Cisco VPN Tunnels

Hi All,

I have a customer with 4 sites, these sites are have an ADSL connection each that has been set-aside for VPN.

They require site-to-site VPN to be set up so each router has a VPN tunnel to the next - so there will need to be 3 x site-to-site VPN connections per router.

I have looked on the Cisco website and it would seem that Cisco 800 series routers (867 for example) is what we need for this.  My only questions is the number of tunnels it can accomodate - if it can have a max of 5 tunnels does this mean I can have what I require?


Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

John MeggersNetwork ArchitectCommented:
The 800 is definitely the Cisco platform most used with ADSL connections.  As for the number of tunnels, you are correct, for a full mesh each site would have three tunnels, each to the other locations.  Obviously that's fewer than 5, so if there is actually a limitation of 5 tunnels (I haven't looked at the data sheet), you're still OK.  The bigger issue, IMO, is the amount of data that needs to be encrypted.  Maintaining the tunnels itself does take some processing power, but my opinion is it's most likely a guideline to keep the processing the router was being asked to do under control.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Correct, 867 supports 5 ipsec tunnels, 887 supports 20. I 100% agree with jmeggers that even though they say it supports 5, the routers might get bogged down bad depending on things like how much traffic is being passed. I've brought up one tunnel and seen the routers on each end become inoperable pegging the CPU (wasnt an 867)
Best bet would be to check with a Cisco sales rep. I would trust them to give you an honest answer and not upsell you. Also if there is a chance for expansion it might be wise just to get something like the 887 from the start.

As you have said Cisco 8xx is the way to go. The feature you need is DMVPN It's only available in the advipservices version of the IOS.

It uses a hub spoke design VPN. Each site (spoke) can communicate directly with each other rather than via a central point. So you don't need massive amounts of bandwidth at the hub. You only need a fixed IP on the Hub, the other sites can use dynamic IPs (lowering the ISP costs)

I've used this successfully on the Cisco 877W with 8 sites, without any issues. Very cost effective.

It relatively simple to setup and works well.

It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.