Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I can't seem to get the VPN connection going with my 877. I have an old IOS (12.4) but it looks to me like all the pieces are there. I have compared this config against the Azure-provided (albeit v15) script and it seems close enough with the exception of a few default values.

Some relevant config info:

  • local LAN:
  • virtual LAN:
  • local G/W: A.B.C.54
  • remote G/W: D.E.F.155
  • PSK: 00000000000000000000000

relevant IOS config:

! interface for our ISP
interface Vlan4
 description ISP Link
 ip address A.B.C.54
 ip nbar protocol-discovery
 ip flow ingress
 ip flow egress
 ip nat outside
 ip virtual-reassembly
 zone-member security out-zone
 crypto map azure-crypto-map
ip access-list extended azure-vpn-acl
 permit ip
crypto isakmp policy 1
 encr aes 256
 authentication pre-share
 group 2
crypto isakmp key 00000000000000000000000 address E.D.F.155 no-xauth
crypto ipsec transform-set azure-ipsec-proposal-set esp-aes 256 esp-sha-hmac  
crypto map azure-crypto-map 1 ipsec-isakmp 
 set peer D.E.F.155
 set security-association lifetime kilobytes 102400000
 set transform-set azure-ipsec-proposal-set 
 match address azure-vpn-acl

I can provide access-list entries if that helps

Can anyone spot anything in there that isn't right? Does anyone have any experience getting the 877 working with Azure site-to-site vpn?

share|improve this question
Any reason you're not updating the IOS, seeing as how it's not in production yet? – HopelessN00b Feb 21 '14 at 6:51
Well actually the router is in production, it's just the VPN part that is new. Secondly, I don't have an active service agreement with Cisco, so i cant download IOS15. I'm working on that separately. Is there something new in 15 that makes you think it more likely to work? – Richard Hauer Feb 22 '14 at 21:58
I don't have experience with this line of routers, but an IOS upgrade is usually one the first things I try because of bug fixes and supportability - it's damn hard to find people with working setups on old IOSes. And, by the way, a search engine told me I could find a download of c870-advsecurityk9-mz.151-4.M2.bin here and a download of c870-advipservicesk9-mz.151-4.M2.bin here. MD5 sums match too... – HopelessN00b Feb 22 '14 at 22:29
Thanks, I am pursuing that course, but I will get the image through legit channels only. It just seemed that there was no material difference in the instructions, so I figured it should have worked. – Richard Hauer Feb 23 '14 at 23:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.