Corporate Headquarters

Tip
If you have trouble, ensure that you specified the correct interface when you applied the access list.
Comprehensive Configuration Examples
Following are comprehensive sample configurations for the site-to-site and extranet scenarios.
Site-to-Site Scenario
The following sample configuration is based on the physical elements shown in 
Figure 3-8
:
Figure 3-8
Site-to-Site VPN Scenario Physical Elements
Fast Ethernet
0/0
10.1.3.3/24
Fast Ethernet
0/0
10.1.4.2/24
Fast Ethernet
0/1
10.1.6.4/24
Headquarters gateway
(hq-sanjose)
Remote office gateway
(ro-rtp)
Internet
Serial 1/0
172.17.2.4/24
Public
Web server
10.1.6.5/24
Private
corporate
server
10.1.3.6/24
Tunnel interface 0
172.17.3.3/24
Tunnel interface 1
172.24.3.6/24
Serial 1/0
172.24.2.5/24
PC A
10.1.4.3/24
GRE tunnel
23245

---

3-40
Cisco IOS VPN Configuration Guide
OL-8336-01
Chapter 3 Site-to-Site and Extranet VPN Business Scenarios
Comprehensive Configuration Examples
Headquarters Router Configuration
hq-sanjose# 
show running-config
Building configuration...
Current configuration:
!
version 12.0
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname hq-sanjose
!
boot system flash bootflash:
boot bootldr bootflash:c7200-jk9o3s-mz.123-3
boot config slot0:hq-sanjose-cfg-small
no logging buffered
!
crypto isakmp policy 1
authentication pre-share
lifetime 84600
crypto isakmp key test12345 address 172.24.2.5
!
crypto ipsec transform-set proposal1 ah-sha-hmac esp-des esp-sha-hmac 
mode transport
!
!
crypto map s1first local-address Serial1/0
crypto map s1first 1 ipsec-isakmp
set peer 172.24.2.5
set transform-set proposal1 
match address 101
!
interface Tunnel0
bandwidth 180
ip address 172.17.3.3 255.255.255.0
no ip directed-broadcast
tunnel source 172.17.2.4
tunnel destination 172.24.2.5
crypto map s1first
!
interface FastEthernet0/0
ip address 10.1.3.3 255.255.255.0
no ip directed-broadcast
no keepalive
full-duplex
no cdp enable
!
interface FastEthernet0/1
ip address 10.1.6.4 255.255.255.0
no ip directed-broadcast
no keepalive
full-duplex
no cdp enable
!
interface Serial1/0
ip address 172.17.2.4 255.255.255.0
no ip directed-broadcast
no ip mroute-cache
no keepalive
fair-queue 64 256 0
framing c-bit

---