	[x] Posted via EE Mobile
	Search, ask, and monitor your questions on the go with EE Mobile. Visit Experts Exchange from your mobile device and never be out of touch again.

Question

	[x] Attachment Details

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

9.2

Cisco

Asked by JonDempsey in Network Routers, Virtual Private Networking (VPN)

Tags: Cisco, 800 Series, 850, Identical equipment at both sites

I am having problems connecting two sites using SDM to create a VPN link.

I have set up routers using SDM at both head office and the branch office and attempted connection using the VPN wizard. The Test Connection utility tells me that the VPN is up and working and I can connect to the remote router using it's local address.
However, I cannot see any machines at the other end of the tunnel.
To add, I will need to connect to two NAT'd servers at Head Office.

According to the Cisco documentation, creating a VPN after creating the firewall should make all the necessary modifications.

Any assistance would be appreciated

View the Solution FREE for 30 Days

         
           
             1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119:
120:
121:
122:
123:
124:
125:
126:
127:
128:
129:
130:
131:
132:
133:
134:
135:
136:
137:
138:
139:
140:
141:
142:
143:
144:
145:
146:
147:
148:
149:
150:
151:
152:
153:
154:
155:
156:
157:
158:
159:
160:
161:
162:
163:
164:
165:
166:
167:
168:
169:
170:
171:
172:
173:
174:
175:
176:
177:
178:
179:
180:
181:
182:
183:
184:
185:
186:
187:
188:
189:
190:
191:
192:
193:
194:
195:
196:
197:
198:
199:
200:
201:
202:
203:
204:
205:
206:
207:
208:
209:
210:
211:
212:
213:
214:
215:
216:
217:
218:
219:
220:
221:
222:
223:
224:
225:
226:
227:
228:
229:
230:
231:
232:
233:
234:
235:
236:
237:
238:
239:
240:
241:
242:
243:
244:
245:
246:
247:
248:
249:
250:
251:
252:
253:
254:
255:
256:
257:
258:
259:
260:
261:
262:
263:
264:
265:
266:
267:
268:
269:
270:
271:
272:
273:
274:
275:
276:
277:
278:
279:
280:
281:
282:
283:
284:
285:
286:
287:
288:
289:
290:
291:
292:
293:
294:
295:
296:
297:
298:
299:
300:
301:
302:
303:
304:
305:
306:
307:
308:
309:
310:
311:
312:
313:
314:
315:
316:
317:
318:
319:
320:
321:
322:
323:
324:
325:
326:
327:
328:
329:
330:
331:
332:
333:
334:
335:
336:
337:
338:
339:
340:
341:
342:
343:
344:
345:
346:
347:
348:
349:
350:
351:
352:
353:
354:
355:
356:
357:
358:
359:
360:
361:
362:
363:
364:
365:
366:
367:
368:
369:
370:
371:
372:
373:
374:
375:
376:
377:
378:
379:
380:
381:
382:
383:
384:
385:
386:
387:
388:
389:
390:
391:
392:
393:
394:
395:
396:
397:
398:
399:
400:
401:
402:
403:
404:
405:
406:
407:
408:
409:
410:
411:
412:
413:
414:
415:
416:
417:
418:
419:
420:
421:
422:
423:
424:
425:
426:
427:
428:
429:
430:
431:
432:
433:
434:
435:
436:
437:
438:
439:
440:
441:
442:
443:
444:
445:
446:
447:
448:
449:
450:
451:
452:
453:
454:
455:
456:
457:
458:
459:
460:
461:

           
           
             Head Office Script
 
!This is the running config of the router: 192.168.1.170
!----------------------------------------------------------------------------
!version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname yourname
!
boot-start-marker
boot-end-marker
!
logging buffered 52000 debugging
!
no aaa new-model
!
resource policy
!
!
!
ip cef
ip inspect name SDM_LOW cuseeme
ip inspect name SDM_LOW dns
ip inspect name SDM_LOW ftp
ip inspect name SDM_LOW h323
ip inspect name SDM_LOW https
ip inspect name SDM_LOW icmp
ip inspect name SDM_LOW imap
ip inspect name SDM_LOW pop3
ip inspect name SDM_LOW rcmd
ip inspect name SDM_LOW realaudio
ip inspect name SDM_LOW rtsp
ip inspect name SDM_LOW esmtp
ip inspect name SDM_LOW sqlnet
ip inspect name SDM_LOW streamworks
ip inspect name SDM_LOW tftp
ip inspect name SDM_LOW tcp
ip inspect name SDM_LOW udp
ip inspect name SDM_LOW vdolive
ip domain name yourdomain.com
ip name-server 158.43.240.3
ip name-server 158.43.240.4
!
!
crypto pki trustpoint TP-self-signed-81106416
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-81106416
 revocation-check none
 rsakeypair TP-self-signed-81106416
!
!
crypto pki certificate chain TP-self-signed-81106416
 certificate self-signed 01
  3082024B 308201B4 A0030201 02020101 300D0609 2A864886 F70D0101 04050030 
  2F312D30 2B060355 04031324 494F532D 53656C66 2D536967 6E65642D 43657274 
  69666963 6174652D 38313130 36343136 301E170D 30323033 30313030 31363138 
  5A170D32 30303130 31303030 3030305A 302F312D 302B0603 55040313 24494F53 
  2D53656C 662D5369 676E6564 2D436572 74696669 63617465 2D383131 30363431 
  3630819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281 8100DD83 
  235386D4 BEA5B9B9 C8E8486E 46343544 B61D6B7C CF2C31B6 A88C16C7 12015919 
  1AE70373 116D5A1A 9B838906 8F495243 7A0655A6 35230557 C8DE02E9 2DC9E6AE 
  847D0F28 A18B0D49 B6B0FEFC 8A34D59D E8C531A0 EDAE59D4 609AD6D5 8827B153 
  8475B496 29DDDA0F 0A4A0FDB 89EAF82C 2842BAFF 5F6E571E BDD8477F 6C010203 
  010001A3 77307530 0F060355 1D130101 FF040530 030101FF 30220603 551D1104 
  1B301982 17796F75 726E616D 652E796F 7572646F 6D61696E 2E636F6D 301F0603 
  551D2304 18301680 14359711 CFC952DF 0FF6C620 A965AB76 495CEB10 08301D06 
  03551D0E 04160414 359711CF C952DF0F F6C620A9 65AB7649 5CEB1008 300D0609 
  2A864886 F70D0101 04050003 818100A7 C5C067B0 634076B7 DDE1D2CE 8552DD79 
  1F3BB8CE DC6E4A26 083E2C40 5A28623D 6B4FBD1D 2FD77575 5F27EF7B 62EE5E80 
  9E6B73E9 6E420D63 C64C530A B1CF4244 634BA75E A52EBBF0 D84808AD BB088D65 
  69CDAA5D 1E2C67EB DA2E6EA6 3FD6A850 8762944F 344E28E5 B5986760 79154FAF 
  0F6CA62D 856B1300 1E527938 9A8797
  quit
username Admin privilege 15 secret 5 $1$iJs9$qCarito4/ta6xqQf4g3e5.
!
! 
!
crypto isakmp policy 1
 encr 3des
 authentication pre-share
 group 2
crypto isakmp key BootOfItaly address 81.86.229.6
!
!
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac 
!
crypto map SDM_CMAP_1 1 ipsec-isakmp 
 description Tunnel to81.86.229.6
 set peer 81.86.229.6
 set transform-set ESP-3DES-SHA 
 match address 102
!
!
!
interface ATM0
 no ip address
 no atm ilmi-keepalive
 dsl operating-mode auto 
!
interface ATM0.1 point-to-point
 no snmp trap link-status
 pvc 0/38 
  encapsulation aal5mux ppp dialer
  dialer pool-member 1
 !
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface Vlan1
 description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$FW_INSIDE$
 ip address 192.168.1.170 255.255.255.0
 ip access-group 100 in
 ip nat inside
 ip virtual-reassembly
 ip tcp adjust-mss 1452
!
interface Dialer0
 description $FW_OUTSIDE$
 ip address 81.178.60.206 255.255.255.248
 ip access-group 101 in
 ip inspect SDM_LOW out
 ip nat outside
 ip virtual-reassembly
 encapsulation ppp
 dialer pool 1
 dialer-group 1
 no cdp enable
 ppp authentication chap callin
 ppp chap hostname aufn23@xtreme4.pipex.net
 ppp chap password 0 oohiabez
 crypto map SDM_CMAP_1
!
ip route 0.0.0.0 0.0.0.0 Dialer0
!
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source list 110 interface Vlan1 overload
ip nat inside source route-map SDM_RMAP_1 interface Dialer0 overload
ip nat inside source static 192.168.1.144 81.178.60.202
ip nat inside source static 192.168.1.140 81.178.60.203
!
access-list 1 remark INSIDE_IF=Vlan1
access-list 1 remark SDM_ACL Category=2
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 100 remark auto generated by SDM firewall configuration
access-list 100 remark SDM_ACL Category=1
access-list 100 deny   ip 81.178.60.200 0.0.0.7 any
access-list 100 deny   ip host 255.255.255.255 any
access-list 100 deny   ip 127.0.0.0 0.255.255.255 any
access-list 100 permit ip any any
access-list 101 remark auto generated by SDM firewall configuration
access-list 101 remark SDM_ACL Category=1
access-list 101 permit ip host 81.86.229.6 any
access-list 101 remark IPSec Rule
access-list 101 permit ip 192.168.3.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 101 permit udp host 81.86.229.6 host 81.178.60.206 eq non500-isakmp
access-list 101 permit udp host 81.86.229.6 host 81.178.60.206 eq isakmp
access-list 101 permit esp host 81.86.229.6 host 81.178.60.206
access-list 101 permit ahp host 81.86.229.6 host 81.178.60.206
access-list 101 permit udp host 158.43.240.4 eq domain host 81.178.60.206
access-list 101 permit udp host 158.43.240.3 eq domain host 81.178.60.206
access-list 101 deny   ip 192.168.1.0 0.0.0.255 any
access-list 101 permit icmp any host 81.178.60.206 echo-reply
access-list 101 permit icmp any host 81.178.60.206 time-exceeded
access-list 101 permit icmp any host 81.178.60.206 unreachable
access-list 101 deny   ip 10.0.0.0 0.255.255.255 any
access-list 101 deny   ip 172.16.0.0 0.15.255.255 any
access-list 101 deny   ip 192.168.0.0 0.0.255.255 any
access-list 101 deny   ip 127.0.0.0 0.255.255.255 any
access-list 101 deny   ip host 255.255.255.255 any
access-list 101 deny   ip host 0.0.0.0 any
access-list 101 deny   ip any any log
access-list 102 remark SDM_ACL Category=4
access-list 102 remark IPSec Rule
access-list 102 permit ip 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255
access-list 103 remark SDM_ACL Category=2
access-list 103 remark IPSec Rule
access-list 103 deny   ip 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255
access-list 103 permit ip 192.168.1.0 0.0.0.255 any
access-list 110 deny   ip 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255
access-list 110 permit ip 192.168.1.0 0.0.0.255 any
access-list 120 deny   ip host 192.168.1.140 192.168.3.0 0.0.0.255
access-list 120 deny   ip host 192.168.1.144 192.168.3.0 0.0.0.255
access-list 120 permit ip host 192.168.1.140 any
access-list 120 permit ip host 192.168.1.144 any
dialer-list 1 protocol ip permit
no cdp run
route-map SDM_RMAP_1 permit 1
 match ip address 103
!
route-map nonat permit 10
 match ip address 120
!
!
control-plane
!
banner login ^C
-----------------------------------------------------------------------
Cisco Router and Security Device Manager (SDM) is installed on this device. 
This feature requires the one-time use of the username "cisco" 
with the password "cisco". The default username and password have a privilege level of 15.
 
Please change these publicly known initial credentials using SDM or the IOS CLI. 
Here are the Cisco IOS commands.
 
username <myuser>  privilege 15 secret 0 <mypassword>
no username cisco
 
Replace <myuser> and <mypassword> with the username and password you want to use. 
 
For more information about SDM please follow the instructions in the QUICK START 
GUIDE for your router or go to http://www.cisco.com/go/sdm 
-----------------------------------------------------------------------
^C
!
line con 0
 login local
 no modem enable
line aux 0
line vty 0 4
 privilege level 15
 login local
 transport input telnet ssh
!
scheduler max-task-time 5000
end
 
 
Branch Script
 
!This is the running config of the router: 192.168.3.170
!----------------------------------------------------------------------------
!version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname yourname
!
boot-start-marker
boot-end-marker
!
logging buffered 52000 debugging
!
no aaa new-model
!
resource policy
!
!
!
ip cef
ip inspect name SDM_LOW cuseeme
ip inspect name SDM_LOW dns
ip inspect name SDM_LOW ftp
ip inspect name SDM_LOW h323
ip inspect name SDM_LOW https
ip inspect name SDM_LOW icmp
ip inspect name SDM_LOW imap
ip inspect name SDM_LOW pop3
ip inspect name SDM_LOW rcmd
ip inspect name SDM_LOW realaudio
ip inspect name SDM_LOW rtsp
ip inspect name SDM_LOW esmtp
ip inspect name SDM_LOW sqlnet
ip inspect name SDM_LOW streamworks
ip inspect name SDM_LOW tftp
ip inspect name SDM_LOW tcp
ip inspect name SDM_LOW udp
ip inspect name SDM_LOW vdolive
ip domain name yourdomain.com
ip name-server 158.152.1.43
ip name-server 158.152.1.58
!
!
crypto pki trustpoint TP-self-signed-2988032477
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-2988032477
 revocation-check none
 rsakeypair TP-self-signed-2988032477
!
!
crypto pki certificate chain TP-self-signed-2988032477
 certificate self-signed 01
  3082024F 308201B8 A0030201 02020101 300D0609 2A864886 F70D0101 04050030 
  31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274 
  69666963 6174652D 32393838 30333234 3737301E 170D3032 30333031 30313031 
  31325A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649 
  4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D32 39383830 
  33323437 3730819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281 
  8100DAE0 6AE9D44E 617D7E07 35722433 85192113 1143C31F 11A71E5D C9364248 
  DCABECF8 EA61BFC1 D6AE1C2D E649C568 5DC535A4 57F6AA9C FC1D1018 FB40957E 
  7AE705FF 78AAE6D1 D8B115B5 5C42315B 966601AF A9054CA8 054B2493 E8637F7B 
  7F326E78 CBE409C2 E3743B12 99409F3F B3EB3178 38210F5F 474F02AA 2217E8E1 
  B2690203 010001A3 77307530 0F060355 1D130101 FF040530 030101FF 30220603 
  551D1104 1B301982 17796F75 726E616D 652E796F 7572646F 6D61696E 2E636F6D 
  301F0603 551D2304 18301680 14EF651E AE2252E5 D82E6484 4D07BF6D 97C02AC2 
  17301D06 03551D0E 04160414 EF651EAE 2252E5D8 2E64844D 07BF6D97 C02AC217 
  300D0609 2A864886 F70D0101 04050003 818100B8 EC769ADA 2336BB2E 28C39666 
  FDAFE1D4 720B8311 AE70F183 9F760F06 9984D157 CE2C93FF 66D56F7C C80E80CA 
  5C3AEEBD 2B48B278 51F57BC8 FBC6787E A617B711 E0F3BEBE 463A4ADC BCD2A85E 
  B2592EB6 E1CCD1CE DBDB3876 E94F19A6 030BEC3E 7071D64C 08EC630D 7EFB16EF 
  2D45B7C4 53248869 5AD3175E 36D4C96B 65F142
  quit
username admin privilege 15 secret 5 $1$RiGB$LjPsePQS2/yE1E2lyl5z6/
!
! 
!
crypto isakmp policy 1
 encr 3des
 authentication pre-share
 group 2
crypto isakmp key BootOfItaly address 81.178.60.206
!
!
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac 
!
crypto map SDM_CMAP_1 1 ipsec-isakmp 
 description Tunnel to81.178.60.206
 set peer 81.178.60.206
 set transform-set ESP-3DES-SHA 
 match address 102
!
!
!
interface ATM0
 no ip address
 no atm ilmi-keepalive
 dsl operating-mode auto 
!
interface ATM0.1 point-to-point
 no snmp trap link-status
 pvc 0/38 
  encapsulation aal5mux ppp dialer
  dialer pool-member 1
 !
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface Vlan1
 description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$FW_INSIDE$
 ip address 192.168.3.170 255.255.255.0
 ip access-group 100 in
 ip nat inside
 ip virtual-reassembly
 ip tcp adjust-mss 1452
!
interface Dialer0
 description $FW_OUTSIDE$
 ip address 81.86.229.6 255.255.255.248
 ip access-group 101 in
 ip inspect SDM_LOW out
 ip nat outside
 ip virtual-reassembly
 encapsulation ppp
 dialer pool 1
 dialer-group 1
 no cdp enable
 ppp authentication chap pap callin
 ppp chap hostname axqa85@xtreme5.pipex.net
 ppp chap password 0 tivivida
 ppp pap sent-username axqa85@xtreme5.pipex.net password 0 tivivida
 crypto map SDM_CMAP_1
!
ip route 0.0.0.0 0.0.0.0 Dialer0
!
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source route-map SDM_RMAP_1 interface Dialer0 overload
!
access-list 1 remark INSIDE_IF=Vlan1
access-list 1 remark SDM_ACL Category=2
access-list 1 permit 192.168.3.0 0.0.0.255
access-list 100 remark auto generated by SDM firewall configuration
access-list 100 remark SDM_ACL Category=1
access-list 100 deny   ip 81.86.229.0 0.0.0.7 any
access-list 100 deny   ip host 255.255.255.255 any
access-list 100 deny   ip 127.0.0.0 0.255.255.255 any
access-list 100 permit ip any any
access-list 101 remark auto generated by SDM firewall configuration
access-list 101 remark SDM_ACL Category=1
access-list 101 permit ip host 81.178.60.206 any
access-list 101 permit ahp host 81.178.60.206 host 81.86.229.6
access-list 101 permit esp host 81.178.60.206 host 81.86.229.6
access-list 101 permit udp host 81.178.60.206 host 81.86.229.6 eq isakmp
access-list 101 permit udp host 81.178.60.206 host 81.86.229.6 eq non500-isakmp
access-list 101 remark IPSec Rule
access-list 101 permit ip 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255
access-list 101 permit udp host 81.178.60.206 host 81.86.229.1 eq non500-isakmp
access-list 101 permit udp host 81.178.60.206 host 81.86.229.1 eq isakmp
access-list 101 permit esp host 81.178.60.206 host 81.86.229.1
access-list 101 permit ahp host 81.178.60.206 host 81.86.229.1
access-list 101 permit udp host 158.152.1.58 eq domain host 81.86.229.1
access-list 101 permit udp host 158.152.1.43 eq domain host 81.86.229.1
access-list 101 permit icmp any host 81.86.229.1 echo-reply
access-list 101 permit icmp any host 81.86.229.1 time-exceeded
access-list 101 permit icmp any host 81.86.229.1 unreachable
access-list 102 remark SDM_ACL Category=4
access-list 102 remark IPSec Rule
access-list 102 permit ip 192.168.3.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 103 remark SDM_ACL Category=2
access-list 103 remark IPSec Rule
access-list 103 deny   ip 192.168.3.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 103 permit ip 192.168.3.0 0.0.0.255 any
dialer-list 1 protocol ip permit
no cdp run
route-map SDM_RMAP_1 permit 1
 match ip address 103
!
!
control-plane
!
banner login ^C
-----------------------------------------------------------------------
Cisco Router and Security Device Manager (SDM) is installed on this device. 
This feature requires the one-time use of the username "cisco" 
with the password "cisco". The default username and password have a privilege level of 15.
 
Please change these publicly known initial credentials using SDM or the IOS CLI. 
Here are the Cisco IOS commands.
 
username <myuser>  privilege 15 secret 0 <mypassword>
no username cisco
 
Replace <myuser> and <mypassword> with the username and password you want to use. 
 
For more information about SDM please follow the instructions in the QUICK START 
GUIDE for your router or go to http://www.cisco.com/go/sdm 
-----------------------------------------------------------------------
^C
!
line con 0
 login local
 no modem enable
line aux 0
line vty 0 4
 privilege level 15
 login local
 transport input telnet ssh
!
scheduler max-task-time 5000
end

           
         

	Title
1	Cisco 877 change SDM Secure acce…
2	Cisco 1811 Site to Site - VPN up b…
3	Cisco 837 ADSL Router: Adding Ro…
4	Cisco Router and IPSEC Tunnel Configu…
5	CISCO VPN SITE-TO-SITE TRAFFIC P…
6	Basic Router Config / Cisco 800 Se…

Cisco

Asked by JonDempsey in Network Routers, Virtual Private Networking (VPN)

Tags: Cisco, 800 Series, 850, Identical equipment at both sites

About this solution