Multiple VPNs on one interface troubles

Hello. I am still pretty new to Cisco IOS, but I think I'm getting there. Right now I am trying to configure a sort of mesh VPN setup between five routers in such a way that every router can conect to every other roughter through VPN over an emulated Internet connection I set up (NAT). Here is the configuration of one router. I am using Packet Tracer with 2811 routers.
Current configuration : 3021 bytes!version 12.4no service timestamps log datetime msecno service timestamps debug datetime msecno service password-encryption!hostname Central!!!!!!!!crypto isakmp policy 1 encr aes 128 authentication pre-share group 2!crypto isakmp key VPNtun address 222.222.222.6crypto isakmp key VPNtun address 222.222.222.10crypto isakmp key VPNtun address 222.222.222.14crypto isakmp key VPNtun address 222.222.222.18!!crypto ipsec transform-set TRANS-SET-GRE-TUNNEL esp-aes 128 esp-sha-hmac!crypto map Central_Out 5 ipsec-isakmp set peer 222.222.222.14 set transform-set TRANS-SET-GRE-TUNNEL match address IPSEC-TRAFFIC!crypto map Central_Out 6 ipsec-isakmp set peer 222.222.222.10 set transform-set TRANS-SET-GRE-TUNNEL match address IPSEC-TRAFFIC!crypto map Central_Out 7 ipsec-isakmp set peer 222.222.222.6 set transform-set TRANS-SET-GRE-TUNNEL match address IPSEC-TRAFFIC!crypto map Central_Out 8 ipsec-isakmp set peer 222.222.222.18 set transform-set TRANS-SET-GRE-TUNNEL match address IPSEC-TRAFFIC!!!!!spanning-tree mode pvst!!!!interface Tunnel5 ip address 10.10.20.1 255.255.255.0 tunnel source FastEthernet1/0 tunnel destination 222.222.222.18!!interface Tunnel6 ip address 10.10.40.1 255.255.255.0 tunnel source FastEthernet1/0 tunnel destination 222.222.222.14!!interface Tunnel7 ip address 10.10.60.1 255.255.255.0 tunnel source FastEthernet1/0 tunnel destination 222.222.222.6!!interface Tunnel8 ip address 10.10.80.1 255.255.255.0 tunnel source FastEthernet1/0 tunnel destination 222.222.222.10!!interface FastEthernet0/0 ip address 10.1.50.1 255.255.255.0 ip nat inside duplex auto speed auto!interface FastEthernet0/1 no ip address duplex auto speed auto!interface FastEthernet0/1.2 encapsulation dot1Q 2 ip address 10.1.2.1 255.255.255.0 ip nat inside!interface FastEthernet0/1.5 encapsulation dot1Q 5 ip address 10.1.5.1 255.255.255.0 ip nat inside!interface FastEthernet0/1.10 encapsulation dot1Q 10 ip address 10.1.10.1 255.255.255.0 ip nat inside!interface FastEthernet1/0 ip address 222.222.222.2 255.255.255.252 ip nat outside duplex auto speed auto!interface Vlan1 no ip address shutdown!router eigrp 7 network 10.0.0.0 auto-summary!ip nat inside source list 199 interface FastEthernet1/0 overloadip nat inside source static tcp 10.1.50.2 80 222.222.222.2 80 ip classlessip route 0.0.0.0 0.0.0.0 222.222.222.1 !!ip access-list extended IPSEC-TRAFFIC permit gre host 222.222.222.2 host 222.222.222.6 permit gre host 222.222.222.2 host 222.222.222.10 permit gre host 222.222.222.2 host 222.222.222.14 permit gre host 222.222.222.2 host 222.222.222.18access-list 110 deny tcp any any eq telnetaccess-list 111 deny tcp any any eq ftpaccess-list 113 deny tcp any 10.1.50.0 0.0.0.255 eq 22access-list 114 deny tcp any any eq 81access-list 115 deny udp any any eq 82access-list 199 permit ip 10.1.0.0 0.0.255.255 any!!!!!line con 0line vty 0 4 login!!!end
Every time I try to add the crypto map to interface f1/0, packet tracer crashes on me. So, can anyone help me figure out what I'm doing wrong?

Okay, I believe I got it. I needed to seperate the different ACL listings for the VPNs into different extended bits. Gonna see if I can create the mesh VPN network I wanted now.

Similar Messages

Multiple Receivers for one interface

Hi All,
In File-XI-File Scenario,there is a requirement in which
we are getting a file from a location using Sender File
Adapter, and based on the name of the file(<i>Which is a
part of the message content, and we are going to remove
it in Receiver File Adapter, because the access of
filename is not provided by standard XI Functioanality</i>)
It can go to more than 50 different servers with 3-4
different directory locations. This way We are having
total more than 180 locations in which we can place the
file using Receiver File Adapter.
We can define 50 receiver hosts(is it advisable ??) in
the Receiver determination, but how can we put the file
in different directory locations in a perticular
host???? we can define only one receiver agreement for
this pair, this means one communication channel.
Variable substitution is not applicable for directory
location.Apart from writing some unix script, is there
any preferred solution for this scenario ?????
Regards,
Vijay

Nothing much to think about. Create 180+ communication channels and same number of receiver agreements and interface determinations!
If you feel that all the 50 FTP servers are part of the same business system, create 1 receiver determination and 180 interface determintions. It might look a bit less messy.
I have worked in other middleware products. Frankly, this is not how others work!!!! They provide provisions for changing any parameter of a communication channel at runtime.
All the best,
kk

VPN ASA inside Interface and ip pool are one same Subnet

Hi Everyone,
I have configured RA VPN full tunnel.
Inside interface of ASA is
Vlan1 inside 10.0.0.1 255.255.255.0 CONFIG
ip local pool 10-pool 10.0.0.51-10.0.0.100 mask 255.255.255.0
Need to know is it good design to have both on same subnet?
When i access the Switch connecting to VPN ASA inside interface via--https://10.0.0.2
which has IP 10.0.0.2 while using Remote VPN connection to ASA it does not work gives error
message as below
Jan 19 2014 19:42:46: %ASA-5-305013: Asymmetric NAT rules matched for forward and reverse flows; Connection for tcp src outside:10.0.0.51/51077(LOCAL\ipsec-user) dst inside:10.0.0.2/443 denied due to NAT reverse path failure.
Jan 19 2014 19:42:57: %ASA-5-305013: Asymmetric NAT rules matched for forward and reverse flows; Connection for tcp src outside:10.0.0.51/51078(LOCAL\ipsec-user) dst inside:10.0.0.2/443 denied due to NAT reverse path failure
Jan 19 2014 19:42:59: %ASA-6-302014: Teardown TCP connection 22418 for outside:10.0.0.51/51069(LOCAL\ipsec-user) to identity:10.0.0.1/443 duration 0:01:08 bytes 1035 TCP Reset-O (ipsec-user)
Jan 19 2014 19:42:59: %ASA-6-106015: Deny TCP (no connection) from 10.0.0.51/51069 to 10.0.0.1/443 flags FIN ACK on interface outside
Current NAT config is
nat (inside,outside) source dynamic any interface
Regards
MAhesh
Message was edited by: mahesh parmar

Hi Mahesh,
It should work but I generally would not suggest having the same network on the LAN and also configured partially as a VPN Pool network.
Your problem at the moment is simply lacking the NAT0 configuration for the traffic between LAN and VPN Pool.
I would suggest changing the VPN Pool first and then configuring this
object network LAN
subnet 10.0.0.0 255.255.255.0
object network VPN-POOL
subnet
nat (inside,outside) 1 source static LAN LAN destination static VPN-POOL VPN-POOL
We have to use the line number "1" in the above command so that it gets moved to the top since your current Dynamic PAT would otherwise override it.
In the future it would be best if you changed your current Dynamic PAT configuration to this
nat (inside,outside) after-auto source dynamic any interface
We simply add the "after-auto" to this Dynamic PAT configuration so that it gets moved down in priority. The "after-auto" refers to the fact that this NAT will be inserted after Auto NAT (after Section 2). Your current rule is Manual NAT (Sectiom 1). The new rule will be Manual NAT (Section 3)
- Jouni

Cisco 2800 - Multiple VPNs Using Virtual-Template

Hello List,
I have a question related to the way of setting up multiple VPNs using
virtual-template configuration (Cisco calls this Dynamic VPN): how can
I make my configuration to be a "spoke" type VPN rather than "hub" type
without using "crypto map" on the physical interface?
Here is how it works now (the VPN hub config):
!!! the VPN hub config
crypto keyring PSKs
pre-shared-key address <peer_ip> key 6 ************
crypto isakmp profile ISAKMP_Profile
keyring PSKs
self-identity address
match identity address <peer_ip> 255.255.255.255
virtual-template 1
crypto ipsec transform-set Transform_Set esp-3des esp-md5-hmac
crypto ipsec profile IPSEC_Profile
set transform-set Transform_Set
set isakmp-profile ISAKMP_Profile
interface Loopback1007
description This is a public IP address from a range routed via my
gatey IP address (see bellow)
ip address <my_VPN-hub_ip> 255.255.255.255
no ip redirects
interface Multilink1
description This is my gateway IP address facing the ISP
ip address <my_public_IP> 255.255.255.252
no ip redirects
no ip unreachables
ip nbar protocol-discovery
ip nat outside
ip virtual-reassembly
rate-limit input access-group 102 8000 1500 2000 conform-action
transmit exceed-action drop
ip route-cache flow
no cdp enable
ppp multilink
ppp multilink fragment delay 20
ppp multilink interleave
ppp multilink group 1
ppp multilink multiclass
service-policy output qos_pm-outbound
interface Serial0/0/0
description 1st Serial Interface to ISP
bandwidth 2048
no ip address
encapsulation ppp
ip route-cache flow
no fair-queue
ppp multilink
ppp multilink group 1
interface Serial0/0/1
description 2nd Serial Interface to ISP
bandwidth 2048
no ip address
encapsulation ppp
ip route-cache flow
no fair-queue
ppp multilink
ppp multilink group 1
interface Virtual-Template1 type tunnel
ip unnumbered Loopback1007
ip access-group vpn_acl-tunnel-encr-in in
ip access-group vpn_acl-tunnel-encr-out out
ip mtu 1400
ip route-cache flow
tunnel source Loopback1007
tunnel mode ipsec ipv4
tunnel sequence-datagrams
tunnel checksum
tunnel path-mtu-discovery
tunnel protection ipsec profile IPSEC_Profile
service-policy output qos_pm-VPN
ip access-list extended vpn_acl-tunnel-encr-in
permit ip 172.20.40.0 0.0.0.255 192.168.2.0 0.0.0.255
ip access-list extended vpn_acl-tunnel-encr-out
permit ip 192.168.2.0 0.0.0.255 172.20.40.0 0.0.0.255
!!! the Spoke VPN is configured by my peers (Cisco routers, PIXes,
Cisco VPN concentrators)
!!! all follow the standard crypto map config on the physical
interface.
!!! i.e. http://www.vpnc.org/InteropProfiles/cisco-ios.txt
It is obvious that with my router configured as a VPN hub, if the
tunnel dies, I need to wait for the peer to reset the tunnel, all this
time my clients in my network are not able to access the remote sites.
The reason to use the virtual-template interfaces as suppose to
traditional "crypto map" way, is that my peers do not want to share the
same VPN end-point between themselves (different companies all
together) and they are very strict in regards to ACLs. As I don't have
a VPN device for each one of them and their number increases (I have 5
separate tunnels right now with a potential grow to 15 in the next 3
months), I need to find a way to get rid of the hub config in my end (I
did not have much choice there when I migrated to this platform from a
linux box).
Pros for the Virtual-Template:
- separate QoS for each tunnel
- ACLs configured directly on the tunnel interface (grater flexibility)
- tunnel end-point IP address can be part of a range BGP advertised via
multiple ISP links
Cons:
- hub config, the tunnel needs to be reseted by the peer
Any help is very much appreciated. Thank you,
Adrian

Hope the following link will help you
http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a008019d6f7.shtml

Multiple iphones on one computer.........is it possible?

this may be a silly question but its one im having trouble finding any kind of answer for anywhere on the apple websites!
i have an iphone 3gs and my other half is also going to be getting one pretty soon, but the dilema is that we will be using it on the same computer, will we be able to do this? i know you cant use your iphone between other computers but dont know what the precedence is for multiples!
any help would be greatly appreciated!
thanks!

Yes, you can sync multiple phones to one computer. If the phones are to have different content (e.g., calendar and contacts) the easiest way to do this is to have separate logins for each user on the computer.

How to scan multiple pages in one file

I would like to know how to scan multiple pages into one file. There is no add button that comes up. I have a HP Officejet 8600 and a macbook pro. Please help, this would really help me out.

Open Preview and use its "Import From Scanner" option in the File menu. This will launch the scanning interface, which has some standard and basic scanning controls. If you choose "PDF" as the file format to save as, then you will see an option to scan all images to one file. When you do this, you will scan and edit them individually, but Preview will save them to the same file when saved.

Creating multiple JFrames in one program

What kind of trouble should I look for when creating multiple JFrames in one application. These JFrames will talk to each other via drag and drop. Is this ok?

What kind of trouble would you like? I'm sure you can engineer all kinds. As long as you have a place to hold the frame references, you should be okay. If you need them.
You can do drag and drop between components in different frames, no problem. Better read up on drag and drop first though.

May I start more than one interface at boot using network profiles ?

Hi everybody,
I installed ArchLinux on my laptop and I was playing with network profiles to obtain different configurations of the ethernet and wireless interfaces for home, office etc. Everything works fine using "!" in from of each configuration name in /etc/rc.conf and I found useful the menu option.
As far as I understood each configuration file in /etc/network-profiles/ correspond to one interface only, therefore this utility does not allow me to start more than one interface at boot time. Am I right?
In this case it exist already a script to choose between different configuration for two interfaces?
Thanks in advance
Jimmi

Welcome to the Apple Community da dad.
Yes you can connect multiple Apple TV's by ethernet.
What do you mean by outside.

LabVIEW FPGA: Multiple SCTL versus one SCTL (same clock domain)

Hello NI forums,
Question:
See the attached picture from a modified version of the LabVIEW DRAM FIFO example. It probably explains my question more effectively than the paragraphs below.
What is the difference to the LabVIEW / Xilinx compiliers, if any, between placing two independent branches of code in the same SCTL, versus placing them in individual SCTLs (in the same clock domain)?
Misc. comments:
I have briefly experimented with this concept using the included LabVIEW DRAM FIFO example (example finder >> Hardware Input and Output >> FlexRIO >> External Memory >> Simple External Memory FIFO.lvproj).
I compiled the default example (the read and write interfaces are in separate 40MHz SCTLs) five separate times. Then I put the read and write interfaces in the same 40MHz SCTL and compiled another five times. The result (when both read and write interfaces were in the same SCTL) was a reduction in resource usage (according to the compilation summary).
However, due to my lack of knowledge I'm hesitant to conclude that placing everything in one SCTL is always the best option. For example, I do not know what is created 'behind the scenes' with each SCTL. Perhaps putting independent branches of code in separate SCTLs makes it possible to route clock, reset, implicit enable, etc. signals more effectively.
Background information:
My task involves acquiring 2 channels of analog data using the NI 5772 and PXIe-7966. Data acquisition takes place in a 200MHz SCTL, and downstream processing is performed in a 100MHz SCTL.
During a vast majority of the 100MHz SCTL processing stages of the FPGA VI, the 2 channels of data do not interact with eachother. So it would be easy for me to place them in separate 100MHz loops if doing so would somehow help the design (timing, resource usage, etc.).
Thanks!
Attachments:
question.png ‏76 KB

Intaris
Trusted Enthusiast
Posts: 3,264
Re: LabVIEW FPGA: Multiple SCTL versus one SCTL (same clock domain)
‎10-28-2014 12:11 PM
Just out of interest, what is the resource usage differential between the two versions?
In response to the above comment,
This is a little embarrassing, but it seems like the resource usage is similar than I initially thought for this particular example. I think the previous compilations that I based my assumption on coincidentally used more resources in the 2-SCTL loop case. I just compiled each version two additional times (see below).
Here's the version with everything in one loop:
Device Utilization
Total Slices: 17.6% (2587 out of 14720)
Slice Registers: 9.5% (5583 out of 58880)
Slice LUTs: 8.2% (4855 out of 58880)
DSP48s: 0.0% (0 out of 640)
Block RAMs: 2.5% (6 out of 244)
Device Utilization
Total Slices: 16.9% (2493 out of 14720)
Slice Registers: 9.5% (5583 out of 58880)
Slice LUTs: 8.3% (4858 out of 58880)
DSP48s: 0.0% (0 out of 640)
Block RAMs: 2.5% (6 out of 244)
Here's the version with the read and write in separate loops:
Device Utilization
Total Slices: 16.4% (2407 out of 14720)
Slice Registers: 9.5% (5583 out of 58880)
Slice LUTs: 8.2% (4852 out of 58880)
DSP48s: 0.0% (0 out of 640)
Block RAMs: 2.5% (6 out of 244)
Device Utilization
Total Slices: 19.4% (2859 out of 14720)
Slice Registers: 9.5% (5583 out of 58880)
Slice LUTs: 8.3% (4859 out of 58880)
DSP48s: 0.0% (0 out of 640)
Block RAMs: 2.5% (6 out of 244)

Message splitting-- Queue stopped when no message created for one interface

Hi all,
I think you saw one post regarding this issue in SDN, but I can't find the post any more.
So, I have message splitting (it's multiple mappings to map one outbound msg to multip inbound msgs, not one mapping to map 1 to n. This is because of our own reason, but should not affect the analysis of the issue) to split one message to multiple. It works fine if the outbound message contains data for every inbound interface. However if the outbound message does NOT contain data for any one inbound message, there is an error in MONI and all subsequently splitted messages will not be passed in IE. The error in MONI says Split mapping created no messages, and Queue status turns to be Queue Stopped, and thus all the subsequently splitted messages are stuck in the queue.
Why this? and how to solve this problem?
Thanks
Jayson

>
Jayson wrote:
> Hi all,
>
> I think you saw one post regarding this issue in SDN, but I can't find the post any more.
>
> So, I have message splitting (it's multiple mappings to map one outbound msg to multip inbound msgs, not one mapping to map 1 to n. This is because of our own reason, but should not affect the analysis of the issue) to split one message to multiple. It works fine if the outbound message contains data for every inbound interface. However if the outbound message does NOT contain data for any one inbound message, there is an error in MONI and all subsequently splitted messages will not be passed in IE. The error in MONI says Split mapping created no messages, and Queue status turns to be Queue Stopped, and thus all the subsequently splitted messages are stuck in the queue.
>
> Why this? and how to solve this problem?
>
> Thanks
> Jayson
Hi Jyson,
what i analyse from this is you may be using different maapings and different inbound interfaces
but your receiver is the same and hence you are using only one interface determination with all the interface mappings specified there...
if this is the case..i suggest you remove the "maintain order at runtime "
tick in that interface detemination and it will surely work
giving points is another way to say thanks
Edited by: Tarang Shah on Mar 20, 2009 7:18 PM

Multiple Operation in Service Interface

Hi Experts,
Here is the problem -
Scenario: SOAP Adapter-> PI (7.1) -> XI Adapter -> ERP Proxy
We have defined multiple operation in Service Interface using Interface pattern "Stateless".
Message posted using SOAP adapter goes through PI alright. But on ERP is throws the error saying "No implementing class registered for the interface"
Well the checklist-
1. Proxy class generated/re-generated. Class/Interface/Methods all activated.
2. If I remove all the operation from Service interface and just have one with the same name as Service Interface (which is also default when you create new service interface) it works fine.
Any idea guys ?
Regards.

Hi Sreenivas,
I appreciate your promptness in answering the query.
1. And I know that if you select Stateless (XI 3.0), in the service interface you just can't have multiple operations.
2. ID contents are generated fine (I dont do it manually. I just import the scenario from ESR).
Please, first test yourself and let me know if you succeed or point me to some document explaining that.
Regards.

BI for NW04S: Concatenating multiple chars into one field in BI query

Hi,
We have BI for NW04S. We have a requirement of concatenating multiple characteristics into one field in the BI report. This single field should have the usual drill down and other olap functionalities that a single characteristic usually enjoy in a BI report.
In BI for NW04 (Not the S) this probably can be done using the table interface in WAD. However in BI7 WAD functionality are through Java.
Also can this be done using Query designer alone.
Can anybody help?
Thanks

Hi,
Can you please elaborate on your Query designer option. You can always have a variable and in the user exit can write code, but what is not clear that
1> How will you acheive the contatenation done for every row of the report in the BEX user exit variable( since it's called during the beginning of the query execution and not for all rows of the report
2> How do you transfer the char variable into a char field in the report.
Please elaborate .
Thanks

More than 1 VPN using single interface

I have to implement a VPN with four routers every router has different configurations but the Primary router has only one interface connected to internet. When ever I try to implement more than one VPN on the same interface it gives me an error that u have a VPN running on this interface and it can be effected ,ignoring this error will cost me VPN down from previous site.

You need to use the same crypto map, with different priority values (10 for first site-to-site, 20 for the second), as only one crypto map can be applied on a given interface.
Please rate if this helped.
Regards,
Daniel

Multiple subnets under one vlan

Hi everyone,
Is there any way to create multiple subnets under one VLAN ? Right now, I am using VLAN 110 and it's IP is 172.16.0.1/16.
We have three types of devices on this VLAN.I want to create 3 or 4 subnets for those devices under this VLAN for reducing the traffic or broadcast ?
Please advise me.....
Thanks in advance

Mohammed,
As long as you have a single VLAN only, you will not reduce the amount of broadcasts in this VLAN by using several IP networks. Even if the stations are in different IP networks within a single VLAN, every broadcast will be sent across the entire VLAN to all stations, regardless of their configured IP address. Broadcasting is a matter of Data Link Layer, or Layer2, and if you keep a single Layer2 domain (the VLAN), you will keep a single, merged, large broadcast domain.
Just to answer your question, you could assign multiple addresses to an interface in a single network/VLAN by using secondary IP addresses, for example:
interface Vlan110
ip address 172.16.0.1 255.255.0.0
ip address 192.168.1.1 255.255.255.0 secondary
ip address 10.20.30.1 255.255.255.0 secondary
However, as I explained, this will only allow you to "stretch" multiple IP networks over a single broadcast domain so there is no saving in terms of broadcasts or traffic reduction. For that, you must resort to multiple VLANs.
Best regards,
Peter

Hp printer f4488 HOW TO SCAN MULTIPLE SHEET IN ONE ATTACHMENT

hp printer f4488 HOW TO SCAN MULTIPLE SHEET IN ONE ATTACHMENT Kindly suggest if any solution are their for above subject..

Open Preview and use its "Import From Scanner" option in the File menu. This will launch the scanning interface, which has some standard and basic scanning controls. If you choose "PDF" as the file format to save as, then you will see an option to scan all images to one file. When you do this, you will scan and edit them individually, but Preview will save them to the same file when saved.

Multiple VPNs on one interface troubles

Similar Messages

Maybe you are looking for