Cisco VPN Tunnels

Hi All,

I have a customer with 4 sites, these sites are have an ADSL connection each that has been set-aside for VPN.

They require site-to-site VPN to be set up so each router has a VPN tunnel to the next - so there will need to be 3 x site-to-site VPN connections per router.

I have looked on the Cisco website and it would seem that Cisco 800 series routers (867 for example) is what we need for this.  My only questions is the number of tunnels it can accomodate - if it can have a max of 5 tunnels does this mean I can have what I require?


Who is Participating?
John MeggersConnect With a Mentor Network ArchitectCommented:
The 800 is definitely the Cisco platform most used with ADSL connections.  As for the number of tunnels, you are correct, for a full mesh each site would have three tunnels, each to the other locations.  Obviously that's fewer than 5, so if there is actually a limitation of 5 tunnels (I haven't looked at the data sheet), you're still OK.  The bigger issue, IMO, is the amount of data that needs to be encrypted.  Maintaining the tunnels itself does take some processing power, but my opinion is it's most likely a guideline to keep the processing the router was being asked to do under control.
Correct, 867 supports 5 ipsec tunnels, 887 supports 20. I 100% agree with jmeggers that even though they say it supports 5, the routers might get bogged down bad depending on things like how much traffic is being passed. I've brought up one tunnel and seen the routers on each end become inoperable pegging the CPU (wasnt an 867)
Best bet would be to check with a Cisco sales rep. I would trust them to give you an honest answer and not upsell you. Also if there is a chance for expansion it might be wise just to get something like the 887 from the start.

As you have said Cisco 8xx is the way to go. The feature you need is DMVPN It's only available in the advipservices version of the IOS.

It uses a hub spoke design VPN. Each site (spoke) can communicate directly with each other rather than via a central point. So you don't need massive amounts of bandwidth at the hub. You only need a fixed IP on the Hub, the other sites can use dynamic IPs (lowering the ISP costs)

I've used this successfully on the Cisco 877W with 8 sites, without any issues. Very cost effective.

It relatively simple to setup and works well.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.