C1721 VPN tunnel to C3015 VPN Concentrator

[rainman]

Has anybody here ever created a VPN tunnel between a C1721 router and a C3015 VPN Concentrator? Currently I connect to this VPN concentrator via the Cisco VPN Client (for Windows). This allows my 1 PC access to my LAN @ work. I have a C1721 router that I would like to configure to access this VPN similar to how I am accessing it with the PC, but then share out access to my internal LAN @ home.

I can access the VPN Concentrator's config to view the active configuration but I probably can't make any big config changes to it. As for the C1721 I can config that from scratch since it's @ home.

Any thoughts?

Tx - Rainman

 

[routerman]

I use router to concentrator VPN's, they are set up as LAN to LAN connections on the 3015.

But it sounds like you want to set your 1721 router to act the same way as a Cisco VPN PC based client, I am pretty sure this is not possible. When the client software connects to the 3015 the concentrator pushes details such as IP address, WINS DNS or what ever is required. This policy push process will not work to a router, so I'd expect the connection process to fail.

 

[rainman]

Isn't it possible to push that IP to a software interface tho (i.e., Loopback, Virtual-Template, Virtual-Access)? I have not found any way to do this yet but it would be beneficial and Cisco has everything else in their IOS.

Cisco also makes a hardware-based VPN client (3002). If this has the capability to simulate the CSVPN software then I would hope the IOS can do the same.


-Rainman

 

[rainman]

Also check out this URL:

http://www.cisco.com/en/US/customer...s_configuration_example09186a00800945cf.shtml

I think that the IOS can simulate the CSVPN client software via EzVPN. I'm going to toy this this today and see if I can get it to work.

Any more input please chime in.

Tx - Rainman

 

[routerman]

Rainman, I read the URL, you have probably got this working as that appears to be exactly what you want. Once again the IOS proves me wrong, I've learnt something new

 

[rainman]

Routerman -

My configuration is ready to go, except I'm running into a snag - the VPN concentrator I connect to is using TCP 10000 instead of UDP 500. I turned on various debugs (debug crypto ipsec, debug crypto isakmp) and I see it trying to connect to the server on UDP 500 but I need it to do TCP 10000. Any other thoughts? Is it possible to nat UDP 500 on the inside to TCP 10000 on the outside of my C1700 router?


-Rainman