Currently have a Cisco 2610 router configured for remote VPN access via the Cisco VPN Client. We would like to also use this same router in a site-to-site VPN scenario to another office. Is it possible to provide both these services with this one router and one public IP address? I thought you could only apply one crypto map to the outside interface?
Below is our current running-config; Thanks for any help.
version 12.3
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname VPNrouter
!
boot-start-marker
boot system tftp c2600-ik9o3s3-mz.123-18.bin 10.200.202.50
boot-end-marker
!
enable secret 5 $1$/uXD$.pXv9eM.XBJYm9cBbiUjd1
!
aaa new-model
!
!
aaa authentication login local local
aaa authorization network VPN local
aaa session-id common
ip subnet-zero
ip cef
!
!
no ip domain lookup
!
ip dhcp pool test
!
ip audit po max-events 100
!
!
!
!
!
!
!
!
username **** password 0 ****
username **** password 0 ****
username **** password 0 ****
username **** password 0 ****
!
!
!
crypto isakmp policy 3
encr 3des
authentication pre-share
group 2
!
crypto isakmp client configuration group ****
key creatine
dns 10.200.202.50
domain xxxx.com
pool VPNpool
acl 101
!
!
crypto ipsec transform-set VPN esp-3des esp-md5-hmac
!
crypto dynamic-map dynmap 10
set transform-set VPN
!
!
crypto map VPNmap client authentication list local
crypto map VPNmap isakmp authorization list VPN
crypto map VPNmap client configuration address respond
crypto map VPNmap 10 ipsec-isakmp dynamic dynmap
!
!
!
interface Ethernet0/0
ip address 10.200.201.100 255.255.255.0
ip broadcast-address 0.0.0.0
half-duplex
crypto map VPNmap
!
!
ip local pool VPNpool 10.200.203.1 10.200.203.50
ip http server
no ip http secure-server
ip http path flash:
ip classless
ip route 0.0.0.0 0.0.0.0 10.200.201.254
!
access-list 101 permit ip 172.16.0.0 0.0.255.255 10.200.203.0 0.0.0.255
access-list 101 permit ip 192.168.0.0 0.0.255.255 10.200.203.0 0.0.0.255
access-list 101 permit ip 172.30.0.0 0.0.255.255 10.200.203.0 0.0.0.255
access-list 101 permit ip 10.200.0.0 0.0.255.255 10.200.203.0 0.0.0.255
access-list 101 permit ip 10.100.0.0 0.0.255.255 10.200.203.0 0.0.0.255
!
!
!
!
!
line con 0
line aux 0
line vty 0 4
exec-timeout 90 0
password ****
!
!
end
What exactly do you need help with? I see that you've already got remote access setup. The two can be configured side by side with no problem - just make sure your router has enough throughput to handle it all.
Here is a link to setting up site to site on a 2600 router - this should get you up and running! Go to the bottom of the article and download the "template" - this will automatically generate all commands you need to get this working. You do need an account to get this but the signup is free.
http://articles.techrepublic.com.com/5100-10878_11-6130365.html
Cheers! Let me know if you have any questions!