?
Solved

Multiple crypto maps on WAN interface

Posted on 2010-09-14
7
Medium Priority
?
749 Views
Last Modified: 2012-06-27
We have ipsec tunnels set for a vendor and the crypto map is set on the WAN interface. We want to have another tunnel to different vendor, is there a way to set multiple IPSEC tunnel on one interface?

Thanks;
0
Comment
Question by:totaram
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 2
7 Comments
 
LVL 16

Expert Comment

by:uescomp
ID: 33674317
Yes you can have multiple VPN tunnels on one interface, but  you can only use one crypto map.  You get around this by using multiple statements, one for each tunnel.  So the first tunnel would be:

crypto map MAP_NAME 1 ipsec-isakmp

and the second one would be

cyrpto map MAP_NAME 2 ipsec-isakmp

0
 

Author Comment

by:totaram
ID: 33675208
Can one use different transform set within each tunnel? Also, please let me know if where exactly the isakmp policy is used? I have the following policy defined:

Protection suite of priority 10
        encryption algorithm:   Three key triple DES
        hash algorithm:         Secure Hash Standard
        authentication method:  Pre-Shared Key
        Diffie-Hellman group:   #2 (1024 bit)
        lifetime:               28800 seconds, no volume limit

but where does it take an affect???? I define the crypto map with interface, but crypto map does not have any mention of the policy.
0
 
LVL 16

Accepted Solution

by:
uescomp earned 1000 total points
ID: 33677198
http://www.routergeek.net/content/view/50/37/

This is the guide that I used to set up my tunnels.  We have three site to site tunnels in a hub a spoke configuration.  The note at the bottom of the article explains how to modify the config for multiple tunnels on the same interface.  Basically your are creating two crypto maps with the same name but different priorities.
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 

Author Comment

by:totaram
ID: 33677392
I understand the guide, my issue is what do I need to do if I need to change step 1 too ? ( I see that note ask us repeat 2-7). Should I just keep going on as usual (two crypto maps with same name, but different priorities)?
0
 
LVL 6

Expert Comment

by:kuoh
ID: 33679229
I'm not sure why that guide ties policy number 9 to pre-shared key usage.  You can repeat step 1 and use the parameters you need, just with a different policy number.  Negotiation starts with the lowest policy number until a match is found.  The following should work for what you specified.

crypto isakmp policy 10
encryption 3des
hash sha
group 2
lifetime 28800
authentication pre-share


0
 

Author Comment

by:totaram
ID: 33695474
OK.. I added a new crypto map entry with different (lesser) priority to the same map. Is it automatic that the new policy will kick or do I need to take off the cypto map association to the gi interface (WAN link) and add it back? I did not want to disturb the existing ipsec tunnels with other customer.
0
 

Author Comment

by:totaram
ID: 33696169
Never mind, the issue has been sorted.
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Tired of waiting for your show or movie to load?  Are buffering issues a constant problem with your internet connection?  Check this article out to see if these simple adjustments are the solution for you.
Quality of Service (QoS) options are nearly endless when it comes to networks today. This article is merely one example of how it can be handled in a hub-n-spoke design using a 3-tier configuration.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…
Suggested Courses

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question