Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

site-to-site vpn tunnel problems....

Hello,

I have a small problem I need to get users access from site a to site b. However Site A connects to the central office through a site-to-site vpn and site b is also connected to the central office through a site-to-site vpn tunnel. The central office can ping both site a and b and site a and b can ping the central office however. Site a cannot ping site b. I would like for users from site a to see the shared drive on the server at site b, however the central office router isn't passing the traffic, I think. Is there a command or a set of commands that I need to enter on the central office to allow for the traffic to be passed? Or do I simply need to setup a vpn tunnel from site a to b? If so where can I find a good how to?

thanks,

Zeb

PS central office is a Cisco 1841 and site a and b are both Cisco 851w's

4 REPLIES
Cisco Employee

Re: site-to-site vpn tunnel problems....

Zeb,

Looks like you want to have VPN Tunnel communication between the spokes using the Hub Site.

Please refer the below URL for configuration details and explanation:

Configuring IPSec Router-to-Router Hub and Spoke with Communication Between the Spokes

http://cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a0080093dc8.shtml

I hope it helps.

Regards,

Arul

** Please rate all helpful posts **

New Member

Re: site-to-site vpn tunnel problems....

Arul,

That link was very helpful however I was looking over the configurations and noticed the only difference was they had an ip route for each subnet and I have a single ip route of 0.0.0.0 0.0.0.0 S0/0/0. Would that affect pinging from site a to site b? Thanks for your help

Zeb

New Member

Re: site-to-site vpn tunnel problems....

Hi Arul,

I will be very thankful if you clear my doubt . Here is my query .

In the Hub router configuration. the routes are like that.

ip route 172.16.1.0 255.255.255.0 Ethernet0

ip route 192.168.1.0 255.255.255.0 Ethernet0

ip route 200.1.0.0 255.255.0.0 Ethernet0

Three different subnet's will exit via ethernet0. but Two sperate tunnel is connected with the 'ethernet0'interface for two different spokes . In that case how the hub router will make the routing decision when spaoke 'A' want to communicates with spoke 'B'.0 .

My thinking is instead of specifying the 'interface' in the routing command why can't we specify the remote end gateway IP adderss for the respective subnets ?

can we change the routing commands like this ?

ip route 172.16.1.0 255.255.255.0 200.1.2.1

ip route 192.168.1.0 255.255.255.0 200.1.3.1

ip route 200.1.0.0 255.255.0.0 Ethernet0

Thanks in Advance ,

--Jaffer

New Member

Re: site-to-site vpn tunnel problems....

Jaffer:

Configuration of Acl and route can tell you how the hub router will make the routing decision when spoke 'A' want to communicates with spoke 'B'.

When Spoke 1(172.16.1.0/24) want to pass traffic to Spoke 2(192.168.1.0/24),Spoke 1 will setup ipsec tunnel with Hub.When Hub receives the traffic from Spoke 1 that want to visit Spoke 2,according to the configuration of HUB

crypto map mymap 20 ipsec-isakmp

set peer 200.x.x.1

set transform-set myset

match address 120

access-list 120 permit ip 172.16.1.0 0.0.0.255 192.168.1.0 0.0.0.255

ip route 192.168.1.0 255.255.255.0 Ethernet0

HUB will setup ipsec tunnel with Spoke 2.

Martin

167
Views
0
Helpful
4
Replies