P.S. I don't know how to set a /31 mask instead of a /24 mask?
I tried 255.255.255.254 but with not luck.

I have another question: in the past I set up a PPP over SSH tunnel between two Unix machines, I could, start stop, restart the tunnel whenever I wanted. Can I do the same with an IPSec tunnel between two Cisco routers? In particular, I wish I could start the tunnel on demand and not have it active all the time... is it possible and how?

Lea Massiot said
I've turned off the Windows firewalls on both "PC 1" and "PC 2" and now "PC 1" can access "PC 2"'s shares and and vice versa. It is not a solution but I guess it is an indication that the VPN tunnel is actually "doing" its job, isn't it?

aryoba wrote: I never like the idea of having interface as default gateway since it potentially creates unnecessary ARP broadcast which may slow down your connection. Why can't you just use IP address as default gateway?

quote:

---

Run crossover cable between the routers by using one of the unused ports of each router

---

+------+| PC 1 |+------+NIC - IP 192.168.1.2   |   |   +--"Normal" Ethernet cable   |   |VLAN 1 = {Fa0, Fa2, Fa3} - IP IP 192.168.1.1+----------+| Router 1 |+----------+VLAN 2 = {Fa1} - 192.168.15.1   |   |   |   +--Ethernet crossover cable   |   |   |VLAN 2 = {Fa1} - 192.168.15.2+----------+| Router 2 |+----------+VLAN 1 = {Fa0, Fa2, Fa3} - IP 192.168.0.1   |   |   +--"Normal" Ethernet cable   |   |NIC - IP 192.168.0.2+------+| PC 2 |+------+ 

quote:

---

Configure a new VLAN on each router

---

Router 1# conf tRouter 1(config)# vlan 2Router 1(config-vlan)# name vlan_vpnRouter 1(config-vlan)# state activeRouter 1(config-vlan)# no shutdownRouter 1(config-vlan)# exitRouter 1(config)# exit Router 1# conf tRouter 1(config)# interface FastEthernet 1Router 1(config-if)# switchport access vlan 2Router 1(config-if)# exitRouter 1(config)# exit Router 1# conf tRouter 1(config)# interface Vlan 2Router 1(config-if)# ip address 192.168.15.1 255.255.255.0 

Router 2# conf tRouter 2(config)# interface Vlan 2Router 2(config-if)# ip address 192.168.15.2 255.255.255.0 

quote:

---

Terminate the IPSec VPN tunnel using this new VLAN

---

Router 1(config)# access-list 100 permit udp host 192.168.15.2 host 192.168.15.1 eq isakmpRouter 1(config)# access-list 100 permit ahp host 192.168.15.2 host 192.168.15.1Router 1(config)# access-list 100 permit esp host 192.168.15.2 host 192.168.15.1-----------------------------------------------------------------------Router 1(config)# crypto isakmp enableRouter 1(config)# crypto isakmp identity addressRouter 1(config)# crypto isakmp key azertyuiop address 192.168.15.2 255.255.255.0-----------------------------------------------------------------------Router 1(config)#crypto isakmp policy 10Router 1(config-isakmp)# authentication pre-shareRouter 1(config-isakmp)# encryption 3desRouter 1(config-isakmp)# group 2Router 1(config-isakmp)# hash md5Router 1(config-isakmp)# lifetime 86400Router 1(config-isakmp)# exitRouter 1(config)#-----------------------------------------------------------------------Router 1(config)# access-list 101 permit ip 192.168.1.0 0.0.0.255 192.168.0.0 0.0.0.255-----------------------------------------------------------------------Router 1(config)# crypto ipsec transform-set STRONGEST esp-3des esp-md5-hmacRouter 1(cfg-crypto-trans)# mode tunnelRouter 1(cfg-crypto-trans)# exitRouter 1(config)#Router 1(config)# crypto ipsec security-association lifetime seconds 86400-----------------------------------------------------------------------Router 1(config)# crypto map VPN 10 ipsec-isakmpRouter 1(config-crypto-map)# match address 101Router 1(config-crypto-map)# set transform-set STRONGESTRouter 1(config-crypto-map)# set peer 192.168.15.2-----------------------------------------------------------------------Router 1(config)#interface Vlan 2Router 1(config-if)#crypto map VPNRouter 1(config-if)#exit 

Router 2(config)# access-list 100 permit udp host 192.168.15.1 host 192.168.15.2 eq isakmpRouter 2(config)# access-list 100 permit ahp host 192.168.15.1 host 192.168.15.2Router 2(config)# access-list 100 permit esp host 192.168.15.1 host 192.168.15.2-----------------------------------------------------------------------Router 2(config)# crypto isakmp enableRouter 2(config)# crypto isakmp identity addressRouter 2(config)# crypto isakmp key azertyuiop address 192.168.15.1 255.255.255.0-----------------------------------------------------------------------Router 2(config)#crypto isakmp policy 10Router 2(config-isakmp)# authentication pre-shareRouter 2(config-isakmp)# encryption 3desRouter 2(config-isakmp)# group 2Router 2(config-isakmp)# hash md5Router 2(config-isakmp)# lifetime 86400Router 2(config-isakmp)# exitRouter 2(config)#-----------------------------------------------------------------------Router 2(config)# access-list 101 permit ip 192.168.0.0 0.0.0.255 192.168.1.0 0.0.0.255-----------------------------------------------------------------------Router 2(config)# crypto ipsec transform-set STRONGEST esp-3des esp-md5-hmacRouter 2(cfg-crypto-trans)# mode tunnelRouter 2(cfg-crypto-trans)# exitRouter 2(config)#Router 2(config)# crypto ipsec security-association lifetime seconds 86400-----------------------------------------------------------------------Router 2(config)# crypto map VPN 10 ipsec-isakmpRouter 2(config-crypto-map)# match address 101Router 2(config-crypto-map)# set transform-set STRONGESTRouter 2(config-crypto-map)# set peer 192.168.15.1-----------------------------------------------------------------------Router 2(config)#interface Vlan 2Router 2(config-if)#crypto map VPNRouter 2(config-if)#exit 

Router 1# show crypto isakmp saIPv4 Crypto ISAKMP SAdst             src             state          conn-id status192.168.15.1    192.168.15.2    QM_IDLE           2001 ACTIVE Router 2# show crypto isakmp saIPv4 Crypto ISAKMP SAdst             src             state          conn-id status192.168.15.1    192.168.15.2    QM_IDLE           2001 ACTIVE Router 1# show crypto ipsec sainterface: Vlan2    Crypto map tag: VPN, local addr 192.168.15.1    protected vrf: (none)   local  ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)   remote ident (addr/mask/prot/port): (192.168.0.0/255.255.255.0/0/0)   current_peer 192.168.15.2 port 500     PERMIT, flags={origin_is_acl,}    #pkts encaps: 635, #pkts encrypt: 635, #pkts digest: 635    #pkts decaps: 697, #pkts decrypt: 697, #pkts verify: 697    #pkts compressed: 0, #pkts decompressed: 0    #pkts not compressed: 0, #pkts compr. failed: 0    #pkts not decompressed: 0, #pkts decompress failed: 0    #send errors 0, #recv errors 0      local crypto endpt.: 192.168.15.1, remote crypto endpt.: 192.168.15.2     path mtu 1500, ip mtu 1500, ip mtu idb Vlan2     current outbound spi: 0x38EBFA57(954989143)     PFS (Y/N): N, DH group: none      inbound esp sas:      spi: 0xB8D93DEB(3101244907)        transform: esp-3des esp-md5-hmac ,        in use settings ={Tunnel, }        conn id: 37, flow_id: Onboard VPN:37, sibling_flags 80000046, crypto map: VPN        sa timing: remaining key lifetime (k/sec): (4468644/1773)        IV size: 8 bytes        replay detection support: Y        Status: ACTIVE      inbound ah sas:      inbound pcp sas:      outbound esp sas:      spi: 0x38EBFA57(954989143)        transform: esp-3des esp-md5-hmac ,        in use settings ={Tunnel, }        conn id: 38, flow_id: Onboard VPN:38, sibling_flags 80000046, crypto map: VPN        sa timing: remaining key lifetime (k/sec): (4468648/1773)        IV size: 8 bytes        replay detection support: Y        Status: ACTIVE      outbound ah sas:        in use settings ={Tunnel, }        conn id: 37, flow_id: Onboard VPN:37, sibling_flags 80000046, crypto map: VPN        sa timing: remaining key lifetime (k/sec): (4468644/1773)        IV size: 8 bytes        replay detection support: Y        Status: ACTIVE      inbound ah sas:      inbound pcp sas:      outbound esp sas:      spi: 0x38EBFA57(954989143)        transform: esp-3des esp-md5-hmac ,        in use settings ={Tunnel, }        conn id: 38, flow_id: Onboard VPN:38, sibling_flags 80000046, crypto map: VPN        sa timing: remaining key lifetime (k/sec): (4468648/1773)        IV size: 8 bytes        replay detection support: Y        Status: ACTIVE      outbound ah sas:      outbound pcp sas: 

# debug crypto isakmp# debug crypto ipsec 

\\192.168.0.2The network path was not found. 

IPv4 Crypto ISAKMP SAdst             src             state          conn-id status 

cisco_router···nfig.txt 1,964 bytes Router 1 running configuration

cisco_router···nfig.txt 2,311 bytes Router 2 running configuration