Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

IPSec VPN: VLAN to host

Hi Cisco Gurus!

I am goofing around with Packet Tracer, and now I try to connect a VLAN to a remote host using IPSec VPN connection. Problem is that I can ping all hosts on remote network. Please take a look at my settings to help me get past this problem.

Screen shot of PT:

http://postimg.org/image/3w50ptw5z/

Basically what I want to do is permit traffic from VLAN 10 to the 10.0.0.20 server, and from VLAN 20 to the 10.0.0.21 server. At the moment I can ping both servers from both VLANs.

Crypto map from Router1

Router#sh crypto map

Crypto Map MYMAP 10 ipsec-isakmp

        Peer = 80.202.220.20

        Extended IP access list 101

            access-list 101 permit ip 192.168.1.0 0.0.0.255 host 10.0.0.20

            access-list 101 deny ip 192.168.1.0 0.0.0.255 host 10.0.0.21

        Current peer: 80.202.220.20

        Security association lifetime: 4608000 kilobytes/3600 seconds

        PFS (Y/N): N

        Transform sets={

                MYSET,

        }

        Interfaces using crypto map MYMAP:

                Serial0/1/0

Crypto map from Router0

Router#sh crypto map

Crypto Map MYMAP 10 ipsec-isakmp

        Peer = 80.223.10.140

        Extended IP access list 101

            access-list 101 permit ip host 10.0.0.20 192.168.1.0 0.0.0.255

            access-list 101 deny ip host 10.0.0.21 192.168.1.0 0.0.0.255

        Current peer: 80.223.10.140

        Security association lifetime: 4608000 kilobytes/3600 seconds

        PFS (Y/N): N

        Transform sets={

                MYSET,

        }

        Interfaces using crypto map MYMAP:

                Serial0/1/0

There are no other ACLs on eighter router. This is actually for troubleshooting a larger setup, where one VLAN should be permited to use a application server and the other VLAN should send backup to a backup server. So I narrowed it down to this setup, but still the same problem.

I can place an ACL on the router at the server park.. but I want the IPSec ACLs to do this before the traffic reaches the WAN.

If you need more info, please ask!

Thanks in advanced.. I know this is a bit above knowledge levek, but I like to reach high

Everyone's tags (4)
4 REPLIES
VIP Purple

Re: IPSec VPN: VLAN to host

Just a guess as you didn't post your config:

Also without the IPSec you already have end-to-end connectivity where the VLANs on the right can reach the servers on the left? Then your crypto map only tell which traffic to protect (and you don't need the deny lines in your case). All traffic that doesn't have a permit in the crypto-ACL is processed "the normal way" which could be plain routing.

For a scenario that is more realistic, configure your routers in a way that each router only can only reach the serial interface of the other router but not the networks behind the routers. That is also the situation on the internet. Full connectivity between all router-addresses, but it's not possible to reach the private addresses in the LANs from the internet.

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni


--
Don't stop after you've improved your network! Improve the world by lending money to the working poor: http://www.kiva.org/invitedby/karsteni
New Member

IPSec VPN: VLAN to host

Takk Karsten!

Yes, they can reach eachother because I use static routes, which tutorials often use when demonstrating IPSec.

So this would not be an issue in a real life enviroment, then? I thought that the VPN tunnel connected the two LANs, so that they were acting like one LAN. (as long as the router knew where to find the 10.x.x.x LAN.) I also thought that crypto-ACL worked the same as normal ACLs, but that is not the case?

VIP Purple

IPSec VPN: VLAN to host

I also thought that crypto-ACL worked the same as normal ACLs, but that is not the case?

no, they only control which traffic should be protected by IPsec. But they don't control which traffic can be routed through the router. For that, "normal" interface-ACLs are still used.

For additional tests and learning you should add an ISP-router between your router0 and router1 (not sure if packet-trace has this flexibility, I personally never used that). This ISP-router should only know the WAN-addresses of your routers 0 and 1. Then it should work as you expect it that only the traffic that is defined in the crypto map is possible between the two networks.

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni


--
Don't stop after you've improved your network! Improve the world by lending money to the working poor: http://www.kiva.org/invitedby/karsteni
New Member

IPSec VPN: VLAN to host

Thanks for good answers Karsten, this explains alot, actually

262
Views
0
Helpful
4
Replies