Solved

Multiple crypto maps on WAN interface

Posted on 2010-09-14
7
737 Views
Last Modified: 2012-06-27
We have ipsec tunnels set for a vendor and the crypto map is set on the WAN interface. We want to have another tunnel to different vendor, is there a way to set multiple IPSEC tunnel on one interface?

Thanks;
0
Comment
Question by:totaram
  • 4
  • 2
7 Comments
 
LVL 16

Expert Comment

by:uescomp
ID: 33674317
Yes you can have multiple VPN tunnels on one interface, but  you can only use one crypto map.  You get around this by using multiple statements, one for each tunnel.  So the first tunnel would be:

crypto map MAP_NAME 1 ipsec-isakmp

and the second one would be

cyrpto map MAP_NAME 2 ipsec-isakmp

0
 

Author Comment

by:totaram
ID: 33675208
Can one use different transform set within each tunnel? Also, please let me know if where exactly the isakmp policy is used? I have the following policy defined:

Protection suite of priority 10
        encryption algorithm:   Three key triple DES
        hash algorithm:         Secure Hash Standard
        authentication method:  Pre-Shared Key
        Diffie-Hellman group:   #2 (1024 bit)
        lifetime:               28800 seconds, no volume limit

but where does it take an affect???? I define the crypto map with interface, but crypto map does not have any mention of the policy.
0
 
LVL 16

Accepted Solution

by:
uescomp earned 250 total points
ID: 33677198
http://www.routergeek.net/content/view/50/37/

This is the guide that I used to set up my tunnels.  We have three site to site tunnels in a hub a spoke configuration.  The note at the bottom of the article explains how to modify the config for multiple tunnels on the same interface.  Basically your are creating two crypto maps with the same name but different priorities.
0
6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

 

Author Comment

by:totaram
ID: 33677392
I understand the guide, my issue is what do I need to do if I need to change step 1 too ? ( I see that note ask us repeat 2-7). Should I just keep going on as usual (two crypto maps with same name, but different priorities)?
0
 
LVL 6

Expert Comment

by:kuoh
ID: 33679229
I'm not sure why that guide ties policy number 9 to pre-shared key usage.  You can repeat step 1 and use the parameters you need, just with a different policy number.  Negotiation starts with the lowest policy number until a match is found.  The following should work for what you specified.

crypto isakmp policy 10
encryption 3des
hash sha
group 2
lifetime 28800
authentication pre-share


0
 

Author Comment

by:totaram
ID: 33695474
OK.. I added a new crypto map entry with different (lesser) priority to the same map. Is it automatic that the new policy will kick or do I need to take off the cypto map association to the gi interface (WAN link) and add it back? I did not want to disturb the existing ipsec tunnels with other customer.
0
 

Author Comment

by:totaram
ID: 33696169
Never mind, the issue has been sorted.
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Suggested Solutions

Creating an OSPF network that automatically (dynamically) reroutes network traffic over other connections to prevent network downtime.
Getting hacked is no longer a matter or "if you get hacked" — the 2016 cyber threat landscape is now titled "when you get hacked." When it happens — will you be proactive, or reactive?
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now