VPN router-to-router using cisco 17xx / 18xx

[CBE - cisco by examples]

How to setup a VPN router-to-router using cisco 17xx / 18xx

Want to connect your cisco router to a CiscoVPN server?

the following lines will config your router to act as a VPNClient
and will tunnel the traffic on that VPN

check the ***STARRED*** values and replace it

crypto ipsec client ezvpn MyVpn
connect auto
group ***VPN_GORUP*** key ***VPN_GORUP_KEY***
mode client
peer ***VPN_SERVER_IP_ADDRESS***
username ***VPN_USER_NAME*** password ***VPN_USER_PASSWORD***
xauth userid mode local

interface Ethernet0
crypto ipsec client ezvpn MyVpn

interface FastEthernet0
crypto ipsec client ezvpn MyVpn inside

REMEBER: you may want to tunnelize only some traffic on the VPN CLIENT SIDE, and let all the other traffic transit outside the vpn. Then you have to config a SPLIT-TUNNEL on the VPN SERVER SIDE: check this post.



.

Enable a Cisco VPN Split Tunnel

[CBE - cisco by examples]

Need to a enable a VPN Split Tunnel on a cisco 17xx/18xx ?
Need to separate Subnets traffic from VPN tunneling?

1) define an ACL with the address to tunnel in VPN
2) add this ACL to a group

The client will automatically reconfigure itself at next connection.
No intervention needed on client config!

crypto isakmp client configuration group ***MY_GROUP***
key ***MY_GROUP_KEY***
pool SDM_POOL_1
save-password
include-local-lan
acl 150
!
access-list 150 permit ip any 192.168.10.0 0.0.0.255

How to create a cisco vpn server

[CBE - cisco by examples]

Here is an example showing the quickest way to enable a
VPN SERVER on router Cisco 17xx / 18xx / ...

just check the ***STARRED*** values & replace it with yours;
this script uses a
LAN on 192.168.10.x and
VPN client on 192.168.11.x

!
aaa new-model
!
aaa authentication login default local
aaa authentication login sdm_vpn_xauth_ml_1 local
aaa authorization exec default local
aaa authorization network sdm_vpn_group_ml_1 local
!
aaa session-id common
!
resource policy
!
username ***USER1*** privilege 0 password 0 ***PASSWORD***
username ***USER2*** privilege 0 password 0 ***PASSWORD***
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp xauth timeout 15
!
crypto isakmp client configuration group ***MY_GROUP***
key ***MY_GROUP_KEY***
pool SDM_POOL_1
save-password
include-local-lan
!
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
!
crypto dynamic-map SDM_DYNMAP_1 1
set transform-set ESP-3DES-SHA
reverse-route
!
crypto map SDM_CMAP_1 client authentication list sdm_vpn_xauth_ml_1
crypto map SDM_CMAP_1 isakmp authorization list sdm_vpn_group_ml_1
crypto map SDM_CMAP_1 client configuration address respond
crypto map SDM_CMAP_1 65535 ipsec-isakmp dynamic SDM_DYNMAP_1
!
interface Ethernet0
crypto map SDM_CMAP_1
!
ip local pool SDM_POOL_1 192.168.11.1 192.168.11.100
ip classes
!
ip nat inside source route-map SDM_RMAP_1 interface FastEthernet0 overload
!
access-list 100 permit ip 192.168.10.0 0.0.0.255 any
route-map SDM_RMAP_1 permit 1
match ip address 100
!
end