I am trying to set up the following WAN configuration:
Both interfaces on the router at the datacenter connect to public networks. However, our office is behind a standard cable modem and is NATed. The primary goal is that the server with an IP address of
220.127.116.11 should be able to ping the workstation at
192.168.10.2 and receive a response. Conversely,
192.168.10.2 should be able to ping
18.104.22.168 and the packets will traverse the VPN connection rather than be routed across the public Internet.
I believe I have the Linux server (Racoon IPSec daemon) configured correctly, but I am unsure about the Cisco side. My (abbreviated) config looks somewhat like this:
crypto isakmp policy 1 encr 3des authentication pre-share group 2 lifetime 3600 crypto isakmp key MY_KEY address 22.214.171.124 no-xauth crypto isakmp keepalive 10 10 ! crypto ipsec security-association replay window-size 128 ! crypto ipsec transform-set my-transform esp-3des esp-md5-hmac mode transport crypto ipsec df-bit clear ! crypto map my-cryptomap 1 ipsec-isakmp set peer 126.96.36.199 set transform-set my-transform set pfs group2 match address my-list ! interface FastEthernet0/0 description r1 External interface ip address 188.8.131.52 255.255.255.248 duplex auto speed auto no snmp trap link-status no mop enabled crypto map my-cryptomap ! interface FastEthernet0/1 description r1 Internal interface ip address 184.108.40.206 255.255.255.192 duplex auto speed auto no mop enabled ! ip default-gateway 220.127.116.11 ip forward-protocol nd no ip http server no ip http secure-server ! ! ip route 0.0.0.0 0.0.0.0 18.104.22.168 ! ip access-list extended my-list permit ip host 22.214.171.124 host 126.96.36.199 !
I believe I'm missing some routing config and/or my IPSec details are misconfigured. Can anyone offer any suggestions, please? Thanks!