• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 651
  • Last Modified:

how to setup site to site vpn

Both offices A and B have SHDSL, office A uses a Cisco router 1900, while B has a Cisco ASA 5500 Firewall and a 1900 router.

How to config them to have a site to site vpn, so that PCs in both sites can communicate each other? thanks
0
tonitoni99
Asked:
tonitoni99
1 Solution
 
Scott ThomsonCommented:
Hi tonitoni99

This is a common question. and unfortunately I am not good enough with Cisco to help you. What I could suggest is you search through EE because I see this questions posted 2 - 3 times a day so there is most likely a great guide for you that has been in a previous question. Of course other experts will comment in time but in the meantime I would suggest you do some searching :) you might manage to find the answer you need before an expert can specifically explain the config of your exact setup.

Thanks
0
 
asavenerCommented:
What version of the IOS are you running?

There are a few basic pieces of information you need in order to get this working.

1. what two devices are going to constitute the endpoints of the VPN?  

2. What traffic needs to go over the VPN?  You need to define the traffic flows in access lists on each end, and the access lists must be complimentary.
Example:  site A: ip access-list extended VPN-to-B permit ip 192.168.0.0 0.0.0.255 192.168.1.0 0.0.0.255
site B:  ip access-list extended VPN-to-A permit ip 192.168.1.0 0.0.0.255 192.168.0.0 0.0.0.255

3. What are the peer IP addresses?  (The outside addresses of the VPN endpoints.)

4. Define the IKE policies.  (Allowed hashing and encryption method for Phase 1)

5. Define the transform set.  (Allowed hashing and encryption for the VPN itself)

6.  Define pre-shared keys.  (Make sure it's nice and long.)

7.  Define the crypto map.  (includes peer address, access list AKA "interesting traffic", transform set, and option description)

8.  Assign the crypto map to an interface.

9.  Make sure the all required traffic is allowed through access lists and/or firewalls.  (Required traffic is UDP/500 and either ESP protocol or UDP/4500, depending on whether you're traversing a NAT device)


As long as you have the required info, it's pretty straightforward.  One thing to keep in mind is that it is NOT forgiving of typos, or mis-matched settings.  It will just fail.


http://www.cisco.com/c/en/us/support/docs/cloud-systems-management/configuration-professional/113337-ccp-vpn-routerA-routerB-config-00.html

http://www.cisco.com/c/en/us/support/docs/cloud-systems-management/configuration-professional/112153-ccp-vpn-asa-router-config-00.html
0
 
Pete LongConsultantCommented:
0

Featured Post

 The Evil-ution of Network Security Threats

What are the hacks that forever changed the security industry? To answer that question, we created an exciting new eBook that takes you on a trip through hacking history. It explores the top hacks from the 80s to 2010s, why they mattered, and how the security industry responded.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now