Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 671
  • Last Modified:

Cisco LAN-to-LAN IPsec Tunnel Between Two Routers with a NAT device in the middle

Hi

Topology is

Cisco 881 (Outside on the Internet) wanting to create a number of tunnels to Cisco 881's inside a MPLS network. The MPLS provider has provided a Gateway with a Public IP address and they  have created a different IKE and IPSEC port for each inside host that we want to create a tunnel too.

I.e IKE 4510 / IPSEC 45010 redirect inside to inside Host 10.10.1.100 IKE 500 / IPSEC 4500

Can I on my Cisco 881 on the Internet specify the destination ports that happen in Phase 1 and Phase 2?

Running a very basic L2L Config atm between hosts within the MPLS as per Cisco - http://www.cisco.com/c/en/us/support/docs/routers/1700-series-modular-access-routers/71462-rtr-l2l-ipsec-split.html

 Kind Regards

Steve
0
netprimates
Asked:
netprimates
  • 4
  • 4
1 Solution
 
Matt VCommented:
I'm not sure why you want to use different ports for the tunnels.  You can have multiple tunnels connected over the same ports.
0
 
netprimatesAuthor Commented:
Different EP's behind the traversal device in the middle
0
 
netprimatesAuthor Commented:
Traversal device isn't terminating the tunnels
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 
Matt VCommented:
In that case you may need to have enough outward facing IPs for each EP to connect.

No way that I am aware of to specify which ports the tunnel will use.
0
 
netprimatesAuthor Commented:
I thought as much, the tunnels are created from the public internet through to the internal EP so they will need a dedicated public IP per private EP. One would assume.
0
 
Matt VCommented:
That would be my understanding as well.  No way you could combine those end points into one larger one and route the tunnels out from there?
0
 
netprimatesAuthor Commented:
I am afraid not, I wish. I pushed to have a connection into the site that was on the MPLS but some bright spark thought it best to put it behind a NAT traversal box.

I didn't think there was an option to specify the ports on a Cisco config but they insisted you can.
0
 
Matt VCommented:
Looks like you can use encapsulation on an ASA, but if you are using IOS devices you are out of luck.

https://supportforums.cisco.com/discussion/11085486/how-change-port-number-isakmp
0

Featured Post

The IT Degree for Career Advancement

Earn your B.S. in Network Operations and Security and become a network and IT security expert. This WGU degree program curriculum was designed with tech-savvy, self-motivated students in mind – allowing you to use your technical expertise, to address real-world business problems.

  • 4
  • 4
Tackle projects and never again get stuck behind a technical roadblock.
Join Now