Solved

Multiple crypto maps on WAN interface

Posted on 2010-09-14
7
741 Views
Last Modified: 2012-06-27
We have ipsec tunnels set for a vendor and the crypto map is set on the WAN interface. We want to have another tunnel to different vendor, is there a way to set multiple IPSEC tunnel on one interface?

Thanks;
0
Comment
Question by:totaram
  • 4
  • 2
7 Comments
 
LVL 16

Expert Comment

by:uescomp
ID: 33674317
Yes you can have multiple VPN tunnels on one interface, but  you can only use one crypto map.  You get around this by using multiple statements, one for each tunnel.  So the first tunnel would be:

crypto map MAP_NAME 1 ipsec-isakmp

and the second one would be

cyrpto map MAP_NAME 2 ipsec-isakmp

0
 

Author Comment

by:totaram
ID: 33675208
Can one use different transform set within each tunnel? Also, please let me know if where exactly the isakmp policy is used? I have the following policy defined:

Protection suite of priority 10
        encryption algorithm:   Three key triple DES
        hash algorithm:         Secure Hash Standard
        authentication method:  Pre-Shared Key
        Diffie-Hellman group:   #2 (1024 bit)
        lifetime:               28800 seconds, no volume limit

but where does it take an affect???? I define the crypto map with interface, but crypto map does not have any mention of the policy.
0
 
LVL 16

Accepted Solution

by:
uescomp earned 250 total points
ID: 33677198
http://www.routergeek.net/content/view/50/37/

This is the guide that I used to set up my tunnels.  We have three site to site tunnels in a hub a spoke configuration.  The note at the bottom of the article explains how to modify the config for multiple tunnels on the same interface.  Basically your are creating two crypto maps with the same name but different priorities.
0
Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

 

Author Comment

by:totaram
ID: 33677392
I understand the guide, my issue is what do I need to do if I need to change step 1 too ? ( I see that note ask us repeat 2-7). Should I just keep going on as usual (two crypto maps with same name, but different priorities)?
0
 
LVL 6

Expert Comment

by:kuoh
ID: 33679229
I'm not sure why that guide ties policy number 9 to pre-shared key usage.  You can repeat step 1 and use the parameters you need, just with a different policy number.  Negotiation starts with the lowest policy number until a match is found.  The following should work for what you specified.

crypto isakmp policy 10
encryption 3des
hash sha
group 2
lifetime 28800
authentication pre-share


0
 

Author Comment

by:totaram
ID: 33695474
OK.. I added a new crypto map entry with different (lesser) priority to the same map. Is it automatic that the new policy will kick or do I need to take off the cypto map association to the gi interface (WAN link) and add it back? I did not want to disturb the existing ipsec tunnels with other customer.
0
 

Author Comment

by:totaram
ID: 33696169
Never mind, the issue has been sorted.
0

Featured Post

Free Tool: Postgres Monitoring System

A PHP and Perl based system to collect and display usage statistics from PostgreSQL databases.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
ASA 5520 problem with Failover in Active/Standby 8 98
ASA configuration 2 39
ASA 5505 packet drops 14 46
RDP- Windows 7 home Premium to 7 Pro via VPN 10 16
How to set-up an On Demand, IPSec, Site to SIte, VPN from a Draytek Vigor Router to a Cyberoam UTM Appliance. A concise guide to the settings required on both devices
Envision that you are chipping away at another e-business site with a team of pundit developers and designers. Everything seems, by all accounts, to be going easily.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

821 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question