Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I can't seem to get the VPN connection going with my 877. I have an old IOS (12.4) but it looks to me like all the pieces are there. I have compared this config against the Azure-provided (albeit v15) script and it seems close enough with the exception of a few default values.

Some relevant config info:

  • local LAN: 10.10.26.0/24
  • virtual LAN: 10.10.27.0/24
  • local G/W: A.B.C.54
  • remote G/W: D.E.F.155
  • PSK: 00000000000000000000000

relevant IOS config:

! interface for our ISP
interface Vlan4
 description ISP Link
 ip address A.B.C.54 255.255.255.252
 ip nbar protocol-discovery
 ip flow ingress
 ip flow egress
 ip nat outside
 ip virtual-reassembly
 zone-member security out-zone
 crypto map azure-crypto-map
!
ip access-list extended azure-vpn-acl
 permit ip 10.10.26.0 0.0.0.255 10.10.27.0 0.0.0.255
!
crypto isakmp policy 1
 encr aes 256
 authentication pre-share
 group 2
crypto isakmp key 00000000000000000000000 address E.D.F.155 no-xauth
!
crypto ipsec transform-set azure-ipsec-proposal-set esp-aes 256 esp-sha-hmac  
!
crypto map azure-crypto-map 1 ipsec-isakmp 
 set peer D.E.F.155
 set security-association lifetime kilobytes 102400000
 set transform-set azure-ipsec-proposal-set 
 match address azure-vpn-acl

I can provide access-list entries if that helps

Can anyone spot anything in there that isn't right? Does anyone have any experience getting the 877 working with Azure site-to-site vpn?

share|improve this question
    
Any reason you're not updating the IOS, seeing as how it's not in production yet? –  HopelessN00b Feb 21 at 6:51
    
Well actually the router is in production, it's just the VPN part that is new. Secondly, I don't have an active service agreement with Cisco, so i cant download IOS15. I'm working on that separately. Is there something new in 15 that makes you think it more likely to work? –  Richard Hauer Feb 22 at 21:58
    
I don't have experience with this line of routers, but an IOS upgrade is usually one the first things I try because of bug fixes and supportability - it's damn hard to find people with working setups on old IOSes. And, by the way, a search engine told me I could find a download of c870-advsecurityk9-mz.151-4.M2.bin here and a download of c870-advipservicesk9-mz.151-4.M2.bin here. MD5 sums match too... –  HopelessN00b Feb 22 at 22:29
    
Thanks, I am pursuing that course, but I will get the image through legit channels only. It just seemed that there was no material difference in the instructions, so I figured it should have worked. –  Richard Hauer Feb 23 at 23:44

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.