ethernet0

description LAN 3

ip address 10.20.20.1 255.255.255.0

ip nat inside

service-policy output servers-policy

hold-queue 100 out

!

interface ATM0

no ip address

atm vc-per-vp 64

no atm ilmi-keepalive

dsl operating-mode auto

!

interface ATM0.1 point-to-point

ip address 210.x.x.62 255.255.255.252

crypto map ciscomap

no ip redirects <-- Disable ICMP

no ip unreachables <-- Disable ICMP host unreachable messages

no ip proxy-arp <-- disables IP directed broadcasts

ip nat outside

pvc 8/35

encapsulation aal5snap

!

!

ip nat inside source list 102 interface ATM0.1 overload

ip classless

ip route 0.0.0.0 0.0.0.0 ATM0.1

no ip http secure-server

!

access-list 102 remark Traffic to NAT

access-list 102 deny ip 10.20.20.0 0.0.0.255 172.20.10.0 0.0.0.255

access-list 102 permit ip 10.20.20.0 0.0.0.255 any

!

access-list 111 remark Site to Site VPN from LAN 3 to LAN 2 Network

access-list 111 permit ip 10.20.20.0 0.0.0.255 172.20.10.0 0.0.0.255

Regards,

Junhan

2484
Views
0
Helpful
4
Replies
CreatePlease to create content