Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm not that good with VPN and cisco, and I wanted to create some VPN on Packet Tracert 5.3 so I made some basic schema

Computer1 (IP:192.168.0.11)

ROUTER1 (IP:192.168.0.1) (IP:10.0.0.1)

Router2 (IP:10.0.0.2) (IP:192.168.2.1)

Computer2 (IP:192.168.2.12)

connected like the following

Computer1--------Router1--------Router2--------Computer2

The following is the configuration for router1:


Building configuration...

Current configuration : 855 bytes
!
version 12.4
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname Gauche
!
!
!
!
!
!
!
!
crypto isakmp policy 1
 encr aes 256
 hash md5
 authentication pre-share
 lifetime 7200
!
crypto isakmp key cisco address 10.0.0.2
!
!
crypto ipsec transform-set Router1 esp-des esp-sha-hmac
!
crypto map Router1 1 ipsec-isakmp 
 set peer 10.0.0.2
 set transform-set Router1 
 match address 101
!
!
!
!
!
!
!
!
!
interface FastEthernet0/0
 ip address 192.168.0.1 255.255.255.0
 duplex auto
 speed auto
!
interface FastEthernet0/1
 ip address 10.0.0.1 255.255.255.0
 duplex auto
 speed auto
 crypto map Router1
!
interface Vlan1
 no ip address
 shutdown
!
ip classless
!
!
access-list 101 permit ip 192.168.2.0 0.0.0.255 192.168.0.0 0.0.0.255
!
!
!
!
!
line con 0
line vty 0 4
 login
!
!
!
end

This is the configuration of router2:


Building configuration...

Current configuration : 890 bytes
!
version 12.4
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname Droite
!
!
!
!
!
!
!
!
crypto isakmp policy 1
 encr aes 256
 hash md5
 authentication pre-share
 lifetime 7200
!
crypto isakmp key cisco address 10.0.0.1
!
!
crypto ipsec transform-set Router1 esp-des esp-sha-hmac
!
crypto map Router1 1 ipsec-isakmp 
 set peer 10.0.0.1
 set transform-set Router1 
 match address 101
!
!
!
!
!
!
!
!
!
interface FastEthernet0/0
 ip address 10.0.0.2 255.255.255.0
 duplex auto
 speed auto
 crypto map Router1
!
interface FastEthernet0/1
 ip address 192.168.2.1 255.255.255.0
 duplex auto
 speed auto
!
interface Vlan1
 no ip address
 shutdown
!
ip classless
ip route 0.0.0.0 0.0.0.0 10.0.0.1 
!
!
access-list 101 permit ip 192.168.0.0 0.0.0.255 192.168.2.0 0.0.0.255
!
!
!
!
!
line con 0
line vty 0 4
 login
!
!
!
end

But I really don't get why the VPN is not establishing, could some one help me, Thank you.

share|improve this question

1 Answer 1

I checked your config but did not see your ACL configuration.You need to permit the interesting traffic then associate the crypto map to the access-list 101. Hope this helps.

share|improve this answer
    
And then send it some interesting traffic too.. ping ip 10.0.0.2 source 192.168.0.1 or similar. –  Tom O'Connor Feb 20 '11 at 22:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.