0

While trying to setup ipsec tunnel from a dynamic ip to a static one using cisco routers I have been running into a problem. I am able to ping R1 from R2 and vice versa, but I can't ping R1 from PC2. Show crypto session states that the connection is active. Oddly enough for a gew seconds I was able to ping PC1 to PC2 but after a few seconds of seemingly not changing anything it just stopped working.

To better illustrate the setup I prepared a picture.

And the configs look like this.

R1 CONFIGURATION

Current configuration : 1678 bytes
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
!
!
dot11 syslog
ip cef
!
!
!
!
!
username {USERNAME} privilege 15 secret 5 {PASSWORD}
username {USERNAME} privilege 15 secret 5 {PASSWORD}
!
!
crypto isakmp policy 10
 encr aes 256
 authentication pre-share
 group 5
crypto isakmp key {KEY} address {ISP2 PUBLIC ADDRESS}
!
!
crypto ipsec transform-set R1->R2 esp-aes 256 esp-sha-hmac
!
crypto map CMAP 10 ipsec-isakmp
 set peer {ISP2 PUBLIC ADDRESS}
 set security-association lifetime seconds 86400
 set transform-set R1->R2
 set pfs group5
 match address 100
!
archive
 log config
  hidekeys
!
!
ip ssh version 2
!
!
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
 ip address dhcp
 duplex auto
 speed auto
 crypto map CMAP
!
interface Dot11Radio0
 no ip address
 shutdown
 speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
 station-role root
!
interface Vlan1
 no ip address
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
access-list 100 permit ip 192.168.1.0 0.0.0.255 192.168.0.0 0.0.0.255
!
!
!
control-plane
!
!
line con 0
 exec-timeout 5 0
 login local
 no modem enable
line aux 0
 exec-timeout 5 0
 login local
line vty 0 4
 exec-timeout 5 0
 login local
 transport input ssh
!
scheduler max-task-time 5000
end

R2 CONFIGURATION

Current configuration : 1573 bytes
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R2
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
!
!
dot11 syslog
ip cef
!
!
!
!
!
multilink bundle-name authenticated
!
!
username {USERNAME} privilege 15 secret 5 {PASSWORD}
!
!
crypto isakmp policy 10
 encr aes 256
 authentication pre-share
 group 5
crypto isakmp key {KEY} address 0.0.0.0 0.0.0.0
!
!
crypto ipsec transform-set R2->R1 esp-aes 256 esp-sha-hmac
!
crypto dynamic-map hq-vpn 10
 set security-association lifetime seconds 86400
 set transform-set R2->R1
 set pfs group5
 match address 100
!
!
crypto map CMAP 1 ipsec-isakmp dynamic hq-vpn
!
archive
 log config
  hidekeys
!
!
ip ssh version 2
!
!
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
 ip address dhcp
 duplex auto
 speed auto
 crypto map CMAP
!
interface Vlan1
 no ip address
!
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
!
access-list 100 permit ip 192.168.0.0 0.0.0.255 192.168.1.0 0.0.0.255
!
!
!
!
control-plane
!
!
line con 0
 exec-timeout 5 0
 login local
 no modem enable
line aux 0
 exec-timeout 5 0
 login local
line vty 0 4
 exec-timeout 5 0
 login local
 transport input ssh
!
scheduler max-task-time 5000
end

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.