0

I can't seem to get the VPN connection going with my 877. I have an old IOS (12.4) but it looks to me like all the pieces are there. I have compared this config against the Azure-provided (albeit v15) script and it seems close enough with the exception of a few default values.

Some relevant config info:

  • local LAN: 10.10.26.0/24
  • virtual LAN: 10.10.27.0/24
  • local G/W: A.B.C.54
  • remote G/W: D.E.F.155
  • PSK: 00000000000000000000000

relevant IOS config:

! interface for our ISP
interface Vlan4
 description ISP Link
 ip address A.B.C.54 255.255.255.252
 ip nbar protocol-discovery
 ip flow ingress
 ip flow egress
 ip nat outside
 ip virtual-reassembly
 zone-member security out-zone
 crypto map azure-crypto-map
!
ip access-list extended azure-vpn-acl
 permit ip 10.10.26.0 0.0.0.255 10.10.27.0 0.0.0.255
!
crypto isakmp policy 1
 encr aes 256
 authentication pre-share
 group 2
crypto isakmp key 00000000000000000000000 address E.D.F.155 no-xauth
!
crypto ipsec transform-set azure-ipsec-proposal-set esp-aes 256 esp-sha-hmac  
!
crypto map azure-crypto-map 1 ipsec-isakmp 
 set peer D.E.F.155
 set security-association lifetime kilobytes 102400000
 set transform-set azure-ipsec-proposal-set 
 match address azure-vpn-acl

I can provide access-list entries if that helps

Can anyone spot anything in there that isn't right? Does anyone have any experience getting the 877 working with Azure site-to-site vpn?

4
  • Any reason you're not updating the IOS, seeing as how it's not in production yet? Feb 21, 2014 at 6:51
  • Well actually the router is in production, it's just the VPN part that is new. Secondly, I don't have an active service agreement with Cisco, so i cant download IOS15. I'm working on that separately. Is there something new in 15 that makes you think it more likely to work? Feb 22, 2014 at 21:58
  • I don't have experience with this line of routers, but an IOS upgrade is usually one the first things I try because of bug fixes and supportability - it's damn hard to find people with working setups on old IOSes. And, by the way, a search engine told me I could find a download of c870-advsecurityk9-mz.151-4.M2.bin here and a download of c870-advipservicesk9-mz.151-4.M2.bin here. MD5 sums match too... Feb 22, 2014 at 22:29
  • Thanks, I am pursuing that course, but I will get the image through legit channels only. It just seemed that there was no material difference in the instructions, so I figured it should have worked. Feb 23, 2014 at 23:44

0

You must log in to answer this question.

Browse other questions tagged .