Cisco Blog

Nice post, Jeremy. This is a neat case for using virtual tunnel interfaces with IPsec. Do you know when the "crypto ipsec profile VTI" command was introduced? I checked http://www.cisco.com/univercd, and couldn't determine the earliest version of IOS that has the VTI argument.

Thanks!

-Jeremy

Thanks for useful post!

Once again Jeremy you deliver top notch material. I have been using your CBT based materials for years now and each time your lab exercises help the "penny drop". Thanks once again.

I wonder if building an interface for VPN's, will allow us to start using OSPF, since the Tunnel now has "link state"?

Even though IPSec won't allow you to multicast, you should still be able to configure OSPF at the other side, wouldn't you think?

Hmmmmm

Good Post.

Yup - even OSPF works across it. The GRE tunnel allows it (along with all MCast traffic). IPSec is just used for the security features (encrypt/hash/etc) on top if it.

Thanks for the great post. I would like to add that when implementing the command:

crypto isakmp key cisco123 address 192.1.1.1 255.255.255.255 no-xauth

make sure that immediately following the word key you add in a 0 which specifies that following the 0 will be your plain text key. This hung me up for like a day. it shows up in IOS help, but not in any config documentation...as when you actually implement it, in the config that 0 does not show up either.

Trying to do this setup between a 870 and a 2800.
The tunnel comes up fine if I run in tunnelmode, but when changing to

ENCRYPT-3DES esp-3des esp-md5-hmac
mode transport require

The tunnel never comes up, any ideas?

Joe; only tunnel mode is supported; transport mode is not working in this kind of config.

by the way; I can pass EIGRP through the tunnel; any ideas?

Jeremy,
I watched this setup in your ISCW nuggets but you only showed it from the SDM tool. So seeing this command line was great since I just had to try it. Well I ran into 1 error from above, easy catch:
RTRA(config-if)# tunnel protection ipsec VTI
needed the profile before the VTI. So I corrected that, but still had no luck pinging from LAN A to LAN B. When I did a show isakmp I seen the QM-Idle which from what I remember means the tunnel is established. I did not setup any routing protocols yet. Could this have been the reason?
Thanks
Dave

Yeah, nice configuration but take care to Qos and high availability limitations and other issues !!!

I setup the VPN tunnel interface between two Cisco 1841 routers. These routers require the command:
tunnel protection ipsec profile VTI

After getting everything setup and working, I tested the configuration by sniffing the interface traffic (fa0/1 in my case). I was surprised to see that there is traffic coming straight into the interface that's not encrypted and getting responses from my internal network. I tried putting in an access list that would only receive traffic from the other side of the VPN (the tunnel IPs) and it blocks everything...

I could write a very specific access-list for each side of the tunnel, but this seems to be more difficult than using the crypto maps. Has anyone else tested this configuration and seen the same results? If so, how have you blocked the unencrypted traffic from coming into your network?

Thanks,
Don

I setup the configuration based on the configuration on this page. When sniffing the Internet interface, I see unencrypted packets on the network and can ping a server located inside my network. To test this, using the IP addreses above, setup a sniffer with the IP of 192.1.1.2 and put it on the E0/0 interface. Apparently, the router puts priority on acting as a router and not as an IPSEC gateway.

I've tried to block anything outside of the remote end of the VPN using access lists, but my access list turns out to be worse than building the crypto maps. I cannot simply permit both IP addresses on both ends of the VPN (192.168.3.1 and 192.168.3.2) or the ethernet interface (192.1.1.1 and 193.1.1.1). It looks like I have to include 192.168.2.0 and 192.168.1.0 in this scenario and possibly 192.168.3.0.

Has anyone else done this type of troubleshooting to see how to resolve this problem with the VPN?

Thanks, Don

With the above configuration, do you need to specify IP addresses for the tunnel interface?

ie. We are trying to setup a VPN between an 1841 and a 7206. The company with the 7200 series will not supply a config. I do not want any ip addressing on the GRE tunnel, just a straight tunnel to access the remote network

We need to configure two sites of our office through router by using VPN tunnel. Also we want access the internet on both sides.

need it

Excellent config. worked like a charm

Hi Jeremy. This is very helpful, In fact I am working on a project which has quite similar setup. Basically, they have existing MPLS link and need to setup a virtual tunnel interface. The MPLS should be the primary link and the VTI will serve as a backup. Failover will be based from the BGP routing table. Can this work using BGP? Does it advertise BGP routes across the link? They do have an L3 switch inside the LAN and this should also participate in propagating BGP routes. The L3 switch should decide which link to use e.g. MPLS went down, L3 will tell the rest to use VTI to reach remote routers.

MPLS Router ----[LAN with L3 Switch]-----Internet Router.

We will terminate VTI using internet router. L3 must learn the routes from both MPLS and Internet routes so as to understand which link to go whenever one becomes unavailable and in turn must fall back when primary link (MPLS) come back up. Is this possible/feasible? Any suggestion? Thank you

Hi Jeremy. Config is very clean and quick. However I got a problem.

At the moment I am using your config on 2 cisco 877. The tunnel light is up and I can only ping router B from within router A. But I can't ping router B from a computer on router A network.

Thanks,
Quang

Hi Jeremy. All fix, my mistake silly acl rule.
Thanks,
Quang

Hello there Jeremy,

I'd like to thank you for the enlightment of your post and I would also like to take the chance and agree with you on the crypto map issue when your only hooking up non encrypted sites. The fact that you can use static routes to handle all your traffic with tunnel interfaces is most important. You can of course add crypto maps to the tunnel interface and then pul up a helper address with rip v2 to make things funnly automated.

Believe me after 9 hours of working on a vpn project I had to get down to , your post was most helpful.

Thanks once again.

Mario

Would it be possible to share an example where you also have Remote VPN Clients connecting in a sort of Dynamic fashion and keep the L2L tunnels up?

Excellent Info by the way!