Site-To-Site VPN with Cisco 887

I have a client with Cisco 887 router on each site, and I need to create a vpn between sites, I have added this to my config, but no VPN works:

crypto isakmp key *VPNpsk#1 address XXX.XXX.XXX.XXX
!
!
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
 mode tunnel
!
!
!
crypto map SDM_CMAP_1 1 ipsec-isakmp
 description Tunnel to XXX.XXX.XXX.XXX
 set peer XXX.XXX.XXX.XXX
 set transform-set ESP-3DES-SHA
 match address 100
!
bridge irb

access-list 100 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 101 deny   ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255

any ideas, or working configs??
fns-netsysAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Jody LemoineNetwork ArchitectCommented:
It's hard to say without seeing the entire configuration. Depending on how the rest of your configuration looks, you may be running into problems with NAT, external ACLs, &c.

If you're connecting a pair of IOS routers, you can simplify things a bit by using a virtual tunnel interface. This eliminates complexities with NAT and allows you to use standard routing.

Router 1:

crypto isakmp key *VPNpsk#1 address x.x.x.x no-xauth
!
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
!
crypto ipsec profile crypto-ipsec-pr-vti
 set transform-set ESP-3DES-SHA
!
interface Tunnel0
 ip address 192.168.255.0 255.255.255.254
 tunnel source Dialer1 (or whatever your outside interface is)
 tunnel mode ipsec ipv4
 tunnel destination x.x.x.x
 tunnel protection ipsec profile crypto-ipsec-pr-vti
!
ip route 192.168.2.0 255.255.255.0 Tunnel0

Router 2:

crypto isakmp key *VPNpsk#1 address x.x.x.x no-xauth
!
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
!
crypto ipsec profile crypto-ipsec-pr-vti
 set transform-set ESP-3DES-SHA
!
interface Tunnel0
 ip address 192.168.255.1 255.255.255.254
 tunnel source Dialer1 (or whatever your outside interface is)
 tunnel mode ipsec ipv4
 tunnel destination x.x.x.x
 tunnel protection ipsec profile crypto-ipsec-pr-vti
!
ip route 192.168.1.0 255.255.255.0 Tunnel0

Also, make sure that your access lists are allowing ISAKMP (500/udp) and ESP to reach the router.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
fns-netsysAuthor Commented:
Awesome, thank you so much! this worked flawlessly.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Routers

From novice to tech pro — start learning today.