Question

Cisco 871 cannot get windows VPN tunnel to work

Asked by: bbrunning

I setup the router to forward 3389 to the server for RDP. Now I've tried to get the MS VPN tunnel to work. I forwarded 1723 and opened GRE but it just hangs on verifying username and password but nothing beyond that. WinXP gets error 721 Remote computer did not respond.
Here is my running config:

ip cef
!
!
ip port-map user-protocol--1 port tcp 3389
no ip bootp server
ip domain name stmark.local
ip name-server 216.199.54.9
ip name-server 216.199.46.11
!
parameter-map type protocol-info msn-servers
 server name messenger.hotmail.com
 server name gateway.messenger.hotmail.com
 server name webmessenger.msn.com
 
parameter-map type protocol-info aol-servers
 server name login.oscar.aol.com
 server name toc.oscar.aol.com
 server name oam-d09a.blue.aol.com
 
parameter-map type protocol-info yahoo-servers
 server name scs.msg.yahoo.com
 server name scsa.msg.yahoo.com
 server name scsb.msg.yahoo.com
 server name scsc.msg.yahoo.com
 server name scsd.msg.yahoo.com
 server name cs16.msg.dcn.yahoo.com
 server name cs19.msg.dcn.yahoo.com
 server name cs42.msg.dcn.yahoo.com
 server name cs53.msg.dcn.yahoo.com
 server name cs54.msg.dcn.yahoo.com
 server name ads1.vip.scd.yahoo.com
 server name radio1.launch.vip.dal.yahoo.com
 server name in1.msg.vip.re2.yahoo.com
 server name data1.my.vip.sc5.yahoo.com
 server name address1.pim.vip.mud.yahoo.com
 server name edit.messenger.yahoo.com
 server name messenger.yahoo.com
 server name http.pager.yahoo.com
 server name privacy.yahoo.com
 server name csa.yahoo.com
 server name csb.yahoo.com
 server name csc.yahoo.com
 
!
!
username admin privilege 15 secret 5 $1$fquH$fz2mr5/tJdPGzxuE3jcRw.
! 
!
archive
 log config
  hidekeys
!
!
ip tcp synwait-time 10
ip ssh time-out 60
ip ssh authentication-retries 2
!
class-map type inspect match-any SDM_HTTPS
 match access-group name SDM_HTTPS
class-map type inspect match-any SDM_SSH
 match access-group name SDM_SSH
class-map type inspect match-any SDM_SHELL
 match access-group name SDM_SHELL
class-map type inspect match-any sdm-cls-access
 match class-map SDM_HTTPS
 match class-map SDM_SSH
 match class-map SDM_SHELL
class-map type inspect imap match-any ccp-app-imap
 match  invalid-command
class-map type inspect match-all sdm-nat-user-protocol--1-1
 match access-group 103
 match protocol user-protocol--1
class-map type inspect match-any CCP-Voice-permit
 match protocol h323
 match protocol skinny
 match protocol sip
class-map type inspect match-any ccp-cls-insp-traffic
 match protocol cuseeme
 match protocol dns
 match protocol ftp
 match protocol h323
 match protocol https
 match protocol icmp
 match protocol imap
 match protocol pop3
 match protocol netshow
 match protocol shell
 match protocol realmedia
 match protocol rtsp
 match protocol smtp extended
 match protocol sql-net
 match protocol streamworks
 match protocol tftp
 match protocol vdolive
 match protocol tcp
 match protocol udp
class-map type inspect match-all ccp-insp-traffic
 match class-map ccp-cls-insp-traffic
class-map type inspect match-all sdm-nat-pptp-1
 match access-group 104
 match protocol pptp
class-map type inspect msnmsgr match-any ccp-app-msn-otherservices
 match  service any 
class-map type inspect ymsgr match-any ccp-app-yahoo-otherservices
 match  service any 
class-map type inspect match-any ccp-cls-icmp-access
 match protocol icmp
 match protocol tcp
 match protocol udp
class-map type inspect match-any ccp-cls-protocol-im
 match protocol ymsgr yahoo-servers
 match protocol msnmsgr msn-servers
 match protocol aol aol-servers
class-map type inspect aol match-any ccp-app-aol-otherservices
 match  service any 
class-map type inspect match-all ccp-protocol-pop3
 match protocol pop3
class-map type inspect pop3 match-any ccp-app-pop3
 match  invalid-command
class-map type inspect match-all sdm-access
 match class-map sdm-cls-access
 match access-group 102
class-map type inspect msnmsgr match-any ccp-app-msn
 match  service text-chat 
class-map type inspect ymsgr match-any ccp-app-yahoo
 match  service text-chat 
class-map type inspect match-all ccp-protocol-im
 match class-map ccp-cls-protocol-im
class-map type inspect match-all ccp-invalid-src
 match access-group 100
class-map type inspect match-all ccp-icmp-access
 match class-map ccp-cls-icmp-access
class-map type inspect http match-any ccp-app-httpmethods
 match  request method bcopy
 match  request method bdelete
 match  request method bmove
 match  request method bpropfind
 match  request method bproppatch
 match  request method connect
 match  request method copy
 match  request method delete
 match  request method edit
 match  request method getattribute
 match  request method getattributenames
 match  request method getproperties
 match  request method index
 match  request method lock
 match  request method mkcol
 match  request method mkdir
 match  request method move
 match  request method notify
 match  request method options
 match  request method poll
 match  request method propfind
 match  request method proppatch
 match  request method put
 match  request method revadd
 match  request method revlabel
 match  request method revlog
 match  request method revnum
 match  request method save
 match  request method search
 match  request method setattribute
 match  request method startrev
 match  request method stoprev
 match  request method subscribe
 match  request method trace
 match  request method unedit
 match  request method unlock
 match  request method unsubscribe
class-map type inspect http match-any ccp-http-blockparam
 match  request port-misuse im
 match  request port-misuse p2p
 match  req-resp protocol-violation
class-map type inspect match-all ccp-protocol-imap
 match protocol imap
class-map type inspect aol match-any ccp-app-aol
 match  service text-chat 
class-map type inspect match-all ccp-protocol-http
 match protocol http
class-map type inspect http match-any ccp-http-allowparam
 match  request port-misuse tunneling
!
!
policy-map type inspect ccp-permit-icmpreply
 class type inspect ccp-icmp-access
  inspect
 class class-default
  pass
policy-map type inspect sdm-pol-NATOutsideToInside-1
 class type inspect sdm-nat-user-protocol--1-1
  inspect
 class type inspect sdm-nat-pptp-1
  inspect
 class class-default
policy-map type inspect im ccp-action-app-im
 class type inspect aol ccp-app-aol
  log
  allow
 class type inspect msnmsgr ccp-app-msn
  log
  allow
 class type inspect ymsgr ccp-app-yahoo
  log
  allow
 class type inspect aol ccp-app-aol-otherservices
  log
  reset
 class type inspect msnmsgr ccp-app-msn-otherservices
  log
  reset
 class type inspect ymsgr ccp-app-yahoo-otherservices
  log
  reset
 class class-default
policy-map type inspect http ccp-action-app-http
 class type inspect http ccp-http-blockparam
  log
  reset
 class type inspect http ccp-app-httpmethods
  log
  reset
 class type inspect http ccp-http-allowparam
  log
  allow
 class class-default
policy-map type inspect imap ccp-action-imap
 class type inspect imap ccp-app-imap
  log
 class class-default
policy-map type inspect pop3 ccp-action-pop3
 class type inspect pop3 ccp-app-pop3
  log
 class class-default
policy-map type inspect ccp-inspect
 class type inspect ccp-invalid-src
  drop log
 class type inspect ccp-protocol-http
  inspect
  service-policy http ccp-action-app-http
 class type inspect ccp-protocol-imap
  inspect
  service-policy imap ccp-action-imap
 class type inspect ccp-protocol-pop3
  inspect
  service-policy pop3 ccp-action-pop3
 class type inspect ccp-protocol-im
  inspect
  service-policy im ccp-action-app-im
 class type inspect ccp-insp-traffic
  inspect
 class type inspect CCP-Voice-permit
  inspect
 class class-default
  pass
policy-map type inspect ccp-permit
 class type inspect sdm-access
  inspect
 class class-default
!
zone security out-zone
zone security in-zone
zone-pair security ccp-zp-self-out source self destination out-zone
 service-policy type inspect ccp-permit-icmpreply
zone-pair security ccp-zp-in-out source in-zone destination out-zone
 service-policy type inspect ccp-inspect
zone-pair security ccp-zp-out-self source out-zone destination self
 service-policy type inspect ccp-permit
zone-pair security sdm-zp-NATOutsideToInside-1 source out-zone destination in-zone
 service-policy type inspect sdm-pol-NATOutsideToInside-1
!
!
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
 description $ES_WAN$$FW_OUTSIDE$
 ip address 70.46.31.194 255.255.255.252
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat outside
 ip virtual-reassembly
 zone-member security out-zone
 ip route-cache flow
 duplex auto
 speed auto
!
interface Vlan1
 description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$ES_LAN$$FW_INSIDE$
 ip address 192.168.1.1 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat inside
 ip virtual-reassembly
 zone-member security in-zone
 ip route-cache flow
 ip tcp adjust-mss 1452
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 70.46.31.193
!
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source list 1 interface FastEthernet4 overload
ip nat inside source static tcp 192.168.1.10 3389 interface FastEthernet4 3389
ip nat inside source static tcp 192.168.1.10 500 70.46.31.194 500 extendable
ip nat inside source static tcp 192.168.1.10 1723 70.46.31.194 1723 extendable
!
ip access-list extended SDM_HTTPS
 remark CCP_ACL Category=1
 permit tcp any any eq 443
ip access-list extended SDM_SHELL
 remark CCP_ACL Category=1
 permit tcp any any eq cmd
ip access-list extended SDM_SSH
 remark CCP_ACL Category=1
 permit tcp any any eq 22
!
logging trap debugging
access-list 1 remark INSIDE_IF=Vlan1
access-list 1 remark CCP_ACL Category=2
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 100 remark CCP_ACL Category=128
access-list 100 permit ip host 255.255.255.255 any
access-list 100 permit ip 127.0.0.0 0.255.255.255 any
access-list 100 permit ip 70.46.31.192 0.0.0.3 any
access-list 101 permit tcp host 192.168.1.10 host 70.46.31.194 eq 1723
access-list 101 permit gre host 192.168.1.10 host 70.46.31.194
access-list 102 remark CCP_ACL Category=128
access-list 102 permit ip any any
access-list 103 remark CCP_ACL Category=0
access-list 103 permit ip any host 192.168.1.10
access-list 104 remark CCP_ACL Category=0
access-list 104 permit ip any host 192.168.1.10
access-list 130 permit gre any any
no cdp run
!
!
!
control-plane
!
banner exec ^C
% Password expiration warning.
-----------------------------------------------------------------------
 
Cisco Configuration Professional (Cisco CP) is installed on this device 
and it provides the default username "cisco" for  one-time use. If you have 
already used the username "cisco" to login to the router and your IOS image 
supports the "one-time" user option, then this username has already expired. 
You will not be able to login to the router with this username after you exit 
this session.
 
It is strongly suggested that you create a new username with a privilege level 
of 15 using the following command.
 
username <myuser> privilege 15 secret 0 <mypassword>
 
Replace <myuser> and <mypassword> with the username and password you 
want to use.
 
-----------------------------------------------------------------------
^C
banner login ^CAuthorized access only!
 Disconnect IMMEDIATELY if you are not an authorized user!^C
!
line con 0
 login local
 no modem enable
 transport output telnet
line aux 0
 login local
 transport output telnet
line vty 0 4
 privilege level 15
 login local
 transport input telnet ssh
!
scheduler max-task-time 5000
scheduler allocate 4000 1000
scheduler interval 500
end

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119:
120:
121:
122:
123:
124:
125:
126:
127:
128:
129:
130:
131:
132:
133:
134:
135:
136:
137:
138:
139:
140:
141:
142:
143:
144:
145:
146:
147:
148:
149:
150:
151:
152:
153:
154:
155:
156:
157:
158:
159:
160:
161:
162:
163:
164:
165:
166:
167:
168:
169:
170:
171:
172:
173:
174:
175:
176:
177:
178:
179:
180:
181:
182:
183:
184:
185:
186:
187:
188:
189:
190:
191:
192:
193:
194:
195:
196:
197:
198:
199:
200:
201:
202:
203:
204:
205:
206:
207:
208:
209:
210:
211:
212:
213:
214:
215:
216:
217:
218:
219:
220:
221:
222:
223:
224:
225:
226:
227:
228:
229:
230:
231:
232:
233:
234:
235:
236:
237:
238:
239:
240:
241:
242:
243:
244:
245:
246:
247:
248:
249:
250:
251:
252:
253:
254:
255:
256:
257:
258:
259:
260:
261:
262:
263:
264:
265:
266:
267:
268:
269:
270:
271:
272:
273:
274:
275:
276:
277:
278:
279:
280:
281:
282:
283:
284:
285:
286:
287:
288:
289:
290:
291:
292:
293:
294:
295:
296:
297:
298:
299:
300:
301:
302:
303:
304:
305:
306:
307:
308:
309:
310:
311:
312:
313:
314:
315:
316:
317:
318:
319:
320:
321:
322:
323:
324:
325:
326:
327:
328:
329:
330:
331:
332:
333:
334:
335:
336:
337:
338:
339:
340:
341:
342:
343:
344:
345:
346:
347:
348:
349:
350:
351:
352:
353:
354:
355:
356:
357:
358:
359:
360:
361:
362:
363:
364:
365:
366:
367:
368:
369:
370:
371:
372:
373:
374:
375:
376:
377:
378:
379:
380:
381:
382:
383:
384:
385:
386:
387:
388:
389:
390:
391:
392:

Select all Open in new window

This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

Plus...

30 Day FREE access, no risk, no obligation
Collaborate with the world's top tech experts
Unlimited access to our exclusive solution database
Never be left without tech help again

Subscribe Now

Asked On: 2009-08-18 at 14:43:01ID24663070
Tags: Cisco VPN
,; Cisco router
,; Cisco VPN port forward
,; Cisco port forward
,; Cisco PAT
,; Cisco NAT
Topics: Networking Hardware
,; Windows Networking
Participating Experts: 2
Points: 500
Comments: 46

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

"The time we save is the biggest benefit of Experts Exchange to Warner Bros. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange." Mike Kapnisakis, Warner Bros.
"Our team likes having a resource that is more secure than just using Google and most experts using this service really know their stuff. It's nice to look here first versus using Google." Dayna Sellner, Lockheed Martin
"Anytime that I've been stumped with a problem, 9 out of 10 times Experts Exchange has either the accepted solution or an open discussion of the potential solution to the problem." Kenny Red, eBay Inc.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.

Screenshot of Experts Exchange Knowledgebase

Need individual assistance?

Our experts are ready to help.

If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.

Want to learn from the best?

Read articles from industry experts.

Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.

Working on a long term project?

Store your work and research.

Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.

Access the answers to your technology questions today.

Subscribe Now

30-day free trial. Register in 60 seconds.

What Makes Experts Exchange Unique?

Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Trusted by the world's most respected brands.

image of each brand's logo

Faithfully serving IT professionals since 1996.

Experts Exchange Logo

Try it out and discover for yourself.

Subscribe Now

30-day free trial. Register in 60 seconds.

Free Tech Articles

WARNING: 5 Reasons why you should NEVER fix a computer for free.
It is in our nature to love the puzzle. We are obsessed. The lot of us. We love puzzles. We love the challenge. We thrive on finding the answer. We hate disarray. It bothers us deep in our soul. W...
SCCM OSD Basic troubleshooting
SCCM 2007 OSD is a fantastic way to deploy operating systems, however, like most things SCCM issues can sometimes be difficult to resolve due to the sheer volume of logs to sift through and the dispe...
Migrate Small Business Server 2003 to Exchange 2010 and Windows 2008 R2
This guide is intended to provide step by step instructions on how to migrate from Small Business Server 2003 to Windows 2008 R2 with Exchange 2010. For this migration to work you will need the fo...
Create a Win7 Gadget
This article shows you how to create a simple "Gadget" -- a sort of mini-application supported by Windows 7 and Vista. Gadgets can be dropped anywhere on the desktop to provide instant information, ...
Outlook continually prompting for username and password
There have been a lot of questions recently regarding Outlook prompting for a username and password whilst using Exchange 2007. There are a few reasons why this would happen and I will try to cover t...
Backup Exchange 2010 Information Store using Windows Backup
There seems to be quite a lot of confusion around the ability to backup Exchange 2010 using the built in Windows Backup feature. This stems from the omission of this feature prior to Exchange 2007 s...

Cloud Class Webinars

Avoiding Bugs in Microsoft Access
Alison Balter takes and in-depth look at avoiding bugs in Access. In this webinar you will learn about using the immediate window to debug your applications, invoking the debugger, using breakpoints to troubleshoot, stepping through code, setting the next statement to execute, ...
Top 10 Best New Features in Visio 2010
Scott Helmers gives live demonstrations of the top 10 new features in Visio 2010. This webinar will teach you how to create compelling diagrams by adding shapes to the page with a single click, linking the shapes in a diagram to data in Excel (or SQL Server, or SharePoint), ...
IT Consultant Business Secrets Revealed
Michael Munger, Experts Exchange tech pro and IT consultant, pulls back the curtain on his very successful businesses and answers question on every IT consultant and business owner should know about. He shares secrets on what he did to solve the 5 most common problems in IT, ...
Disaster Recovery and Business Continuity
Quest CTO, Mike Billon, gives an overview of the steps involved in building a dunamic disaster recovery plan. Through case studies and an examination of software/hardware tooles for monitoring and testing, you'll gain a better understandin of where you are, where you want ...
Organize Your Visio Diagrams with Containers and Lists
Scott Helmers uses cross functional flowcharts, wireframe diagrams, data graphic legends and seating charts to teach you: how to ustilize all three new structured diagram components in Visio 2010, the best practices for organizeing shapes in previous version of Visio, how to organize ...
How to Us Objects, Properties, Events and Methods in Microsoft Access
Alison Dalter gives an in-depbth look at objects, properties, events and methods in Microsoft Access. In this webinar you will learn about using the object browser, referring to objects, working with properties and methods, working with object variables, understanding the ...

Watch More

Join the Community

Give a Little. Get a Lot.

Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.

Join the Community

Answers

by: asdlkfPosted on 2009-08-18 at 14:49:50ID: 25128017

On line 317, forward UDP, not TCP for port 500...

change:
ip nat inside source static tcp 192.168.1.10 500 70.46.31.194 500 extendable
to:
ip nat inside source static udp 192.168.1.10 500 70.46.31.194 500 extendable

by: bbrunningPosted on 2009-08-18 at 15:03:50ID: 25128108

Changed, still same problem

by: asdlkfPosted on 2009-08-18 at 16:03:06ID: 25128410

ok, well... looking deeper... there are some other things wrong with this configuration.

For example, access group 101... search for "101" and it only appears once. This means that your declairing an ACL, but your not using that ACL anywhere.

Search for "sdm-nat-pptp-1" which is what i think you used cisco config professional to create a PPTP custom protocol for 1723... sketchy... but ok... - it allows TCP 1723, but not UDP 500 and not GRE.

About line 70:
class-map type inspect match-all sdm-nat-user-protocol--1-1
match access-group 103
match protocol user-protocol--1

Then, line 330ish
access-list 103 remark CCP_ACL Category=0
access-list 103 permit ip any host 192.168.1.10

Line 4:
ip port-map user-protocol--1 port tcp 3389

So, your saying "Permit 3389" when "destination is 192.168.1.10"

I'll have to think about this for a bit to determine what must be done to directly fix this.

Is this a school assignment or just custom install?
is CCP needed?

by: bbrunningPosted on 2009-08-18 at 18:50:06ID: 25129095

No, it's custom install. It's been about 10 years since I configured a cisco router (back when I was in school) and I haven't used cisco since. CCP is not needed, I was big into linux back in the day and know that command line always beats the gui interface but I was in a rush to get the internet and rdp working so I went with cisco's CCP.

Let me know what you find.

Thanks!

by: mikecrPosted on 2009-08-18 at 18:52:35ID: 25129102

Try using the interface name instead of the ip address for the static nat statements and see what happens.

by: bbrunningPosted on 2009-08-18 at 18:56:56ID: 25129118

Mikecr, kind of a newbie with this. Care to explain where and what part in the conf?

by: asdlkfPosted on 2009-08-18 at 22:31:50ID: 25129809

Look at this working example:

http://www.experts-exchange.com/Security/Software_Firewalls/Enterprise_Firewalls/Cisco_PIX_Firewall/Q_22728325.html

Note the use of interfaces instead of ip addresses in the IP NAT STATIC assignments....

by: mikecrPosted on 2009-08-19 at 04:31:25ID: 25131427

Use these.

ip nat inside source static tcp 192.168.1.10 500 Fastethernet4 500 extendable
ip nat inside source static tcp 192.168.1.10 1723 Fastetherent4 1723 extendable

by: bbrunningPosted on 2009-08-19 at 12:26:24ID: 25136320

mikecr, tried that, still gets stuck on verifying username and password. Also, extendable is invalid when using interface names. I'm going to look over that working config now and see if I find anything.

by: bbrunningPosted on 2009-08-19 at 12:42:38ID: 25136523

Made some changes based of the working config. Here's the update:

I'm a little confused on something. If you look at where mine goes out to the internet;
ip route 0.0.0.0 0.0.0.0 70.46.31.193

it's .193

In my access list I'm using the public address .194

Should I be using the .193 address?

BTW still does not get passed verifying username and password.

class-map type inspect msnmsgr match-any ccp-app-msn-otherservices
 match  service any
class-map type inspect ymsgr match-any ccp-app-yahoo-otherservices
 match  service any
class-map match-all pptp-port
class-map type inspect match-any ccp-cls-icmp-access
 match protocol icmp
 match protocol tcp
 match protocol udp
class-map type inspect match-any ccp-cls-protocol-im
 match protocol ymsgr yahoo-servers
 match protocol msnmsgr msn-servers
 match protocol aol aol-servers
class-map type inspect aol match-any ccp-app-aol-otherservices
 match  service any
class-map type inspect match-all ccp-protocol-pop3
 match protocol pop3
class-map type inspect pop3 match-any ccp-app-pop3
 match  invalid-command
class-map type inspect match-all sdm-access
 match class-map sdm-cls-access
 match access-group 102
class-map type inspect msnmsgr match-any ccp-app-msn
 match  service text-chat
class-map type inspect ymsgr match-any ccp-app-yahoo
 match  service text-chat
class-map type inspect match-all ccp-protocol-im
 match class-map ccp-cls-protocol-im
class-map type inspect match-all ccp-invalid-src
 match access-group 100
class-map type inspect match-all ccp-icmp-access
 match class-map ccp-cls-icmp-access
class-map type inspect http match-any ccp-app-httpmethods
 match  request method bcopy
 match  request method bdelete
 match  request method bmove
 match  request method bpropfind
 match  request method bproppatch
 match  request method connect
 match  request method copy
 match  request method delete
 match  request method edit
 match  request method getattribute
 match  request method getattributenames
 match  request method getproperties
 match  request method index
 match  request method lock
 match  request method mkcol
 match  request method mkdir
 match  request method move
 match  request method notify
 match  request method options
 match  request method poll
 match  request method propfind
 match  request method proppatch
 match  request method put
 match  request method revadd
 match  request method revlabel
 match  request method revlog
 match  request method revnum
 match  request method save
 match  request method search
 match  request method setattribute
 match  request method startrev
 match  request method stoprev
 match  request method subscribe
 match  request method trace
 match  request method unedit
 match  request method unlock
 match  request method unsubscribe
class-map type inspect http match-any ccp-http-blockparam
 match  request port-misuse im
 match  request port-misuse p2p
 match  req-resp protocol-violation
class-map type inspect match-all ccp-protocol-imap
 match protocol imap
class-map type inspect aol match-any ccp-app-aol
 match  service text-chat
class-map type inspect match-all ccp-protocol-http
 match protocol http
class-map type inspect http match-any ccp-http-allowparam
 match  request port-misuse tunneling
!
!
policy-map type inspect ccp-permit-icmpreply
 class type inspect ccp-icmp-access
  inspect
 class class-default
  pass
policy-map type inspect sdm-pol-NATOutsideToInside-1
 class type inspect sdm-nat-user-protocol--1-1
  inspect
 class type inspect sdm-nat-pptp-1
  inspect
 class class-default
policy-map type inspect im ccp-action-app-im
 class type inspect aol ccp-app-aol
  log
  allow
 class type inspect msnmsgr ccp-app-msn
  log
  allow
 class type inspect ymsgr ccp-app-yahoo
  log
  allow
 class type inspect aol ccp-app-aol-otherservices
  log
  reset
 class type inspect msnmsgr ccp-app-msn-otherservices
  log
  reset
 class type inspect ymsgr ccp-app-yahoo-otherservices
  log
  reset
 class class-default
policy-map type inspect http ccp-action-app-http
 class type inspect http ccp-http-blockparam
  log
  reset
 class type inspect http ccp-app-httpmethods
  log
  reset
 class type inspect http ccp-http-allowparam
  log
  allow
 class class-default
policy-map type inspect imap ccp-action-imap
 class type inspect imap ccp-app-imap
  log
 class class-default
policy-map type inspect pop3 ccp-action-pop3
 class type inspect pop3 ccp-app-pop3
  log
 class class-default
policy-map type inspect ccp-inspect
 class type inspect ccp-invalid-src
  drop log
 class type inspect ccp-protocol-http
  inspect
  service-policy http ccp-action-app-http
 class type inspect ccp-protocol-imap
  inspect
  service-policy imap ccp-action-imap
 class type inspect ccp-protocol-pop3
  inspect
  service-policy pop3 ccp-action-pop3
 class type inspect ccp-protocol-im
  inspect
  service-policy im ccp-action-app-im
 class type inspect ccp-insp-traffic
  inspect
 class type inspect CCP-Voice-permit
  inspect
 class class-default
  pass
policy-map type inspect ccp-permit
 class type inspect sdm-access
  inspect
 class class-default
!
zone security out-zone
zone security in-zone
zone-pair security ccp-zp-self-out source self destination out-zone
 service-policy type inspect ccp-permit-icmpreply
zone-pair security ccp-zp-in-out source in-zone destination out-zone
 service-policy type inspect ccp-inspect
zone-pair security ccp-zp-out-self source out-zone destination self
 service-policy type inspect ccp-permit
zone-pair security sdm-zp-NATOutsideToInside-1 source out-zone destination in-zo
ne
 service-policy type inspect sdm-pol-NATOutsideToInside-1
!
!
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
 description $ES_WAN$$FW_OUTSIDE$
 ip address 70.46.31.194 255.255.255.252
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat outside
 ip virtual-reassembly
 zone-member security out-zone
 ip route-cache flow
 duplex auto
 speed auto
!
interface Vlan1
 description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$ES_LAN$$FW_INSIDE$
 ip address 192.168.1.1 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat inside
 ip virtual-reassembly
 zone-member security in-zone
 ip route-cache flow
 ip tcp adjust-mss 1452
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 70.46.31.193
!
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source list 1 interface FastEthernet4 overload
ip nat inside source static tcp 192.168.1.10 3389 interface FastEthernet4 3389
ip nat inside source static tcp 192.168.1.10 500 interface FastEthernet4 500
ip nat inside source static tcp 192.168.1.10 1723 interface FastEthernet4 1723
ip nat inside source static udp 192.168.1.10 500 interface FastEthernet4 500
ip nat inside source static udp 192.168.1.10 1701 interface FastEthernet4 1701
!
ip access-list extended SDM_HTTPS
 remark CCP_ACL Category=1
 permit tcp any any eq 443
ip access-list extended SDM_SHELL
 remark CCP_ACL Category=1
 permit tcp any any eq cmd
ip access-list extended SDM_SSH
 remark CCP_ACL Category=1
 permit tcp any any eq 22
!
logging trap debugging
access-list 1 remark INSIDE_IF=Vlan1
access-list 1 remark CCP_ACL Category=2
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 100 remark CCP_ACL Category=128
access-list 100 permit ip host 255.255.255.255 any
access-list 100 permit ip 127.0.0.0 0.255.255.255 any
access-list 100 permit ip 70.46.31.192 0.0.0.3 any
access-list 101 permit gre any any
access-list 101 permit ip any any
access-list 101 permit tcp any host 70.46.31.194 eq 1723
access-list 101 permit tcp any host 70.46.31.194 eq 1701
access-list 101 permit udp any host 70.46.31.194 eq 1701
access-list 101 permit gre any host 70.46.31.194
access-list 102 remark CCP_ACL Category=128
access-list 102 permit ip any any
access-list 103 remark CCP_ACL Category=0
access-list 103 permit ip any host 192.168.1.10
access-list 104 remark CCP_ACL Category=0
access-list 104 permit ip any host 192.168.1.10
no cdp run
!
!
!
control-plane
!
banner exec ^C
% Password expiration warning.
-----------------------------------------------------------------------
 
Cisco Configuration Professional (Cisco CP) is installed on this device
and it provides the default username "cisco" for  one-time use. If you have
already used the username "cisco" to login to the router and your IOS image
supports the "one-time" user option, then this username has already expired.
You will not be able to login to the router with this username after you exit
this session.
 
It is strongly suggested that you create a new username with a privilege level
of 15 using the following command.
 
username <myuser> privilege 15 secret 0 <mypassword>
 
Replace <myuser> and <mypassword> with the username and password you
want to use.
 
-----------------------------------------------------------------------
^C
banner login ^CAuthorized access only!
 Disconnect IMMEDIATELY if you are not an authorized user!^C
!
line con 0
 login local
 no modem enable
 transport output telnet
line aux 0
 login local
 transport output telnet
line vty 0 4
 privilege level 15
 login local
 transport input telnet ssh
!
scheduler max-task-time 5000
scheduler allocate 4000 1000
scheduler interval 500
end
 
StMarkCisco#

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119:
120:
121:
122:
123:
124:
125:
126:
127:
128:
129:
130:
131:
132:
133:
134:
135:
136:
137:
138:
139:
140:
141:
142:
143:
144:
145:
146:
147:
148:
149:
150:
151:
152:
153:
154:
155:
156:
157:
158:
159:
160:
161:
162:
163:
164:
165:
166:
167:
168:
169:
170:
171:
172:
173:
174:
175:
176:
177:
178:
179:
180:
181:
182:
183:
184:
185:
186:
187:
188:
189:
190:
191:
192:
193:
194:
195:
196:
197:
198:
199:
200:
201:
202:
203:
204:
205:
206:
207:
208:
209:
210:
211:
212:
213:
214:
215:
216:
217:
218:
219:
220:
221:
222:
223:
224:
225:
226:
227:
228:
229:
230:
231:
232:
233:
234:
235:
236:
237:
238:
239:
240:
241:
242:
243:
244:
245:
246:
247:
248:
249:
250:
251:
252:
253:
254:
255:
256:
257:
258:
259:
260:
261:
262:
263:
264:
265:
266:
267:
268:
269:
270:
271:
272:
273:
274:
275:
276:
277:
278:
279:
280:
281:
282:
283:
284:
285:
286:
287:
288:
289:
290:
291:
292:
293:
294:
295:
296:
297:
298:
299:
300:

Select all Open in new window

by: bbrunningPosted on 2009-08-19 at 13:13:38ID: 25136823

BTW, my VPN server address is 192.168.1.10, I read somewhere else that I needed access list from this:
access-list 101 permit tcp any host 70.46.31.194 eq 1723
Changed to this:
access-list 101 permit tcp any host 192.168.1.10 eq 1723

Still doesn't work, was that correct or wrong?

by: mikecrPosted on 2009-08-19 at 14:26:14ID: 25137549

Try this and let me know what happens.

access-list 105 permit ip any any
ip nat inside source list 105 interface fastethernet4 overload

by: bbrunningPosted on 2009-08-19 at 15:18:22ID: 25137941

nope, still nothing

by: bbrunningPosted on 2009-08-19 at 15:20:20ID: 25137956

I was trying to temporarily allow one user to rdp in using a different port. 3390 and I updated the acl and ip nat inside but it didn't allow me to rdp in. Here's the current config now:

ne
 service-policy type inspect sdm-pol-NATOutsideToInside-1
!
!
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
 description $ES_WAN$$FW_OUTSIDE$
 ip address 70.46.31.194 255.255.255.252
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat outside
 ip virtual-reassembly
 zone-member security out-zone
 ip route-cache flow
 duplex auto
 speed auto
!
interface Vlan1
 description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$ES_LAN$$FW_INSIDE$
 ip address 192.168.1.1 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat inside
 ip virtual-reassembly
 zone-member security in-zone
 ip route-cache flow
 ip tcp adjust-mss 1452
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 70.46.31.193
!
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source list 1 interface FastEthernet4 overload
ip nat inside source static tcp 192.168.1.10 3389 interface FastEthernet4 3389
ip nat inside source static udp 192.168.1.10 500 interface FastEthernet4 500
ip nat inside source static tcp 192.168.1.10 1723 interface FastEthernet4 1723
ip nat inside source static tcp 192.168.1.171 3390 interface FastEthernet4 3390
ip nat inside source list 105 interface FastEthernet4 overload
ip nat inside source static tcp 192.168.1.10 1701 70.46.31.194 1701 extendable
!
ip access-list extended SDM_HTTPS
 remark CCP_ACL Category=1
 permit tcp any any eq 443
ip access-list extended SDM_SHELL
 remark CCP_ACL Category=1
 permit tcp any any eq cmd
ip access-list extended SDM_SSH
 remark CCP_ACL Category=1
 permit tcp any any eq 22
!
logging trap debugging
access-list 1 remark INSIDE_IF=Vlan1
access-list 1 remark CCP_ACL Category=2
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 100 remark CCP_ACL Category=128
access-list 100 permit ip host 255.255.255.255 any
access-list 100 permit ip 127.0.0.0 0.255.255.255 any
access-list 100 permit ip 70.46.31.192 0.0.0.3 any
access-list 101 permit tcp any host 192.168.1.10 eq 1723
access-list 101 permit gre any host 192.168.1.10
access-list 101 permit tcp any host 192.168.1.171 eq 3390
access-list 101 permit gre any any
access-list 101 permit ip any any
access-list 101 permit udp any host 70.46.31.194 eq 1701
access-list 102 remark CCP_ACL Category=128
access-list 102 permit ip any any
access-list 103 remark CCP_ACL Category=0
access-list 103 permit ip any host 192.168.1.10
access-list 103 permit ip any host 192.168.1.171
access-list 104 remark CCP_ACL Category=0
access-list 104 permit ip any host 192.168.1.10
access-list 104 permit ip any host 192.168.1.171
access-list 105 permit ip any any
no cdp run
!
!
!
control-plane
!

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:

Select all Open in new window

by: bbrunningPosted on 2009-08-19 at 15:51:06ID: 25138107

Another thing, I ran the basic firewall wizard a while ago (with CCP), could this have screwed everything else up?

by: bbrunningPosted on 2009-08-19 at 16:50:42ID: 25138361

What really gets to me is why is port 3389 working properly for remote desktop when it's not even in the access-lists?

by: mikecrPosted on 2009-08-19 at 19:02:37ID: 25138882

Remove this one by putting a no in front of it and let me know what happens.

no ip nat inside source list 1 interface FastEthernet4 overload

The outbound nat should then be done by access list 105.

by: bbrunningPosted on 2009-08-19 at 19:09:31ID: 25138907

I think I may start getting it figured out. I didn't have any of the access lists bound to the interfaces. So everything I did really had no effect on making anything better. fasteth4 has no access group and neither does vlan1. I just applied access group 100 to vlan1 and it cut me off. I've been working on this remotely so now I'm kind of screwed. Looks like I'll be at their office as soon as they open tomorrow.

obviously since ag 100 to vlan1 just kicked me out, I take it that's wrong. Was that supposed to be on fastethernet4?

Which do I bind and where?

by: mikecrPosted on 2009-08-19 at 19:24:31ID: 25138972

First lets work on getting the NAT working again. If you removed the command that I showed you earlier, then access list 105 would have taken over and natted all internal clients and allowed them out to the internet. The NAT access list is only used to dictate what traffic is going to be natted outbound from your network. The IP NAT INSIDE and OUTSIDE statements on the interfaces put this into effect. You don't need to assign an access group to an interface.

Don't assign any access lists to interfaces unless your actually doing security and picking and choosing what traffic you will allow/disallow. In your case here, your identifying traffic that you want to NAT based off of an access list, it's not being used for security.

What version of IOS Is on that router? You can get this by doing "show ver" from the CLI.

by: bbrunningPosted on 2009-08-19 at 19:39:53ID: 25139034

I'm pretty sure it's 12.4 but I cannot double check until the morning since I'm locked out.
Since I applied access group 101 to vlan1, what do I type to reverse it?

by: mikecrPosted on 2009-08-20 at 04:59:44ID: 25141325

If you didn't get a chance to save the changes just reboot the router. If you did then do:
config t
int vlan 1
no ip access-group 101 in (or out) whichever one you used.

by: bbrunningPosted on 2009-08-20 at 06:12:29ID: 25142037

Router ver is 12.3(8r)YI4
I removed the entry I made last night. It's back up. I made the changes to 105 as you listed. I still cannot VPN in and I cannot use my custom port map either for RDP. I did make a change to GRE and port 1723 and 1701 for the VPN. From the working config you showed me earlier, he only has "my_static_ip" and I'm not sure if that's supposted to be my internet ip or my server's ip. Currently it is my servers IP.
Below is the current config:

!
!
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
 description $ES_WAN$$FW_OUTSIDE$
 ip address 70.46.31.194 255.255.255.252
 ip access-group group in
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat outside
 ip virtual-reassembly
 zone-member security out-zone
 ip route-cache flow
 duplex auto
 speed auto
!
interface Vlan1
 description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$ES_LAN$$FW_INSIDE$
 ip address 192.168.1.1 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat inside
 ip virtual-reassembly
 zone-member security in-zone
 ip route-cache flow
 ip tcp adjust-mss 1452
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 70.46.31.193
!
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source static udp 192.168.1.10 500 interface FastEthernet4 500
ip nat inside source static tcp 192.168.1.171 3390 interface FastEthernet4 3390
ip nat inside source static udp 192.168.1.171 3390 interface FastEthernet4 3390
ip nat inside source static udp 192.168.1.10 1701 interface FastEthernet4 1701
ip nat inside source static tcp 192.168.1.10 1723 interface FastEthernet4 1723
ip nat inside source static tcp 192.168.1.10 3389 interface FastEthernet4 3389
ip nat inside source list 105 interface FastEthernet4 overload
ip nat inside source static tcp 192.168.1.10 1701 70.46.31.194 1701 extendable
!
ip access-list extended SDM_HTTPS
 remark CCP_ACL Category=1
 permit tcp any any eq 443
ip access-list extended SDM_SHELL
 remark CCP_ACL Category=1
 permit tcp any any eq cmd
ip access-list extended SDM_SSH
 remark CCP_ACL Category=1
 permit tcp any any eq 22
!
logging trap debugging
access-list 1 remark INSIDE_IF=Vlan1
access-list 1 remark CCP_ACL Category=2
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 100 remark CCP_ACL Category=128
access-list 100 permit ip host 255.255.255.255 any
access-list 100 permit ip 127.0.0.0 0.255.255.255 any
access-list 100 permit ip 70.46.31.192 0.0.0.3 any
access-list 101 permit tcp any host 70.46.31.194 eq 1723
access-list 101 permit udp any host 70.46.31.194 eq isakmp
access-list 101 permit udp any host 70.46.31.194 eq 1701
access-list 101 permit gre any host 70.46.31.194
access-list 102 remark CCP_ACL Category=128
access-list 102 permit ip any any
access-list 103 remark CCP_ACL Category=0
access-list 103 permit ip any host 192.168.1.10
access-list 104 remark CCP_ACL Category=0
access-list 104 permit ip any host 192.168.1.10
access-list 105 permit ip any any
no cdp run

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:

Select all Open in new window

by: bbrunningPosted on 2009-08-20 at 06:13:18ID: 25142045

I'm sorry, currently it is my "INTERNET" IP

by: mikecrPosted on 2009-08-20 at 07:10:13ID: 25142702

What is this? "ip access-group group in" It's applied to the Ethernet4 interface but there is no access list called group.
Remove the zone-member securit off the interface temporarily. Let's try to get to basic config and get it working. Remove all the access lists except for 105 unless your using them somewhere else and remove all the static nat statements also. Just leave the global nat so they can get to the internet.

Once you remove all the nat statements, I want you to add this:

ip nat inside source static tcp 192.168.1.10 1723 70.46.31.194 1723 extendable.

After you do that, try to VPN to the VPN server. As your doing that, I want you to run "show ip nat translations *" on the router and post it here. I need to see if NAT is working properly.

by: bbrunningPosted on 2009-08-20 at 07:52:29ID: 25143260

I'm doing this remotely so I won't be able to remove access group 1 or 100 as far as I know.
Below is the ip nat trans:


StMarkCisco#show ip nat translations
Pro Inside global         Inside local          Outside local         Outside global
udp 70.46.31.194:50450    70.46.31.194:50450    216.199.46.11:53      216.199.46.11:53
udp 70.46.31.194:50921    70.46.31.194:50921    216.199.46.11:53      216.199.46.11:53
udp 70.46.31.194:50964    70.46.31.194:50964    216.199.46.11:53      216.199.46.11:53
udp 70.46.31.194:52109    70.46.31.194:52109    216.199.46.11:53      216.199.46.11:53
udp 70.46.31.194:52204    70.46.31.194:52204    216.199.46.11:53      216.199.46.11:53
udp 70.46.31.194:52728    70.46.31.194:52728    216.199.46.11:53      216.199.46.11:53
udp 70.46.31.194:55071    70.46.31.194:55071    216.199.46.11:53      216.199.46.11:53
udp 70.46.31.194:56324    70.46.31.194:56324    216.199.46.11:53      216.199.46.11:53
udp 70.46.31.194:57323    70.46.31.194:57323    216.199.46.11:53      216.199.46.11:53
udp 70.46.31.194:57341    70.46.31.194:57341    216.199.46.11:53      216.199.46.11:53
udp 70.46.31.194:58598    70.46.31.194:58598    216.199.46.11:53      216.199.46.11:53
udp 70.46.31.194:60098    70.46.31.194:60098    216.199.46.11:53      216.199.46.11:53
udp 70.46.31.194:60543    70.46.31.194:60543    216.199.46.11:53      216.199.46.11:53
udp 70.46.31.194:61226    70.46.31.194:61226    216.199.46.11:53      216.199.46.11:53
udp 70.46.31.194:61952    70.46.31.194:61952    216.199.46.11:53      216.199.46.11:53
udp 70.46.31.194:62210    70.46.31.194:62210    216.199.46.11:53      216.199.46.11:53
udp 70.46.31.194:62924    70.46.31.194:62924    216.199.46.11:53      216.199.46.11:53
udp 70.46.31.194:63291    70.46.31.194:63291    216.199.46.11:53      216.199.46.11:53
udp 70.46.31.194:63813    70.46.31.194:63813    216.199.46.11:53      216.199.46.11:53
udp 70.46.31.194:63959    70.46.31.194:63959    216.199.46.11:53      216.199.46.11:53
udp 70.46.31.194:64603    70.46.31.194:64603    216.199.46.11:53      216.199.46.11:53
udp 70.46.31.194:500      192.168.1.10:500      216.199.40.189:500    216.199.40.189:500
udp 70.46.31.194:500      192.168.1.10:500      216.199.40.189:500    216.199.40.189:500
udp 70.46.31.194:500      192.168.1.10:500      216.199.40.189:500    216.199.40.189:500
udp 70.46.31.194:500      192.168.1.10:500      216.199.40.189:500    216.199.40.189:500
udp 70.46.31.194:500      192.168.1.10:500      ---                   ---
tcp 70.46.31.194:1723     192.168.1.10:1723     76.26.237.181:58277   76.26.237.181:58277
tcp 70.46.31.194:1723     192.168.1.10:1723     ---                   ---
udp 70.46.31.194:1945     192.168.1.10:1945     216.199.46.11:53      216.199.46.11:53
tcp 70.46.31.194:3389     192.168.1.10:3389     76.26.237.181:58265   76.26.237.181:58265
tcp 70.46.31.194:3389     192.168.1.10:3389     ---                   ---
udp 70.46.31.194:11233    192.168.1.10:11233    216.199.46.11:53      216.199.46.11:53
udp 70.46.31.194:11996    192.168.1.10:11996    216.199.46.11:53      216.199.46.11:53
tcp 70.46.31.194:21505    192.168.1.10:21505    210.68.85.241:80      210.68.85.241:80
tcp 70.46.31.194:21685    192.168.1.10:21685    210.68.85.241:80      210.68.85.241:80
tcp 70.46.31.194:22195    192.168.1.10:22195    211.147.20.24:80      211.147.20.24:80
udp 70.46.31.194:22846    192.168.1.10:22846    216.199.46.11:53      216.199.46.11:53
tcp 70.46.31.194:22881    192.168.1.10:22881    74.125.45.148:80      74.125.45.148:80
tcp 70.46.31.194:22905    192.168.1.10:22905    74.125.45.99:80       74.125.45.99:80
tcp 70.46.31.194:23060    192.168.1.10:23060    198.99.122.203:80     198.99.122.203:80
tcp 70.46.31.194:23067    192.168.1.10:23067    70.46.29.40:80        70.46.29.40:80
tcp 70.46.31.194:23088    192.168.1.10:23088    70.46.29.40:80        70.46.29.40:80
tcp 70.46.31.194:23089    192.168.1.10:23089    70.46.29.42:80        70.46.29.42:80
tcp 70.46.31.194:23095    192.168.1.10:23095    70.46.29.42:80        70.46.29.42:80
tcp 70.46.31.194:23101    192.168.1.10:23101    70.46.29.42:80        70.46.29.42:80
tcp 70.46.31.194:23104    192.168.1.10:23104    91.121.160.217:80     91.121.160.217:80
tcp 70.46.31.194:23106    192.168.1.10:23106    70.46.29.40:80        70.46.29.40:80
tcp 70.46.31.194:23112    192.168.1.10:23112    91.121.160.217:80     91.121.160.217:80
tcp 70.46.31.194:23116    192.168.1.10:23116    91.121.160.217:80     91.121.160.217:80
tcp 70.46.31.194:23117    192.168.1.10:23117    213.186.46.79:80      213.186.46.79:80
tcp 70.46.31.194:23118    192.168.1.10:23118    74.125.65.139:80      74.125.65.139:80
Pro Inside global         Inside local          Outside local         Outside global
tcp 70.46.31.194:23122    192.168.1.10:23122    198.99.122.199:80     198.99.122.199:80
tcp 70.46.31.194:23124    192.168.1.10:23124    66.114.52.26:80       66.114.52.26:80
tcp 70.46.31.194:23126    192.168.1.10:23126    91.121.160.217:80     91.121.160.217:80
tcp 70.46.31.194:23131    192.168.1.10:23131    213.186.46.79:80      213.186.46.79:80
tcp 70.46.31.194:23135    192.168.1.10:23135    74.125.45.102:80      74.125.45.102:80
tcp 70.46.31.194:23140    192.168.1.10:23140    74.125.45.138:80      74.125.45.138:80
tcp 70.46.31.194:23148    192.168.1.10:23148    96.7.108.20:80        96.7.108.20:80
tcp 70.46.31.194:23158    192.168.1.10:23158    96.9.153.126:80       96.9.153.126:80
tcp 70.46.31.194:23159    192.168.1.10:23159    96.9.153.126:80       96.9.153.126:80
tcp 70.46.31.194:23160    192.168.1.10:23160    96.9.153.126:80       96.9.153.126:80
tcp 70.46.31.194:23161    192.168.1.10:23161    82.94.246.43:80       82.94.246.43:80
tcp 70.46.31.194:23184    192.168.1.10:23184    151.138.22.170:80     151.138.22.170:80
tcp 70.46.31.194:23199    192.168.1.10:23199    98.137.80.32:80       98.137.80.32:80
tcp 70.46.31.194:23200    192.168.1.10:23200    98.137.80.33:80       98.137.80.33:80
tcp 70.46.31.194:23201    192.168.1.10:23201    98.137.80.34:80       98.137.80.34:80
tcp 70.46.31.194:23202    192.168.1.10:23202    98.137.80.33:80       98.137.80.33:80
tcp 70.46.31.194:23203    192.168.1.10:23203    98.137.80.50:80       98.137.80.50:80
tcp 70.46.31.194:23204    192.168.1.10:23204    98.137.80.49:80       98.137.80.49:80
tcp 70.46.31.194:23205    192.168.1.10:23205    72.246.113.153:80     72.246.113.153:80
tcp 70.46.31.194:23211    192.168.1.10:23211    151.138.22.170:80     151.138.22.170:80
tcp 70.46.31.194:23214    192.168.1.10:23214    209.177.239.55:80     209.177.239.55:80
tcp 70.46.31.194:23218    192.168.1.10:23218    208.71.121.28:80      208.71.121.28:80
tcp 70.46.31.194:23223    192.168.1.10:23223    70.46.29.40:80        70.46.29.40:80
tcp 70.46.31.194:23226    192.168.1.10:23226    66.114.52.23:80       66.114.52.23:80
tcp 70.46.31.194:23228    192.168.1.10:23228    64.124.61.10:80       64.124.61.10:80
tcp 70.46.31.194:23232    192.168.1.10:23232    74.55.196.220:80      74.55.196.220:80
tcp 70.46.31.194:23234    192.168.1.10:23234    74.125.45.149:80      74.125.45.149:80
tcp 70.46.31.194:23235    192.168.1.10:23235    66.114.52.23:80       66.114.52.23:80
tcp 70.46.31.194:23236    192.168.1.10:23236    97.65.135.139:80      97.65.135.139:80
tcp 70.46.31.194:23237    192.168.1.10:23237    209.85.66.221:80      209.85.66.221:80
tcp 70.46.31.194:23248    192.168.1.10:23248    209.177.239.56:80     209.177.239.56:80
tcp 70.46.31.194:23259    192.168.1.10:23259    151.138.22.74:80      151.138.22.74:80
tcp 70.46.31.194:23261    192.168.1.10:23261    69.147.76.15:80       69.147.76.15:80
tcp 70.46.31.194:23262    192.168.1.10:23262    64.12.190.1:80        64.12.190.1:80
tcp 70.46.31.194:23263    192.168.1.10:23263    209.177.239.55:80     209.177.239.55:80
tcp 70.46.31.194:23264    192.168.1.10:23264    66.235.142.3:80       66.235.142.3:80
tcp 70.46.31.194:23265    192.168.1.10:23265    64.236.144.246:80     64.236.144.246:80
tcp 70.46.31.194:23266    192.168.1.10:23266    97.65.135.176:80      97.65.135.176:80
tcp 70.46.31.194:23267    192.168.1.10:23267    97.65.135.178:80      97.65.135.178:80
tcp 70.46.31.194:23268    192.168.1.10:23268    97.65.135.178:80      97.65.135.178:80
tcp 70.46.31.194:23269    192.168.1.10:23269    64.12.201.118:80      64.12.201.118:80
tcp 70.46.31.194:23270    192.168.1.10:23270    64.236.144.245:80     64.236.144.245:80
tcp 70.46.31.194:23271    192.168.1.10:23271    64.236.144.246:80     64.236.144.246:80
tcp 70.46.31.194:23272    192.168.1.10:23272    64.236.144.245:80     64.236.144.245:80
tcp 70.46.31.194:23273    192.168.1.10:23273    74.125.45.148:80      74.125.45.148:80
tcp 70.46.31.194:23274    192.168.1.10:23274    74.125.45.148:80      74.125.45.148:80
tcp 70.46.31.194:23275    192.168.1.10:23275    72.32.153.176:80      72.32.153.176:80
tcp 70.46.31.194:23276    192.168.1.10:23276    97.65.135.152:80      97.65.135.152:80
tcp 70.46.31.194:23277    192.168.1.10:23277    97.65.135.161:80      97.65.135.161:80
tcp 70.46.31.194:23278    192.168.1.10:23278    97.65.135.155:80      97.65.135.155:80
tcp 70.46.31.194:23279    192.168.1.10:23279    205.188.186.19:80     205.188.186.19:80
Pro Inside global         Inside local          Outside local         Outside global
tcp 70.46.31.194:23280    192.168.1.10:23280    64.12.169.57:80       64.12.169.57:80
tcp 70.46.31.194:23281    192.168.1.10:23281    97.65.135.163:80      97.65.135.163:80
tcp 70.46.31.194:23282    192.168.1.10:23282    97.65.135.139:80      97.65.135.139:80
tcp 70.46.31.194:23283    192.168.1.10:23283    97.65.135.147:80      97.65.135.147:80
tcp 70.46.31.194:23284    192.168.1.10:23284    64.12.168.33:80       64.12.168.33:80
tcp 70.46.31.194:23285    192.168.1.10:23285    97.65.135.146:80      97.65.135.146:80
tcp 70.46.31.194:23286    192.168.1.10:23286    97.65.135.139:80      97.65.135.139:80
tcp 70.46.31.194:23287    192.168.1.10:23287    165.193.93.108:80     165.193.93.108:80
tcp 70.46.31.194:23288    192.168.1.10:23288    64.12.174.185:80      64.12.174.185:80
tcp 70.46.31.194:23289    192.168.1.10:23289    97.65.135.139:80      97.65.135.139:80
tcp 70.46.31.194:23290    192.168.1.10:23290    4.71.251.72:80        4.71.251.72:80
tcp 70.46.31.194:23291    192.168.1.10:23291    97.65.135.161:80      97.65.135.161:80
tcp 70.46.31.194:23292    192.168.1.10:23292    64.236.76.160:80      64.236.76.160:80
tcp 70.46.31.194:23293    192.168.1.10:23293    97.65.135.171:80      97.65.135.171:80
tcp 70.46.31.194:23294    192.168.1.10:23294    97.65.135.161:80      97.65.135.161:80
tcp 70.46.31.194:23295    192.168.1.10:23295    97.65.135.161:80      97.65.135.161:80
tcp 70.46.31.194:23296    192.168.1.10:23296    97.65.135.161:80      97.65.135.161:80
tcp 70.46.31.194:23297    192.168.1.10:23297    64.12.190.33:80       64.12.190.33:80
tcp 70.46.31.194:23298    192.168.1.10:23298    97.65.135.161:80      97.65.135.161:80
tcp 70.46.31.194:23299    192.168.1.10:23299    64.12.168.33:80       64.12.168.33:80
tcp 70.46.31.194:23302    192.168.1.10:23302    64.12.168.33:80       64.12.168.33:80
tcp 70.46.31.194:23303    192.168.1.10:23303    64.12.175.129:80      64.12.175.129:80
tcp 70.46.31.194:23305    192.168.1.10:23305    64.12.168.33:80       64.12.168.33:80
tcp 70.46.31.194:23306    192.168.1.10:23306    66.235.143.118:80     66.235.143.118:80
tcp 70.46.31.194:23307    192.168.1.10:23307    64.12.190.1:80        64.12.190.1:80
tcp 70.46.31.194:23312    192.168.1.10:23312    64.12.190.1:80        64.12.190.1:80
tcp 70.46.31.194:23313    192.168.1.10:23313    64.12.168.33:80       64.12.168.33:80
tcp 70.46.31.194:23314    192.168.1.10:23314    64.12.168.33:80       64.12.168.33:80
tcp 70.46.31.194:23315    192.168.1.10:23315    64.12.190.1:80        64.12.190.1:80
udp 70.46.31.194:26523    192.168.1.10:26523    216.199.46.11:53      216.199.46.11:53
udp 70.46.31.194:30044    192.168.1.10:30044    216.199.46.11:53      216.199.46.11:53
udp 70.46.31.194:31272    192.168.1.10:31272    216.199.46.11:53      216.199.46.11:53
udp 70.46.31.194:32504    192.168.1.10:32504    216.199.46.11:53      216.199.46.11:53
udp 70.46.31.194:32622    192.168.1.10:32622    216.199.46.11:53      216.199.46.11:53
udp 70.46.31.194:33448    192.168.1.10:33448    216.199.46.11:53      216.199.46.11:53
udp 70.46.31.194:33708    192.168.1.10:33708    216.199.46.11:53      216.199.46.11:53
udp 70.46.31.194:36133    192.168.1.10:36133    216.199.46.11:53      216.199.46.11:53
udp 70.46.31.194:37382    192.168.1.10:37382    216.199.46.11:53      216.199.46.11:53
udp 70.46.31.194:40713    192.168.1.10:40713    216.199.46.11:53      216.199.46.11:53
udp 70.46.31.194:48335    192.168.1.10:48335    216.199.46.11:53      216.199.46.11:53
udp 70.46.31.194:48878    192.168.1.10:48878    216.199.46.11:53      216.199.46.11:53
udp 70.46.31.194:50239    192.168.1.10:50239    216.199.46.11:53      216.199.46.11:53
udp 70.46.31.194:53004    192.168.1.10:53004    216.199.46.11:53      216.199.46.11:53
udp 70.46.31.194:63337    192.168.1.10:63337    216.199.46.11:53      216.199.46.11:53
udp 70.46.31.194:137      192.168.1.97:137      192.168.161.1:137     192.168.161.1:137
tcp 70.46.31.194:49564    192.168.1.121:49564   99.192.82.141:31470   99.192.82.141:31470
tcp 70.46.31.194:57299    192.168.1.124:57299   74.125.45.83:80       74.125.45.83:80
udp 70.46.31.194:1025     192.168.1.130:1025    64.81.111.2:53        64.81.111.2:53
tcp 70.46.31.194:1971     192.168.1.130:1971    65.55.200.156:80      65.55.200.156:80
tcp 70.46.31.194:1026     192.168.1.130:2492    65.55.122.232:2492    65.55.122.232:2492
udp 70.46.31.194:49505    192.168.1.130:49505   64.81.111.2:53        64.81.111.2:53
Pro Inside global         Inside local          Outside local         Outside global
udp 70.46.31.194:55417    192.168.1.130:55417   64.81.111.2:53        64.81.111.2:53
tcp 70.46.31.194:2246     192.168.1.132:2246    98.244.231.233:35458  98.244.231.233:35458
tcp 70.46.31.194:3491     192.168.1.132:3491    99.183.170.127:49712  99.183.170.127:49712
udp 70.46.31.194:22091    192.168.1.132:22091   24.58.82.135:18697    24.58.82.135:18697
udp 70.46.31.194:22091    192.168.1.132:22091   70.188.242.184:31781  70.188.242.184:31781
udp 70.46.31.194:22091    192.168.1.132:22091   71.65.63.149:3737     71.65.63.149:3737
udp 70.46.31.194:22091    192.168.1.132:22091   173.48.177.34:25184   173.48.177.34:25184
tcp 70.46.31.194:2615     192.168.1.137:2615    92.235.94.154:1227    92.235.94.154:1227
tcp 70.46.31.194:2389     192.168.1.140:2389    69.89.22.118:110      69.89.22.118:110
tcp 70.46.31.194:1146     192.168.1.170:1146    207.46.236.102:21     207.46.236.102:21
tcp 70.46.31.194:1147     192.168.1.170:1147    207.46.236.102:21     207.46.236.102:21
tcp 70.46.31.194:1148     192.168.1.170:1148    207.46.236.102:21     207.46.236.102:21
tcp 70.46.31.194:1149     192.168.1.170:1149    207.46.236.102:21     207.46.236.102:21
tcp 70.46.31.194:1150     192.168.1.170:1150    207.46.236.102:21     207.46.236.102:21
tcp 70.46.31.194:1151     192.168.1.170:1151    207.46.236.102:21     207.46.236.102:21
tcp 70.46.31.194:1153     192.168.1.170:1153    69.89.22.118:110      69.89.22.118:110
tcp 70.46.31.194:2492     192.168.1.170:2492    65.55.122.232:2492    65.55.122.232:2492
StMarkCisco#

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119:
120:
121:
122:
123:
124:
125:
126:
127:
128:
129:
130:
131:
132:
133:
134:
135:
136:
137:
138:
139:
140:
141:
142:
143:
144:
145:
146:
147:
148:
149:
150:
151:
152:
153:
154:
155:
156:
157:
158:
159:
160:
161:
162:
163:
164:
165:
166:
167:
168:
169:
170:
171:
172:
173:
174:
175:
176:
177:

Select all Open in new window

by: bbrunningPosted on 2009-08-20 at 08:05:19ID: 25143414

Also, I cannot remove zone member sec without disconnecting myself.

by: mikecrPosted on 2009-08-20 at 08:07:36ID: 25143451

Is RDP working? I see a NAT statement for it. What is the error message that you're getting when you try to PPTP to the VPN server? BTW, port 500 is for IPSEC and is not needed for PPTP.

I don't see any configuration for access list 1 or 100 that is being used. Do "show access-list 1" and the same thing with 100 and see if you have any matches.

by: mikecrPosted on 2009-08-20 at 08:16:58ID: 25143590

Try removing this: class type inspect sdm-nat-pptp-1 from the policy map below on the router. See if that works. If not, post a new copy of the entire config with all the changes that have been made so far.

policy-map type inspect sdm-pol-NATOutsideToInside-1
class type inspect sdm-nat-user-protocol--1-1
inspect
class type inspect sdm-nat-pptp-1
inspect

by: bbrunningPosted on 2009-08-20 at 08:25:34ID: 25143720

Okay, after I removed zone-member security out zone, it booted me. I had a user reset the router. Now RDP does NOT work, and I get error 800 when trying to VPN.

by: mikecrPosted on 2009-08-20 at 08:29:12ID: 25143772

Remove the class type above, not the entire zone command from the interface. Post an up to date config of the router and we'll fix RDP also.

by: bbrunningPosted on 2009-08-20 at 08:39:19ID: 25143895

Here's the config:
match protocol h323
match protocol https
match protocol icmp
match protocol imap
match protocol pop3
match protocol netshow
match protocol shell
match protocol realmedia
match protocol rtsp
match protocol smtp extended
match protocol sql-net
match protocol streamworks
match protocol tftp
match protocol vdolive
match protocol tcp
match protocol udp
class-map type inspect match-all ccp-insp-traffic
match class-map ccp-cls-insp-traffic
class-map type inspect match-all sdm-nat-pptp-1
match access-group 104
match protocol pptp
class-map type inspect msnmsgr match-any ccp-app-msn-otherservices
match service any
class-map type inspect ymsgr match-any ccp-app-yahoo-otherservices
match service any
class-map match-all pptp-port
class-map type inspect match-any ccp-cls-icmp-access
match protocol icmp
match protocol tcp
match protocol udp
class-map type inspect match-any ccp-cls-protocol-im
match protocol ymsgr yahoo-servers
match protocol msnmsgr msn-servers
match protocol aol aol-servers
class-map type inspect aol match-any ccp-app-aol-otherservices
match service any
class-map type inspect match-all ccp-protocol-pop3
match protocol pop3
class-map type inspect pop3 match-any ccp-app-pop3
match invalid-command
class-map type inspect match-all sdm-access
match class-map sdm-cls-access
match access-group 102
class-map type inspect msnmsgr match-any ccp-app-msn
match service text-chat
class-map type inspect ymsgr match-any ccp-app-yahoo
match service text-chat
class-map type inspect match-all ccp-protocol-im
match class-map ccp-cls-protocol-im
class-map type inspect match-all ccp-invalid-src
match access-group 100
class-map type inspect match-all ccp-icmp-access
match class-map ccp-cls-icmp-access
class-map type inspect http match-any ccp-app-httpmethods
match request method bcopy
match request method bdelete
match request method bmove
match request method bpropfind
match request method bproppatch
match request method connect
match request method copy
match request method delete
match request method edit
match request method getattribute
match request method getattributenames
match request method getproperties
match request method index
match request method lock
match request method mkcol
match request method mkdir
match request method move
match request method notify
match request method options
match request method poll
match request method propfind
match request method proppatch
match request method put
match request method revadd
match request method revlabel
match request method revlog
match request method revnum
match request method save
match request method search
match request method setattribute
match request method startrev
match request method stoprev
match request method subscribe
match request method trace
match request method unedit
match request method unlock
match request method unsubscribe
class-map type inspect http match-any ccp-http-blockparam
match request port-misuse im
match request port-misuse p2p
match req-resp protocol-violation
class-map type inspect match-all ccp-protocol-imap
match protocol imap
class-map type inspect aol match-any ccp-app-aol
match service text-chat
class-map type inspect match-all ccp-protocol-http
match protocol http
class-map type inspect http match-any ccp-http-allowparam
match request port-misuse tunneling
!
!
policy-map type inspect ccp-permit-icmpreply
class type inspect ccp-icmp-access
inspect
class class-default
pass
policy-map type inspect sdm-pol-NATOutsideToInside-1
class type inspect sdm-nat-user-protocol--1-1
inspect
class class-default
policy-map type inspect im ccp-action-app-im
class type inspect aol ccp-app-aol
log
allow
class type inspect msnmsgr ccp-app-msn
log
allow
class type inspect ymsgr ccp-app-yahoo
log
allow
class type inspect aol ccp-app-aol-otherservices
log
reset
class type inspect msnmsgr ccp-app-msn-otherservices
log
reset
class type inspect ymsgr ccp-app-yahoo-otherservices
log
reset
class class-default
policy-map type inspect http ccp-action-app-http
class type inspect http ccp-http-blockparam
log
reset
class type inspect http ccp-app-httpmethods
log
reset
class type inspect http ccp-http-allowparam
log
allow
class class-default
policy-map type inspect imap ccp-action-imap
class type inspect imap ccp-app-imap
log
class class-default
policy-map type inspect pop3 ccp-action-pop3
class type inspect pop3 ccp-app-pop3
log
class class-default
policy-map type inspect ccp-inspect
class type inspect ccp-invalid-src
drop log
class type inspect ccp-protocol-http
inspect
service-policy http ccp-action-app-http
class type inspect ccp-protocol-imap
inspect
service-policy imap ccp-action-imap
class type inspect ccp-protocol-pop3
inspect
service-policy pop3 ccp-action-pop3
class type inspect ccp-protocol-im
inspect
service-policy im ccp-action-app-im
class type inspect ccp-insp-traffic
inspect
class type inspect CCP-Voice-permit
inspect
class class-default
pass
policy-map type inspect ccp-permit
class type inspect sdm-access
inspect
class class-default
!
zone security out-zone
zone security in-zone
zone-pair security ccp-zp-self-out source self destination out-zone
service-policy type inspect ccp-permit-icmpreply zone-pair security ccp-zp-in-out source in-zone destination out-zone
service-policy type inspect ccp-inspect zone-pair security ccp-zp-out-self source out-zone destination self
service-policy type inspect ccp-permit zone-pair security sdm-zp-NATOutsideToInside-1 source out-zone destination in-zo ne
service-policy type inspect sdm-pol-NATOutsideToInside-1 !
!
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
description $ES_WAN$$FW_OUTSIDE$
ip address 70.46.31.194 255.255.255.252
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip virtual-reassembly
zone-member security out-zone
ip route-cache flow
duplex auto
speed auto
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$ES_LAN$$FW_INSIDE$
ip address 192.168.1.1 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip virtual-reassembly
zone-member security in-zone
ip route-cache flow
ip tcp adjust-mss 1452
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 70.46.31.193
!
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000 ip nat inside source static udp 192.168.1.10 500 interface FastEthernet4 500 ip nat inside source static tcp 192.168.1.10 3389 interface FastEthernet4 3389 ip nat inside source list 105 interface FastEthernet4 overload ip nat inside source static tcp 192.168.1.10 1723 70.46.31.194 1723 extendable !
ip access-list extended SDM_HTTPS
remark CCP_ACL Category=1
permit tcp any any eq 443
ip access-list extended SDM_SHELL
remark CCP_ACL Category=1
permit tcp any any eq cmd
ip access-list extended SDM_SSH
remark CCP_ACL Category=1
permit tcp any any eq 22
!
logging trap debugging
access-list 105 permit ip any any
no cdp run
!
!
!
control-plane
!
banner exec ^C
% Password expiration warning.
-----------------------------------------------------------------------

Cisco Configuration Professional (Cisco CP) is installed on this device and it provides the default username "cisco" for one-time use. If you have already used the username "cisco" to login to the router and your IOS image supports the "one-time" user option, then this username has already expired.
You will not be able to login to the router with this username after you exit this session.

It is strongly suggested that you create a new username with a privilege level of 15 using the following command.

username <myuser> privilege 15 secret 0 <mypassword>

Replace <myuser> and <mypassword> with the username and password you want to use.

-----------------------------------------------------------------------
^C
banner login ^CAuthorized access only!
Disconnect IMMEDIATELY if you are not an authorized user!^C !
line con 0
login local
no modem enable
transport output telnet
line aux 0
login local
transport output telnet
line vty 0 4
privilege level 15
password 7 00141C5F544A1C545E
login
transport input telnet ssh
!
scheduler max-task-time 5000
scheduler allocate 4000 1000
scheduler interval 500
end

StMarkCisco#

by: bbrunningPosted on 2009-08-20 at 09:05:58ID: 25144199

Sorry, I didn't remove that pptp entry. Here's the updated config. VPN still gets error 800. It doesn't even get to verifying username and password like it did before.

Thanks again in advance:

  match protocol h323
  match protocol https
  match protocol icmp
  match protocol imap
  match protocol pop3
  match protocol netshow
  match protocol shell
  match protocol realmedia
  match protocol rtsp
  match protocol smtp extended
  match protocol sql-net
  match protocol streamworks
  match protocol tftp
  match protocol vdolive
  match protocol tcp
  match protocol udp
class-map type inspect match-all ccp-insp-traffic
  match class-map ccp-cls-insp-traffic
class-map type inspect match-all sdm-nat-pptp-1
  match access-group 104
  match protocol pptp
class-map type inspect msnmsgr match-any ccp-app-msn-otherservices
  match  service any
class-map type inspect ymsgr match-any ccp-app-yahoo-otherservices
  match  service any
class-map match-all pptp-port
class-map type inspect match-any ccp-cls-icmp-access
  match protocol icmp
  match protocol tcp
  match protocol udp
class-map type inspect match-any ccp-cls-protocol-im
  match protocol ymsgr yahoo-servers
  match protocol msnmsgr msn-servers
  match protocol aol aol-servers
class-map type inspect aol match-any ccp-app-aol-otherservices
  match  service any
class-map type inspect match-all ccp-protocol-pop3
  match protocol pop3
class-map type inspect pop3 match-any ccp-app-pop3
  match  invalid-command
class-map type inspect match-all sdm-access
  match class-map sdm-cls-access
  match access-group 102
class-map type inspect msnmsgr match-any ccp-app-msn
  match  service text-chat
class-map type inspect ymsgr match-any ccp-app-yahoo
  match  service text-chat
class-map type inspect match-all ccp-protocol-im
  match class-map ccp-cls-protocol-im
class-map type inspect match-all ccp-invalid-src
  match access-group 100
class-map type inspect match-all ccp-icmp-access
  match class-map ccp-cls-icmp-access
class-map type inspect http match-any ccp-app-httpmethods
  match  request method bcopy
  match  request method bdelete
  match  request method bmove
  match  request method bpropfind
  match  request method bproppatch
  match  request method connect
  match  request method copy
  match  request method delete
  match  request method edit
  match  request method getattribute
  match  request method getattributenames
  match  request method getproperties
  match  request method index
  match  request method lock
  match  request method mkcol
  match  request method mkdir
  match  request method move
  match  request method notify
  match  request method options
  match  request method poll
  match  request method propfind
  match  request method proppatch
  match  request method put
  match  request method revadd
  match  request method revlabel
  match  request method revlog
  match  request method revnum
  match  request method save
  match  request method search
  match  request method setattribute
  match  request method startrev
  match  request method stoprev
  match  request method subscribe
  match  request method trace
  match  request method unedit
  match  request method unlock
  match  request method unsubscribe
class-map type inspect http match-any ccp-http-blockparam
  match  request port-misuse im
  match  request port-misuse p2p
  match  req-resp protocol-violation
class-map type inspect match-all ccp-protocol-imap
  match protocol imap
class-map type inspect aol match-any ccp-app-aol
  match  service text-chat
class-map type inspect match-all ccp-protocol-http
  match protocol http
class-map type inspect http match-any ccp-http-allowparam
  match  request port-misuse tunneling
!
!
policy-map type inspect ccp-permit-icmpreply
  class type inspect ccp-icmp-access
   inspect
  class class-default
   pass
policy-map type inspect sdm-pol-NATOutsideToInside-1
  class type inspect sdm-nat-user-protocol--1-1
   inspect
  class class-default
policy-map type inspect im ccp-action-app-im
  class type inspect aol ccp-app-aol
   log
   allow
  class type inspect msnmsgr ccp-app-msn
   log
   allow
  class type inspect ymsgr ccp-app-yahoo
   log
   allow
  class type inspect aol ccp-app-aol-otherservices
   log
   reset
  class type inspect msnmsgr ccp-app-msn-otherservices
   log
   reset
  class type inspect ymsgr ccp-app-yahoo-otherservices
   log
   reset
  class class-default
policy-map type inspect http ccp-action-app-http
  class type inspect http ccp-http-blockparam
   log
   reset
  class type inspect http ccp-app-httpmethods
   log
   reset
  class type inspect http ccp-http-allowparam
   log
   allow
  class class-default
policy-map type inspect imap ccp-action-imap
  class type inspect imap ccp-app-imap
   log
  class class-default
policy-map type inspect pop3 ccp-action-pop3
  class type inspect pop3 ccp-app-pop3
   log
  class class-default
policy-map type inspect ccp-inspect
  class type inspect ccp-invalid-src
   drop log
  class type inspect ccp-protocol-http
   inspect
   service-policy http ccp-action-app-http
  class type inspect ccp-protocol-imap
   inspect
   service-policy imap ccp-action-imap
  class type inspect ccp-protocol-pop3
   inspect
   service-policy pop3 ccp-action-pop3
  class type inspect ccp-protocol-im
   inspect
   service-policy im ccp-action-app-im
  class type inspect ccp-insp-traffic
   inspect
  class type inspect CCP-Voice-permit
   inspect
  class class-default
   pass
policy-map type inspect ccp-permit
  class type inspect sdm-access
   inspect
  class class-default
!
zone security out-zone
zone security in-zone
zone-pair security ccp-zp-self-out source self destination out-zone
  service-policy type inspect ccp-permit-icmpreply zone-pair security ccp-zp-in-out source in-zone destination out-zone
  service-policy type inspect ccp-inspect zone-pair security ccp-zp-out-self source out-zone destination self
  service-policy type inspect ccp-permit zone-pair security sdm-zp-NATOutsideToInside-1 source out-zone destination in-zo ne
  service-policy type inspect sdm-pol-NATOutsideToInside-1 !
!
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
  description $ES_WAN$$FW_OUTSIDE$
  ip address 70.46.31.194 255.255.255.252
  no ip redirects
  no ip unreachables
  no ip proxy-arp
  ip nat outside
  ip virtual-reassembly
  zone-member security out-zone
  ip route-cache flow
  duplex auto
  speed auto
!
interface Vlan1
  description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$ES_LAN$$FW_INSIDE$
  ip address 192.168.1.1 255.255.255.0
  no ip redirects
  no ip unreachables
  no ip proxy-arp
  ip nat inside
  ip virtual-reassembly
  zone-member security in-zone
  ip route-cache flow
  ip tcp adjust-mss 1452
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 70.46.31.193
!
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000 ip nat inside source static udp 192.168.1.10 500 interface FastEthernet4 500 ip nat inside source static tcp 192.168.1.10 3389 interface FastEthernet4 3389 ip nat inside source list 105 interface FastEthernet4 overload ip nat inside source static tcp 192.168.1.10 1723 70.46.31.194 1723 extendable !
ip access-list extended SDM_HTTPS
  remark CCP_ACL Category=1
  permit tcp any any eq 443
ip access-list extended SDM_SHELL
  remark CCP_ACL Category=1
  permit tcp any any eq cmd
ip access-list extended SDM_SSH
  remark CCP_ACL Category=1
  permit tcp any any eq 22
!
logging trap debugging
access-list 105 permit ip any any
no cdp run
!
!
!
control-plane
!
banner exec ^C
% Password expiration warning.
-----------------------------------------------------------------------
 
Cisco Configuration Professional (Cisco CP) is installed on this device and it provides the default username "cisco" for  one-time use. If you have already used the username "cisco" to login to the router and your IOS image supports the "one-time" user option, then this username has already expired.
You will not be able to login to the router with this username after you exit this session.
 
It is strongly suggested that you create a new username with a privilege level of 15 using the following command.
 
username <myuser> privilege 15 secret 0 <mypassword>
 
Replace <myuser> and <mypassword> with the username and password you want to use.
 
-----------------------------------------------------------------------
^C
banner login ^CAuthorized access only!
  Disconnect IMMEDIATELY if you are not an authorized user!^C !
line con 0
  login local
  no modem enable
  transport output telnet
line aux 0
  login local
  transport output telnet
line vty 0 4
  privilege level 15
  password 7 00141C5F544A1C545E
  login
  transport input telnet ssh
!
scheduler max-task-time 5000
scheduler allocate 4000 1000
scheduler interval 500
end
 
StMarkCisco#

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119:
120:
121:
122:
123:
124:
125:
126:
127:
128:
129:
130:
131:
132:
133:
134:
135:
136:
137:
138:
139:
140:
141:
142:
143:
144:
145:
146:
147:
148:
149:
150:
151:
152:
153:
154:
155:
156:
157:
158:
159:
160:
161:
162:
163:
164:
165:
166:
167:
168:
169:
170:
171:
172:
173:
174:
175:
176:
177:
178:
179:
180:
181:
182:
183:
184:
185:
186:
187:
188:
189:
190:
191:
192:
193:
194:
195:
196:
197:
198:
199:
200:
201:
202:
203:
204:
205:
206:
207:
208:
209:
210:
211:
212:
213:
214:
215:
216:
217:
218:
219:
220:
221:
222:
223:
224:
225:
226:
227:
228:
229:
230:
231:
232:
233:
234:
235:
236:
237:
238:
239:
240:
241:
242:
243:
244:
245:
246:
247:
248:
249:
250:
251:
252:
253:
254:
255:
256:
257:
258:
259:
260:
261:
262:
263:
264:
265:
266:
267:
268:
269:
270:
271:
272:
273:
274:
275:
276:
277:
278:
279:
280:
281:
282:
283:

Select all Open in new window

by: mikecrPosted on 2009-08-20 at 09:08:55ID: 25144227

I don't see any of the access lists on this config, put them back if there missing.

access-list 1 remark INSIDE_IF=Vlan1
access-list 1 remark CCP_ACL Category=2
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 100 remark CCP_ACL Category=128
access-list 100 permit ip host 255.255.255.255 any
access-list 100 permit ip 127.0.0.0 0.255.255.255 any
access-list 100 permit ip 70.46.31.192 0.0.0.3 any
access-list 101 permit tcp any host 70.46.31.194 eq 1723
access-list 101 permit udp any host 70.46.31.194 eq isakmp
access-list 101 permit udp any host 70.46.31.194 eq 1701
access-list 101 permit gre any host 70.46.31.194
access-list 102 remark CCP_ACL Category=128
access-list 102 permit ip any any
access-list 103 remark CCP_ACL Category=0
access-list 103 permit ip any host 192.168.1.10
access-list 104 remark CCP_ACL Category=0
access-list 104 permit ip any host 192.168.1.10
access-list 105 permit ip any any

Can you RDP to the server now? Try "clear ip nat translations *" on the router. Try to VPN or PPTP again. There will be a slight hiccup accessing the internet but it will come back in a few seconds.

I'm almost positive at this point it's the zone security causing your problems.
Try this from your workstation: telnet 70.46.31.194 1723

If you don't get a response, it's definately a zone security problem. Do you happen to have a firewall turned on on the RRAS server?

To test if it's zone security, you'll need to probably be on site but you need to remove the zone statements from both interfaces on the router. Without any security in place, I bet it works. IP inspection can cause some strange things on a router.

by: bbrunningPosted on 2009-08-20 at 09:26:00ID: 25144405

RPD works again. VPN does not, it once again doesn't get pas the ip address. No Verifying username or password or anything. Orginally it was actually getting to verifying username or password. RRAS is only setup for dial in, I never setup a firewall policy for it. I added ip nat inside source static tcp 192.168.1.171 3390 interface fastethernet4 3390 again and I still cannot even RDP into the other computer which is strange also.
Another thing, the VPN physical address is 192.168.1.10 but the internal address is 192.168.1.120 on the server. Should we have changed 1723 to .120 instead?

by: bbrunningPosted on 2009-08-20 at 09:27:04ID: 25144418

I'll go to their office tomorrow, how do I remove the zone statments?
no zone-member security in-zone
and
no zone-member security out-zone ???

by: mikecrPosted on 2009-08-20 at 09:37:00ID: 25144526

Yes, taht will remove the zone statements. Do the inside first and then the outside. The IP of the RRAS server, which you have indicated as 192.168.1.10 should be the correct one since it's the one listening for VPN traffic. However, lets do .120 anyhow.

First though, try this: telnet 70.46.31.194 1723
Then change it by removing the one and adding the new one like this:
no ip nat inside source static tcp 192.168.1.10 1723 70.46.31.194 1723
ip nat inside source static tcp 192.168.1.120 1723 70.46.31.194 1723

Then telnet again to the IP address and see what happens. Do you have DHCP set up on RRAS so that it hands out an IP address to clients or is it pointing to a DHCP server?

by: bbrunningPosted on 2009-08-20 at 09:47:27ID: 25144633

I cannot telnet remotely, locally or from within the ios.
Also, it won't let me delete that nat because it's in use.

by: bbrunningPosted on 2009-08-20 at 09:52:31ID: 25144694

I just have DHCP relay agent on so it uses the servers regular DHCP.

by: mikecrPosted on 2009-08-20 at 09:52:57ID: 25144699

Let the NAT time out and change it later. You can clear NAT on the router but it will cause a small hiccup to users connected to the internet. If you want to do that do: clear ip nat trans *

by: bbrunningPosted on 2009-08-20 at 10:21:07ID: 25144975

I just saw this:
class-map type inspect match-all sdm-nat-pptp-1
match access-group 104
match protocol pptp

match access-group 104, so does that mean for VPN to work, I need to put this:
access-list 101 permit tcp any host 70.46.31.194 eq 1723
access-list 101 permit udp any host 70.46.31.194 eq isakmp
access-list 101 permit udp any host 70.46.31.194 eq 1701
access-list 101 permit gre any host 70.46.31.194

on access-list 104 instead?

by: mikecrPosted on 2009-08-20 at 11:02:06ID: 25145409

No, if you look access group 104 specifies access list 104 which permits anything to 192.168.1.10 so right now it's okay. Unless however the IP needs to be 192.168.1.120 which is the actual IP of the server but you can't change that yet in NAT to work.

by: bbrunningPosted on 2009-08-20 at 14:56:27ID: 25147527

I've been looking over several cisco documents and they all seem to point me in the direction of assigning access-lists to the interfaces for proper NATing. I think tomorrow while I'm there I'll try to create one for what the network needs, which in the long run will suite me since they will be streaming video within the next couple of months.

I'll let you know how it goes.

by: bbrunningPosted on 2009-08-24 at 11:58:29ID: 25171271

Mike, I remeoved the statements: no zone-member security in-zone
and no zone-member security out-zone like you said and now I can RDP into the correct PCs via port and the VPN works!!!!! OMG about time, you were right, something in the zone security was blocking it.

by: mikecrPosted on 2009-08-24 at 12:10:13ID: 25171383

Wheeewww, I was begining to wonder if I was missing something. If you want, firewall inspection on the router can be kinda ugly, you can just use access lists on interfaces for security instead of inspecting the traffic using zones.

by: bbrunningPosted on 2009-08-24 at 12:38:21ID: 25171657

thank you so much for your patience and help! ive learned quite a bit this past week.

by: mikecrPosted on 2009-08-24 at 14:17:51ID: 25172723

No problem, if there is anything that we can help you with in the future, please stop back.

20120131-EE-VQP-002

3 Ways to Join

30-Day Free Trial

For individual users
Instant access to solutions
Ask your tech questions
Start your 30-day Free Trial

Business Accounts

Perfect for organizations
Multiple users
Save over 36%
Create a Business Account

Answer for Membership

Earn free access
Showcase your knowledge
No credit card required
Sign Up to Answer

The Experts

98% positive feedback on 31,087 answers since March 2000. angeliii is a Microsoft Most Valuable Professional for his work with MS SQL Server & Develoment.

He has also proven his knowledge of Visual Basic Programming, PHP Scripting and Oracle Databases.

The Experts

97% positive feedback on 10,752 answers since July 2000. lrmoore has more than 18 years experience in the networking industry.

The six-time Mircosoft MVPs specialties include firewalls, virtual private networking, and network management.

Testimonials

"...and excellent source for support... Kind of like having your very own IT dept." Electriciansnet

Testimonials

"I was apprehensive at signing up at first. However... it has already made my life as an IT administrator much easier." JaCrews

Testimonials

"WOW! You guys have great, active, and knowledgeable people on here." moore50

Business Clients

In the Press

"If you’ve got a question... Experts Exchange can supply an answer.”

In the Press

"...an invaluable aid for both IT professionals and those who require tech support."

In the Press

"where IT professionals provide quick answers on just about any topic"

Business Account Plans

Loading Advertisement...

Question

Cisco 871 cannot get windows VPN tunnel to work

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Need individual assistance?

Our experts are ready to help.

Want to learn from the best?

Read articles from industry experts.

Working on a long term project?

Store your work and research.

What Makes Experts Exchange Unique?

Trusted by the world's most respected brands.

Faithfully serving IT professionals since 1996.

Related Solutions

Free Tech Articles

Cloud Class Webinars

Join the Community

Give a Little. Get a Lot.

Answers

3 Ways to Join

The Experts

The Experts

Testimonials

Testimonials

Testimonials

Business Clients

Business Clients

In the Press

In the Press

In the Press