Home > Security and SD-WAN > Site-to-site VPN > Configuring Cisco 2811 router for Site-to-site VPN with MX Series Appliance using the Command Line Interface

Configuring Cisco 2811 router for Site-to-site VPN with MX Series Appliance using the Command Line Interface

Table of contents
No headers

This article will outline the process for configuring a Site-to-site VPN between a MX Security Appliance and a Cisco 2800 series router using the command line interface.

The diagram below shows the connection between the 2 sites participating in the site to site VPN



  • Configure the MX side as explained here
  • Configure the Cisco 2811 router as shown below



Configure ISKAMP Policy

   crypto isakmp policy 10

   encr 3des

   authentication pre-share

   hash sha

   lifetime 28800

   group 2


Configure IPsec Transform Set

  crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac


Specifies the interesting traffic to be encrypted

   ip access-list extended outgoing_to_MX

   permit ip


Specifies the pre-shared key "secretkey" which should be identical at both peers

  crypto isakmp key secretkey address


Configure the Ipsec-isakmp

  crypto map 2800-isakmp 1 ipsec-isakmp

  set peer

  set transform-set ESP-3DES-SHA

  match address outgoing_to_MX


Apply the Ipsec-isakmp to interface

  interface FastEthernet0/1

  ip address

  ip nat outside

  duplex auto

  speed auto

  crypto map 2800-isakmp


Once the MX and the ASA are successfully configured, the network configured for VPN access will be able to access each other's resources. To initialize the VPN tunnel, it is necessary to generate interesting traffic and send it to the VPN peer. This can be done by initiating a ping across the tunnel.


Troubleshooting 3rd party VPN on MX can be found here



Last modified



This page has no classifications.

Explore the Product

Click to Learn More

Article ID

ID: 1486

Explore Meraki

You can find out more about Cisco Meraki on our main site, including information on products, contacting sales and finding a vendor.

Explore Meraki

Contact Support

Most questions can be answered by reviewing our documentation, but if you need more help, Cisco Meraki Support is ready to work with you.

Open a Case

Ask the Community

In the Meraki Community, you can keep track of the latest announcements, find answers provided by fellow Meraki users and ask questions of your own.

Visit the Community