Advertisement

05.20.2008 at 04:45PM PDT, ID: 23419237
[x]
Attachment Details

Cisco 1841 as VPN Server for Linksys RV082

Asked by maciej_szymanski in Virtual Private Networking (VPN), Network Routers

Tags: , ,

In my company I've got Cisco 1841 (192.168.2.10) configured as VPN Server connected to Linksys RV082 (192.168.2.0) on which I have my whole LAN I want to be able to access through Cisco VPN Client. I am able to get VPN connection from my home remote location, but I cannot ping any LAN machines except Cisco 1841 in Windows. I can also login through SSH to IOS on 192.168.2.10 and when I ping from there all LAN hosts respond fine. I think it is trivial problem to solve but I am begginer and I would be grateful for an exact IOS code to config 1841. show ip route gives me this:

Gateway of last resort is xxx.yyy.zzz.97 to network 0.0.0.0

     xxx.0.0.0/24 is subnetted, 1 subnets
C       xxx.yyy.zzz.0 is directly connected, FastEthernet0/1
     192.168.4.0/32 is subnetted, 1 subnets
S       192.168.4.100 [1/0] via aaa.bbb.51.235
C    192.168.2.0/24 is directly connected, FastEthernet0/0
S*   0.0.0.0/0 [1/0] via xxx.yyy.zzz.97
Start Free Trial 
1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119:
120:
121:
122:
123:
124:
125:
126:
127:
128:
129:
130:
131:
132:
133:
134:
135:
136:
137:
138:
139:
140:
141:
142:
143:
144:
145:
146:
147:
148:
149:
150:
151:
152:
153:
154:
155:
156:
157:
158:
159:
160:
161:
162:
163:
164:
165:
166:
167:
168:
169:
170:
171:
172:
173:
174:
175:
176:
177:
178:
179:
180:
181:
182:
183:
184:
185:
186:
187:
188:
189:
190:
191:
192:
193:
194:
195:
196:
197:
198:
199:
200:
201:
202:
203:
204:
205:
206:
207:
208:
209:
210:
211:
212:
213:
214:
215:
216:
217:
218:
219:
220:
221:
222:
223:
224:

Building configuration...
 
Current configuration : 8781 bytes
!
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname Cisco
!
boot-start-marker
boot-end-marker
!
security authentication failure rate 3 log
security passwords min-length 6
logging buffered 51200 debugging
logging console critical
enable secret 5 xxx
!
aaa new-model
!
!
aaa authentication login default local
aaa authentication login sdm_vpn_xauth_ml_1 local
aaa authorization exec default local 
aaa authorization network sdm_vpn_group_ml_1 local 
!
aaa session-id common
no ip source-route
ip cef
!
!
ip tcp synwait-time 10
!
!
no ip bootp server
no ip domain lookup
ip domain name big5x.com
ip ssh time-out 60
ip ssh authentication-retries 2
!
!
crypto pki trustpoint TP-self-signed-417082025
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-417082025
 revocation-check none
 rsakeypair TP-self-signed-417082025
!
!
crypto pki certificate chain TP-self-signed-417082025
 certificate self-signed 01
  xxxx
  quit
username mszy privilege 15 secret 5 xxx
!
! 
!
crypto isakmp policy 1
 encr 3des
 authentication pre-share
 group 2
!
crypto isakmp client configuration group VPN
 key xxxx
 pool SDM_POOL_1
 netmask 255.255.255.0
!
!
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac 
!
crypto dynamic-map SDM_DYNMAP_1 1
 set transform-set ESP-3DES-SHA 
 reverse-route
!
!
crypto map SDM_CMAP_1 client authentication list sdm_vpn_xauth_ml_1
crypto map SDM_CMAP_1 isakmp authorization list sdm_vpn_group_ml_1
crypto map SDM_CMAP_1 client configuration address respond
crypto map SDM_CMAP_1 65535 ipsec-isakmp dynamic SDM_DYNMAP_1 
!
!
!
interface FastEthernet0/0
 description $ETH-SW-LAUNCH$$INTF-INFO-FE 0$$ES_LAN$$FW_INSIDE$$ETH-LAN$
 ip address 192.168.2.10 255.255.255.0
 ip access-group 100 in
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat inside
 ip virtual-reassembly
 ip route-cache flow
 duplex auto
 speed auto
 no mop enabled
!
interface FastEthernet0/1
 description $ES_WAN$$FW_OUTSIDE$
 ip address xxx.yyy.zzz.103 255.255.255.0
 ip access-group 103 in
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat outside
 ip virtual-reassembly
 ip route-cache flow
 duplex auto
 speed auto
 no mop enabled
 crypto map SDM_CMAP_1
!
ip local pool SDM_POOL_1 192.168.4.100 192.168.4.110
ip route 0.0.0.0 0.0.0.0 xxx.yyy.zzz.97
!
!
ip http server
ip http access-class 2
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
logging trap debugging
access-list 1 remark INSIDE_IF=FastEthernet0/0
access-list 1 remark SDM_ACL Category=2
access-list 1 permit 192.168.2.0 0.0.0.255
access-list 2 remark Auto generated by SDM Management Access feature
access-list 2 remark SDM_ACL Category=1
access-list 2 permit 192.168.4.0 0.0.0.255
access-list 2 permit xxx.yyy.zzz.0 0.0.0.255
access-list 2 permit 192.168.2.0 0.0.0.255
access-list 100 remark Auto generated by SDM Management Access feature
access-list 100 remark SDM_ACL Category=1
access-list 100 permit tcp 192.168.2.0 0.0.0.255 host 192.168.2.10 eq telnet
access-list 100 permit tcp 192.168.2.0 0.0.0.255 host 192.168.2.10 eq 22
access-list 100 permit tcp 192.168.2.0 0.0.0.255 host 192.168.2.10 eq www
access-list 100 permit tcp 192.168.2.0 0.0.0.255 host 192.168.2.10 eq 443
access-list 100 permit tcp 192.168.2.0 0.0.0.255 host 192.168.2.10 eq cmd
access-list 100 deny   tcp any host 192.168.2.10 eq telnet
access-list 100 deny   tcp any host 192.168.2.10 eq 22
access-list 100 deny   tcp any host 192.168.2.10 eq www
access-list 100 deny   tcp any host 192.168.2.10 eq 443
access-list 100 deny   tcp any host 192.168.2.10 eq cmd
access-list 100 deny   udp any host 192.168.2.10 eq snmp
access-list 100 permit ip any any
access-list 101 remark Auto generated by SDM Management Access feature
access-list 101 remark SDM_ACL Category=1
access-list 101 permit ip 192.168.4.0 0.0.0.255 any
access-list 101 permit ip xxx.yyy.zzz.0 0.0.0.255 any
access-list 101 permit ip 192.168.2.0 0.0.0.255 any
access-list 102 remark Auto generated by SDM Management Access feature
access-list 102 remark SDM_ACL Category=1
access-list 102 permit ip 192.168.4.0 0.0.0.255 any
access-list 102 permit ip xxx.yyy.zzz.0 0.0.0.255 any
access-list 102 permit ip 192.168.2.0 0.0.0.255 any
access-list 103 remark Auto generated by SDM Management Access feature
access-list 103 remark SDM_ACL Category=1
access-list 103 permit tcp 192.168.4.0 0.0.0.255 host xxx.yyy.zzz.103 eq telnet
access-list 103 permit tcp 192.168.2.0 0.0.0.255 host xxx.yyy.zzz.103 eq telnet
access-list 103 permit tcp xxx.yyy.zzz.0 0.0.0.255 host xxx.yyy.zzz.103 eq telnet
access-list 103 permit tcp 192.168.4.0 0.0.0.255 host xxx.yyy.zzz.103 eq 22
access-list 103 permit tcp 192.168.2.0 0.0.0.255 host xxx.yyy.zzz.103 eq 22
access-list 103 permit tcp xxx.yyy.zzz.0 0.0.0.255 host xxx.yyy.zzz.103 eq 22
access-list 103 permit tcp 192.168.4.0 0.0.0.255 host xxx.yyy.zzz.103 eq www
access-list 103 permit tcp 192.168.2.0 0.0.0.255 host xxx.yyy.zzz.103 eq www
access-list 103 permit tcp xxx.yyy.zzz.0 0.0.0.255 host xxx.yyy.zzz.103 eq www
access-list 103 permit tcp 192.168.4.0 0.0.0.255 host xxx.yyy.zzz.103 eq 443
access-list 103 permit tcp 192.168.2.0 0.0.0.255 host xxx.yyy.zzz.103 eq 443
access-list 103 permit tcp xxx.yyy.zzz.0 0.0.0.255 host xxx.yyy.zzz.103 eq 443
access-list 103 permit tcp 192.168.4.0 0.0.0.255 host xxx.yyy.zzz.103 eq cmd
access-list 103 permit tcp 192.168.2.0 0.0.0.255 host xxx.yyy.zzz.103 eq cmd
access-list 103 permit tcp xxx.yyy.zzz.0 0.0.0.255 host xxx.yyy.zzz.103 eq cmd
access-list 103 deny   tcp any host xxx.yyy.zzz.103 eq telnet
access-list 103 deny   tcp any host xxx.yyy.zzz.103 eq 22
access-list 103 deny   tcp any host xxx.yyy.zzz.103 eq www
access-list 103 deny   tcp any host xxx.yyy.zzz.103 eq 443
access-list 103 deny   tcp any host xxx.yyy.zzz.103 eq cmd
access-list 103 deny   udp any host xxx.yyy.zzz.103 eq snmp
access-list 103 permit ip host 192.168.4.100 any
access-list 103 permit ip host 192.168.4.101 any
access-list 103 permit ip host 192.168.4.102 any
access-list 103 permit ip host 192.168.4.103 any
access-list 103 permit ip host 192.168.4.104 any
access-list 103 permit ip host 192.168.4.105 any
access-list 103 permit ip host 192.168.4.106 any
access-list 103 permit ip host 192.168.4.107 any
access-list 103 permit ip host 192.168.4.108 any
access-list 103 permit ip host 192.168.4.109 any
access-list 103 permit ip host 192.168.4.110 any
access-list 103 permit udp any host xxx.yyy.zzz.103 eq non500-isakmp
access-list 103 permit udp any host xxx.yyy.zzz.103 eq isakmp
access-list 103 permit esp any host xxx.yyy.zzz.103
access-list 103 permit ahp any host xxx.yyy.zzz.103
access-list 103 permit udp host 195.114.181.130 eq domain any
access-list 103 permit udp host 195.114.161.61 eq domain any
access-list 103 permit ip any any
no cdp run
!
!
!
!
control-plane
!
!
banner login ^CCAuthorized access only!
 Disconnect IMMEDIATELY if you are not an authorized user!^C
!
line con 0
 transport output telnet
line aux 0
 transport output telnet
line vty 0 4
 access-class 101 in
 transport input telnet ssh
line vty 5 15
 access-class 102 in
 transport input telnet ssh
!
scheduler allocate 4000 1000
end
[+][-]05.21.2008 at 02:47PM PDT, ID: 21619305

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]05.22.2008 at 03:21PM PDT, ID: 21628119

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]05.24.2008 at 02:39AM PDT, ID: 21638461

View this solution now by starting your 7-day free trial. Setting up your free trial is quick, easy, and secure. We will return you to this solution, unlocked, when you're done.

 

About this solution

Zones: Virtual Private Networking (VPN), Network Routers
Tags: Cisco, Cisco 1841, 1841
Sign Up Now!
Solution Provided By: cstosgale
Participating Experts: 1
Solution Grade: A
 
 
 
Loading Advertisement...
20080716-EE-VQP-32 / EE_QW_2_20070628