Hi,
Here is my setup:
internet (84.x.x.x) Adsl WIC atm0/0 module in the router below with a static ip from my isp
|
|
|
router cisco 2621
| f0/0 192.168.1.1 (all traffic gets routed out this interface for the internet)
|
|
firewall pix 515e
| e0 outside 192.168.1.2 e1 inside 192.168.2.1 (physical interface)
| e1.3 inside 192.168.3.1 vlan 3 (logical interface)
|
switch 2950 (port 24, 192.168.2.2 trunks to e1 inside of pix 192.168.2.1)
| port 2 assigned to vlan3 192.168.3.1
|
|
my computer (me connected to port 2 on switch - vlan3 on 192.168.3.2)
The above setup works where i can get out to the internet and so on.
What I would like to now achieve with your help is to connect to my computer from the outside world using cisco vpn client. Now I have one static ip (84.x.x.x) which is allocated to the dailer interface on the adsl wic of my router.
Would the above setup require additional static ip's - one for f0/0 on the router and another for e0 (outside) on the pix - note the pix is running version 7.2 ios. I look forward to hear from what you experts out there on EE have to say. Thanks in Advance.
I have attached my config:
router
**************************
**********
**********
**********
**********
**********
**********
**********
******
version 12.2
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R5
!
logging queue-limit 100
!
ip subnet-zero
!
!
ip dhcp excluded-address 192.168.2.1
ip dhcp excluded-address 192.168.1.1
ip dhcp excluded-address 192.168.3.1
ip dhcp excluded-address 192.168.4.1
!
ip dhcp pool pool
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1
dns-server 83.146.21.6 212.158.249.5
!
ip cef
mpls ldp logging neighbor-changes
!
!
no voice hpi capture buffer
no voice hpi capture destination
!
!
mta receive maximum-recipients 0
!
!
interface ATM0/0
no ip address
no ip route-cache
no ip mroute-cache
no atm ilmi-keepalive
dsl operating-mode auto
!
interface ATM0/0.1 point-to-point
no ip route-cache
no ip mroute-cache
pvc 0/38
encapsulation aal5mux ppp dialer
dialer pool-member 1
!
!
interface FastEthernet0/0
ip address 192.168.1.1 255.255.255.0
ip nat inside
duplex auto
speed auto
!
interface FastEthernet0/0.3
encapsulation dot1Q 3
ip address 192.168.3.1 255.255.255.0
ip nat inside
!
interface FastEthernet0/0.4
encapsulation dot1Q 4
ip address 192.168.4.1 255.255.255.0
ip nat inside
!
interface Serial0/0
no ip address
shutdown
!
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
interface Serial0/1
no ip address
shutdown
!
interface Dialer1
ip address 84.x.x.x 255.0.0.0
ip nat outside
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication chap callin
ppp chap hostname xxxxx
ppp chap password 0 xxxxx
!
ip nat inside source list 1 interface Dialer1 overload
no ip http server
ip classless
ip route 0.0.0.0 0.0.0.0 Dialer1
!
!
!
access-list 1 permit 192.168.2.0 0.0.0.255
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 1 permit 192.168.3.0 0.0.0.255
access-list 1 permit 192.168.4.0 0.0.0.255
dialer-list 1 protocol ip permit
!
!
call rsvp-sync
!
!
mgcp profile default
!
!
!
dial-peer cor custom
!
!
line con 0
line aux 0
line vty 0 4
login
!
!
end
**************************
**********
**********
**********
**********
**********
**********
**********
******
firewall
**************************
**********
**********
**********
**********
**********
**********
**********
******
PIX Version 7.2(2)
!
hostname FW1
enable password 8Ry2YjIyt7RRXU24 encrypted
names
dns-guard
!
interface Ethernet0
nameif outside
security-level 0
ip address 192.168.1.2 255.255.255.0
!
interface Ethernet1
nameif inside
security-level 100
ip address 192.168.2.1 255.255.255.0
!
interface Ethernet1.3
vlan 3
nameif Imran
security-level 100
ip address 192.168.3.1 255.255.255.0
!
interface Ethernet1.4
vlan 4
nameif Saira
security-level 100
ip address 192.168.4.1 255.255.255.0
!
passwd 2KFQnbNIdI.2KYOU encrypted
boot system flash:/image.bin
ftp mode passive
clock timezone GMT 1 42
dns domain-lookup outside
dns domain-lookup inside
same-security-traffic permit intra-interface
access-list acl-inside extended permit ip any any
access-list no-nat-vpn1-group extended permit ip 192.168.3.0 255.255.255.0 192.168.3.0 255.255.255.0
access-list acl-outside extended deny ip any any
access-list SPLIT-Tunnel-vpn1group standard permit 192.168.3.0 255.255.255.0
access-list acl-out extended permit icmp any any
pager lines 24
logging enable
logging timestamp
logging buffered debugging
logging trap debugging
mtu outside 1500
mtu inside 1500
mtu Imran 1500
mtu Saira 1500
ip local pool user1 192.168.3.10-192.168.3.15 mask 255.255.255.0
ip verify reverse-path interface outside
ip verify reverse-path interface inside
icmp unreachable rate-limit 1 burst-size 1
asdm history enable
arp timeout 14400
nat-control
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
nat (Imran) 0 access-list no-nat-vpn1-group
nat (Imran) 1 192.168.3.0 255.255.255.0
nat (Saira) 1 192.168.4.0 255.255.255.0
static (inside,outside) 192.168.1.2 192.168.2.1 netmask 255.255.255.255
access-group acl-out in interface outside
route outside 0.0.0.0 0.0.0.0 192.168.1.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
group-policy vpn1 internal
group-policy vpn1 attributes
split-tunnel-policy tunnelspecified
split-tunnel-network-list value SPLIT-Tunnel-vpn1group
username vpn1 password Rgp2OnMV8tB9079o encrypted
http server enable
no snmp-server location
no snmp-server contact
snmp-server community public
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set my-set esp-aes-256 esp-sha-hmac
crypto dynamic-map dynmap 10 set transform-set my-set
crypto dynamic-map dynmap 10 set reverse-route
crypto map mymap 10 ipsec-isakmp dynamic dynmap
crypto map mymap interface outside
crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 86400
crypto isakmp nat-traversal 20
tunnel-group vpn1 type ipsec-ra
tunnel-group vpn1 general-attributes
address-pool user1
default-group-policy vpn1
tunnel-group vpn1 ipsec-attributes
pre-shared-key *
telnet timeout 5
ssh timeout 5
ssh version 1
console timeout 0
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns migrated_dns_map_1
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns migrated_dns_map_1
inspect ftp
inspect h323 h225
inspect h323 ras
inspect http
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
inspect pptp
!
service-policy global_policy global
ssl encryption des-sha1 rc4-md5
prompt hostname context
Cryptochecksum:fe3a24b5e31
f952bc5a3a
708b11c790
9
: end
**************************
**********
**********
**********
**********
**********
**********
**********
******
switch
**************************
**********
**********
**********
**********
**********
**********
**********
******
version 12.1
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname SW1
!
!
ip subnet-zero
!
!
spanning-tree mode pvst
no spanning-tree optimize bpdu transmission
spanning-tree extend system-id
!
!
interface FastEthernet0/1
!
interface FastEthernet0/2
description Imran PC
switchport access vlan 3
switchport trunk allowed vlan 3
switchport mode access
no snmp trap link-status
no cdp enable
spanning-tree portfast
!
interface FastEthernet0/3
description Saira PC
switchport access vlan 4
switchport trunk allowed vlan 4
switchport mode access
no snmp trap link-status
no cdp enable
spanning-tree portfast
!
.
.
.
!
interface FastEthernet0/24
switchport trunk allowed vlan 1-4
switchport mode trunk
!
interface Vlan1
ip address 192.168.2.2 255.255.255.0
no ip route-cache
!
ip default-gateway 192.168.2.1
ip http server
access-list 1 permit 192.168.1.0
access-list 1 permit 192.168.2.0
access-list 1 permit 192.168.3.0
access-list 1 permit 192.168.4.0
!
line con 0
line vty 5 15
!
!
end
**************************
**********
**********
**********
**********
**********
**********
**********
******
Start Free Trial
