45. Configure Site to Site VPN
VPN Site-to-Site Configuration
Private Network Addresses:
A = 10.0.0.0/8
B = 172.16.0.0/16 - 172.31.0.0/16
= wildcard: 172.16.0.0/12
C = 192.168.0.0/24 - 192.168.255.0/24
1. Configure ACLs on the ISP router that will prevent these private network addresses, but will permit everything else
ISP:
conf t
access-list 10 deny 10.0.0.0 0.255.255.255.255
access-list 10 deny 172.16.0.0 0.15.255.255
access-list 10 deny 192.168.0.0 0.0.255.255
access-list 10 permit any
exit
2. Apply the ACL to the incoming interfaces
ISP:
conf t
int se 0/2/0
ip access-group 10 in
exit
int se 0/2/1
ip access-group 10 in
exit
3. Test the created ACL rules
we are going to create a loopback interface in HQ-Router with 172.30.1.1/24 private address
this should not be allowed (traffic) to go to Internet router as this is block by the ACL rule.
HQ-Router:
conf t
int loopback 0
ip address 172.30.1.1 255.255.255.0
no shut
ext
will test now via ping
ACL is working
4. Configure default rout on HQ-Router and Branch-Office-Router
HQ-Router:
conf t
ip route 0.0.0.0 0.0.0.0 se 0/2/0
exit
Branch-Office-Router:
conf t
ip route 0.0.0.0 0.0.0.0 se 0/2/0
exit
Now we are going to configure the VPN on the topology on the left.
A. Configure GRE Tunnel
this is the virtual interface that will connect to the other site via virtual interface also
HQ-Route:
conf t
interface tunnel 0 //creating tunnel interface 0
tunnel mode gre ip //setting the mode to ipv4
'tunnel source 50.0.0.1 //setting the tunnel source 50.0.01 (tunnel source is the public IP of the local router)
tunnel source se 0/2/0 //setting the tunnel source 50.0.01 (tunnel source is the public IP of the local router)
tunnel destination 60.0.0.1 //setting the tunnel dest 60.0.01 (tunnel dest is the public IP of the remote router)
exit
show ip int brief //to check the new tunnel created
ping 192.168.10.2 repeat 100000
Branch-Office-Router:
conf t
interface tunnel 0 //creating tunnel interface 0
tunnel mode gre ip //setting the mode to ipv4
'tunnel source 60.0.0.1 //setting the tunnel source 60.0.01 (tunnel source is the public IP of the local router)
tunnel source se 0/2/0 //setting the tunnel source se 0/2/1 (tunnel source is the public IP of the local router)
tunnel destination 50.0.0.1 //setting the tunnel dest 50.0.01 (tunnel dest is the public IP of the remote router)
exit
show ip int brief //to check the new tunnel created
ping 192.168.10.1 repeat 100000
B. Test now the VPN connectivity via ping
HQ-Router:
ping 192.168.10.2
Branch-Office-Router:
ping 192.168.10.1
we have a ping now.
will add loopback int to Branch-Office-Router
Branch-Office-Router:
conf t
int loopback 0 192.168.20.1/24
exit
as you can see, no ping when our source is loopback 0 as it is block on the ISP's ACL
C. we can configure routing on the GRE tunnel to make loopback 0 network of HQ-Router and Branch-Office-Router
accessible vice versa
HQ-Router:
router eigrp 100
network 192.168.10.0
network 172.30.1.0
no auto-summary
exit
Branch-Office-Router:
router eigrp 100
network 192.168.10.0
network 192.168.20.0
no auto-summary
exit
the routing is in place and pint is tested and working on both remote loopback 0 networks
we are good now with VPN.