Solved

Multiple crypto maps on WAN interface

Posted on 2010-09-14
7
740 Views
Last Modified: 2012-06-27
We have ipsec tunnels set for a vendor and the crypto map is set on the WAN interface. We want to have another tunnel to different vendor, is there a way to set multiple IPSEC tunnel on one interface?

Thanks;
0
Comment
Question by:totaram
  • 4
  • 2
7 Comments
 
LVL 16

Expert Comment

by:uescomp
ID: 33674317
Yes you can have multiple VPN tunnels on one interface, but  you can only use one crypto map.  You get around this by using multiple statements, one for each tunnel.  So the first tunnel would be:

crypto map MAP_NAME 1 ipsec-isakmp

and the second one would be

cyrpto map MAP_NAME 2 ipsec-isakmp

0
 

Author Comment

by:totaram
ID: 33675208
Can one use different transform set within each tunnel? Also, please let me know if where exactly the isakmp policy is used? I have the following policy defined:

Protection suite of priority 10
        encryption algorithm:   Three key triple DES
        hash algorithm:         Secure Hash Standard
        authentication method:  Pre-Shared Key
        Diffie-Hellman group:   #2 (1024 bit)
        lifetime:               28800 seconds, no volume limit

but where does it take an affect???? I define the crypto map with interface, but crypto map does not have any mention of the policy.
0
 
LVL 16

Accepted Solution

by:
uescomp earned 250 total points
ID: 33677198
http://www.routergeek.net/content/view/50/37/

This is the guide that I used to set up my tunnels.  We have three site to site tunnels in a hub a spoke configuration.  The note at the bottom of the article explains how to modify the config for multiple tunnels on the same interface.  Basically your are creating two crypto maps with the same name but different priorities.
0
Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

 

Author Comment

by:totaram
ID: 33677392
I understand the guide, my issue is what do I need to do if I need to change step 1 too ? ( I see that note ask us repeat 2-7). Should I just keep going on as usual (two crypto maps with same name, but different priorities)?
0
 
LVL 6

Expert Comment

by:kuoh
ID: 33679229
I'm not sure why that guide ties policy number 9 to pre-shared key usage.  You can repeat step 1 and use the parameters you need, just with a different policy number.  Negotiation starts with the lowest policy number until a match is found.  The following should work for what you specified.

crypto isakmp policy 10
encryption 3des
hash sha
group 2
lifetime 28800
authentication pre-share


0
 

Author Comment

by:totaram
ID: 33695474
OK.. I added a new crypto map entry with different (lesser) priority to the same map. Is it automatic that the new policy will kick or do I need to take off the cypto map association to the gi interface (WAN link) and add it back? I did not want to disturb the existing ipsec tunnels with other customer.
0
 

Author Comment

by:totaram
ID: 33696169
Never mind, the issue has been sorted.
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Tools to detect weak WiFi routers prior connecting to it 14 121
Router assigned IP addresses 18 90
How to setup 3 isps on a redundant mode? 3 30
Failover VPN Question Sonicwall 5 33
In the world of WAN, QoS is a pretty important topic for most, if not all, networks. Some WAN technologies have QoS mechanisms built in, but others, such as some L2 WAN's, don't have QoS control in the provider cloud.
Quality of Service (QoS) options are nearly endless when it comes to networks today. This article is merely one example of how it can be handled in a hub-n-spoke design using a 3-tier configuration.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question