Create a Post
Showing results for 
Search instead for 
Did you mean: 

Route Based VPN

Hi All, 

I facing issue while understanding route based vpn with cisco device. I tried to lab the scenario but its not working. the topology is as follows.

R1--> Checkpoint firewall --> R2

R1 loopback -

R2 loopback -

the objective is to ping to and traffic should go through tunnel.

So i am creating route based vpn between checkpoint and r2. The steps that i performed on checkpoint firewall:

1. created a tunnel interface

 remote peer:

used numbered

local address

remote address

2. add route for ----> vpn tunnel int (next HOP)

3. on checkpoint gateway in VPN domain call is it necessary to mention VPN domain in route based VPN or we can select or subnets behind gateway option.

4. add inter-operable device - R2.

5. in VPN community used mesh --> added gateway and router, configured phase 1 and phase 2 parameters and added shared secret key.

now on Cisco router i configured following.

R1(config)#crypto isakmp policy 1
R1(config-isakmp)#encryption 3des
R1(config-isakmp)#authentication pre-share
R1(config-isakmp)#group 2
R1(config-isakmp)#hash sha256

R1(config-isakmp)#crypto isakmp key admin@123 address

R1(config)#crypto ipsec transform-set MY_TRANSFORM_SET esp-3des esp-sha256-hmac
R1(cfg-crypto-trans)#mode tunnel

R1(config)#crypto ipsec profile IPSEC_PROFILE
R1(ipsec-profile)#set transform-set MY_TRANSFORM_SET

R1(config)#interface Tunnel 0
R1(config-if)#ip address
R1(config-if)#tunnel source
R1(config-if)#tunnel destination

R1(config-if)#tunnel protection ipsec profile IPSEC_PROFILE

R1(config)#ip route Tunnel0

do we need to mention proxy-acl on cisco router as well. 

As i understand it is not necessary and routing decision will be taken in account instead of policy.

Correct me if i am wrong somewhere. I am still a learner.


14 Replies
This widget could not be displayed.