Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 319
  • Last Modified:

Remote access VPN and site-to-site VPN connections on one router

Currently have a Cisco 2610 router configured for remote VPN access via the Cisco VPN Client. We would like to also use this same router in a site-to-site VPN scenario to another office. Is it possible to provide both these services with this one router and one public IP address? I thought you could only apply one crypto map to the outside interface?

Below is our current running-config; Thanks for any help.


version 12.3
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname VPNrouter
!
boot-start-marker
boot system tftp c2600-ik9o3s3-mz.123-18.bin 10.200.202.50
boot-end-marker
!
enable secret 5 $1$/uXD$.pXv9eM.XBJYm9cBbiUjd1
!
aaa new-model
!
!
aaa authentication login local local
aaa authorization network VPN local
aaa session-id common
ip subnet-zero
ip cef
!
!
no ip domain lookup
!
ip dhcp pool test
!
ip audit po max-events 100
!
!
!
!
!
!
!
!
username **** password 0 ****
username **** password 0 ****
username **** password 0 ****
username **** password 0 ****
!
!
!
crypto isakmp policy 3
 encr 3des
 authentication pre-share
 group 2
!
crypto isakmp client configuration group ****
 key creatine
 dns 10.200.202.50
 domain xxxx.com
 pool VPNpool
 acl 101
!
!
crypto ipsec transform-set VPN esp-3des esp-md5-hmac
!
crypto dynamic-map dynmap 10
 set transform-set VPN
!
!
crypto map VPNmap client authentication list local
crypto map VPNmap isakmp authorization list VPN
crypto map VPNmap client configuration address respond
crypto map VPNmap 10 ipsec-isakmp dynamic dynmap
!
!
!

interface Ethernet0/0
  ip address 10.200.201.100 255.255.255.0
 ip broadcast-address 0.0.0.0
 half-duplex
 crypto map VPNmap
!
!
ip local pool VPNpool 10.200.203.1 10.200.203.50
ip http server
no ip http secure-server
ip http path flash:
ip classless
ip route 0.0.0.0 0.0.0.0 10.200.201.254
!
access-list 101 permit ip 172.16.0.0 0.0.255.255 10.200.203.0 0.0.0.255
access-list 101 permit ip 192.168.0.0 0.0.255.255 10.200.203.0 0.0.0.255
access-list 101 permit ip 172.30.0.0 0.0.255.255 10.200.203.0 0.0.0.255
access-list 101 permit ip 10.200.0.0 0.0.255.255 10.200.203.0 0.0.0.255
access-list 101 permit ip 10.100.0.0 0.0.255.255 10.200.203.0 0.0.0.255
!
!
!
!
!
line con 0
line aux 0
line vty 0 4
 exec-timeout 90 0
 password ****
!
!
end
0
Italia_NYC
Asked:
Italia_NYC
  • 3
  • 3
1 Solution
 
SysExpertCommented:
I do this on a Netscreen 5 GT, so I would think that it should work on a Cisco, but it may be device dependent.

0
 
Italia_NYCAuthor Commented:
I applaud your effort and participation SysExpert. Unfortunately however, that was not very useful to me.
0
 
PugglewuggleCommented:
Yes, you absolutely can setup both site-to-site VPN and remote access VPN on a Cisco router. I do it all the time.
What exactly do you need help with? I see that you've already got remote access setup. The two can be configured side by side with no problem - just make sure your router has enough throughput to handle it all.
Here is a link to setting up site to site on a 2600 router - this should get you up and running! Go to the bottom of the article and download the "template" - this will automatically generate all commands you need to get this working. You do need an account to get this but the signup is free.
http://articles.techrepublic.com.com/5100-10878_11-6130365.html 
Cheers! Let me know if you have any questions!
0
 The Evil-ution of Network Security Threats

What are the hacks that forever changed the security industry? To answer that question, we created an exciting new eBook that takes you on a trip through hacking history. It explores the top hacks from the 80s to 2010s, why they mattered, and how the security industry responded.

 
Italia_NYCAuthor Commented:
I guess the help I am seeking or where the confusion stems from, is I'm pretty sure you can only apply one crypto map per interface. So I have one applied now for Remote Access and am perhaps unsure how to modify the existing crypto map to accommodate both. Excellent link you provided though Puggle! Thanks!
0
 
PugglewuggleCommented:
You use the same crypto map. Do you have a contract on the device? If you do, just contact Cisco and they'll guide you through it. Otherwise, post your config and I'll take a look.
Cheers!
0
 
Italia_NYCAuthor Commented:
No Cisco contract unfortunately. The config is posted above in my original post; did you need something else that will help? Thank you for the assistance.
0
 
PugglewuggleCommented:
Did you try the template I sent you? That will give you the commands you need.
Like I said - remote access and S2S work just fine side by side. Just try it out.
Cheers!
0

Featured Post

[Webinar] Cloud and Mobile-First Strategy

Maybe you’ve fully adopted the cloud since the beginning. Or maybe you started with on-prem resources but are pursuing a “cloud and mobile first” strategy. Getting to that end state has its challenges. Discover how to build out a 100% cloud and mobile IT strategy in this webinar.

  • 3
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now