Guygox
asked on
2 Cisco, vpn problem, can't access ressources from remote lan
I have two cisco : one 827 and one 1721
The 1721 must be the endpoint router and the 827 is conencted to the Internet. My problem is I can't access ressources by VPN, at the endpoint I can't ping the remote lan...I don t know how to do.
Another thing : on the cisco client if I check "enable tranpsarent tunneling", I can't connect (I m not asked to enter my login/password). I'd like this fonction to be enabled to pass through an ISA server that I will deploy.
HEre are my configurations :
C827 :
version 12.3
no service pad
service tcp-keepalives-in
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
service tcp-small-servers
!
hostname GoXi
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$8PzU$AJ5B7lTOrvOtDhS51R
!
username Tanguy privilege 15 password 7 03305A05011A38
clock summer-time GMT+01:00 recurring last Sun Mar 2:00 last Sun Oct 3:00
aaa new-model
!
!
aaa session-id common
ip subnet-zero
no ip source-route
ip tcp selective-ack
ip tcp path-mtu-discovery
ip domain name PLACE
ip name-server 10.0.0.253
ip dhcp excluded-address 10.0.0.100 10.0.0.254
!
no ip bootp server
ip cef
!
!
!
no crypto isakmp enable
!
!
!
interface Ethernet0
ip address 192.168.1.1 255.255.255.0
ip verify unicast reverse-path
no ip proxy-arp
ip nat inside
no cdp enable
hold-queue 100 out
!
interface ATM0
no ip address
no atm ilmi-keepalive
dsl operating-mode auto
pvc 8/35
encapsulation aal5mux ppp dialer
dialer pool-member 1
!
!
interface Dialer1
mtu 1492
ip address negotiated
ip verify unicast reverse-path
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
encapsulation ppp
dialer pool 1
dialer-group 1
no cdp enable
ppp authentication chap pap callin
ppp chap hostname fti/rhXPeP2
ppp chap password 7 14300B0E381D123220
ppp pap sent-username fti/rhXPeP2 password 7 153512093033133D2C
hold-queue 100 out
!
ip nat inside source list 1 interface Dialer1 overload
ip nat inside source static udp 192.168.1.2 10000 interface Ethernet0 10000
ip nat inside source static udp 192.168.1.2 4500 interface Ethernet0 4500
ip nat inside source static tcp 192.168.1.2 1723 interface Dialer1 1723
ip nat inside source static udp 192.168.1.2 1723 interface Dialer1 1723
ip nat inside source static udp 192.168.1.2 500 interface Dialer1 500
ip nat inside source static tcp 192.168.1.2 500 interface Dialer1 500
ip nat inside source static tcp 192.168.1.2 7855 interface Dialer1 7855
ip classless
ip route 0.0.0.0 0.0.0.0 193.253.160.3
ip route 10.0.0.0 255.255.255.0 192.168.1.2
no ip http server
no ip http secure-server
!
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 3 permit 82.225.10.79
access-list 3 permit 10.0.0.0 0.0.0.255
access-list 8 deny 192.168.0.5
access-list 100 deny udp any eq netbios-dgm any
access-list 100 deny udp any eq netbios-ns any
access-list 100 deny udp any eq netbios-ss any
access-list 100 deny tcp any eq discard any
access-list 100 deny tcp any eq chargen any
access-list 100 deny tcp any eq 137 any
access-list 100 deny tcp any eq 138 any
access-list 100 deny tcp any eq 139 any
access-list 100 deny ip 192.168.0.0 0.0.255.255 any
access-list 100 deny ip 10.0.0.0 0.255.255.255 any
access-list 100 deny ip 172.16.0.0 0.15.255.255 any
access-list 100 deny ip 127.0.0.0 0.255.255.255 any
access-list 100 permit ip any any
access-list 101 permit tcp any 10.0.0.0 0.0.0.255
dialer-list 1 protocol ip permit
no cdp run
!
!
line con 0
password 7 09646D1C1E32062203
transport preferred all
transport output all
stopbits 1
speed 115200
line vty 0 4
access-class 3 in
transport preferred all
transport input all
transport output all
!
scheduler max-task-time 5000
end
--------------------------
1721
--------------------------
version 12.3
no service pad
service tcp-keepalives-in
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname 1721
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$b4f/$RtSa/Z0AjmUAjXzB89
!
username Tanguy privilege 15 password 7 07270259493E08351F
username Claude password 7 153E0E29062B32213A
clock timezone France 1
clock summer-time France recurring last Sun Mar 2:00 last Sun Oct 3:00
aaa new-model
!
!
aaa authentication login userauthen local
aaa authorization network groupauthor local
aaa session-id common
ip subnet-zero
!
!
!
!
ip tcp selective-ack
ip tcp path-mtu-discovery
ip domain name PLACE
ip name-server 195.68.0.1
ip cef
ip audit notify log
ip audit po max-events 100
ip ssh break-string
no ftp-server write-enable
no scripting tcl init
no scripting tcl encdir
!
!
!
!
!
crypto isakmp policy 3
hash md5
authentication pre-share
group 2
!
crypto isakmp client configuration group Tanguy
key SnapScan1236
pool Pool-For-Vpn-Client
acl SPLIT
include-local-lan
!
!
crypto ipsec transform-set myset esp-3des esp-md5-hmac
!
crypto dynamic-map dynmap 10
set transform-set myset
!
!
crypto map clientmap client authentication list userauthen
crypto map clientmap isakmp authorization list groupauthor
crypto map clientmap client configuration address initiate
crypto map clientmap client configuration address respond
crypto map clientmap 10 ipsec-isakmp dynamic dynmap
!
!
!
!
interface Ethernet0
ip address 192.168.1.2 255.255.255.0
ip nat outside
half-duplex
no cdp enable
crypto map clientmap
!
interface FastEthernet0
ip address 10.0.0.252 255.255.255.0
ip nat inside
speed auto
no cdp enable
!
ip local pool Pool-For-Vpn-Client 10.10.10.1 10.10.10.10
ip nat inside source static tcp 10.0.0.1 7855 interface Ethernet0 7855
ip nat inside source route-map NoNat interface Ethernet0 overload
ip classless
ip route 0.0.0.0 0.0.0.0 192.168.1.1
no ip http server
no ip http secure-server
!
!
!
ip access-list extended No-Nat-Vpn-Client
deny ip 10.0.0.0 0.0.0.255 10.10.10.0 0.0.0.255
permit ip 10.0.0.0 0.0.0.255 any
ip access-list extended SPLIT
permit ip 10.0.0.0 0.0.0.255 10.10.10.0 0.0.0.255
access-list 1 permit 10.0.0.0 0.0.0.255
access-list 1 permit 192.168.0.0 0.0.0.255
access-list 3 permit 82.225.10.79
access-list 3 permit 10.0.0.0 0.0.0.255
dialer-list 1 protocol ip permit
no cdp run
!
route-map NoNat permit 10
match ip address No-Nat-Vpn-Client
!
!
control-plane
!
!
line con 0
password 7 09646D1C1E32062203
transport preferred all
transport output all
stopbits 1
speed 115200
line aux 0
line vty 0 4
access-class 3 in
transport preferred all
transport input all
transport output all
!
scheduler max-task-time 5000
!
end
--------------------------
So help me please !! and thanks for helping me
The 1721 must be the endpoint router and the 827 is conencted to the Internet. My problem is I can't access ressources by VPN, at the endpoint I can't ping the remote lan...I don t know how to do.
Another thing : on the cisco client if I check "enable tranpsarent tunneling", I can't connect (I m not asked to enter my login/password). I'd like this fonction to be enabled to pass through an ISA server that I will deploy.
HEre are my configurations :
C827 :
version 12.3
no service pad
service tcp-keepalives-in
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
service tcp-small-servers
!
hostname GoXi
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$8PzU$AJ5B7lTOrvOtDhS51R
!
username Tanguy privilege 15 password 7 03305A05011A38
clock summer-time GMT+01:00 recurring last Sun Mar 2:00 last Sun Oct 3:00
aaa new-model
!
!
aaa session-id common
ip subnet-zero
no ip source-route
ip tcp selective-ack
ip tcp path-mtu-discovery
ip domain name PLACE
ip name-server 10.0.0.253
ip dhcp excluded-address 10.0.0.100 10.0.0.254
!
no ip bootp server
ip cef
!
!
!
no crypto isakmp enable
!
!
!
interface Ethernet0
ip address 192.168.1.1 255.255.255.0
ip verify unicast reverse-path
no ip proxy-arp
ip nat inside
no cdp enable
hold-queue 100 out
!
interface ATM0
no ip address
no atm ilmi-keepalive
dsl operating-mode auto
pvc 8/35
encapsulation aal5mux ppp dialer
dialer pool-member 1
!
!
interface Dialer1
mtu 1492
ip address negotiated
ip verify unicast reverse-path
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
encapsulation ppp
dialer pool 1
dialer-group 1
no cdp enable
ppp authentication chap pap callin
ppp chap hostname fti/rhXPeP2
ppp chap password 7 14300B0E381D123220
ppp pap sent-username fti/rhXPeP2 password 7 153512093033133D2C
hold-queue 100 out
!
ip nat inside source list 1 interface Dialer1 overload
ip nat inside source static udp 192.168.1.2 10000 interface Ethernet0 10000
ip nat inside source static udp 192.168.1.2 4500 interface Ethernet0 4500
ip nat inside source static tcp 192.168.1.2 1723 interface Dialer1 1723
ip nat inside source static udp 192.168.1.2 1723 interface Dialer1 1723
ip nat inside source static udp 192.168.1.2 500 interface Dialer1 500
ip nat inside source static tcp 192.168.1.2 500 interface Dialer1 500
ip nat inside source static tcp 192.168.1.2 7855 interface Dialer1 7855
ip classless
ip route 0.0.0.0 0.0.0.0 193.253.160.3
ip route 10.0.0.0 255.255.255.0 192.168.1.2
no ip http server
no ip http secure-server
!
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 3 permit 82.225.10.79
access-list 3 permit 10.0.0.0 0.0.0.255
access-list 8 deny 192.168.0.5
access-list 100 deny udp any eq netbios-dgm any
access-list 100 deny udp any eq netbios-ns any
access-list 100 deny udp any eq netbios-ss any
access-list 100 deny tcp any eq discard any
access-list 100 deny tcp any eq chargen any
access-list 100 deny tcp any eq 137 any
access-list 100 deny tcp any eq 138 any
access-list 100 deny tcp any eq 139 any
access-list 100 deny ip 192.168.0.0 0.0.255.255 any
access-list 100 deny ip 10.0.0.0 0.255.255.255 any
access-list 100 deny ip 172.16.0.0 0.15.255.255 any
access-list 100 deny ip 127.0.0.0 0.255.255.255 any
access-list 100 permit ip any any
access-list 101 permit tcp any 10.0.0.0 0.0.0.255
dialer-list 1 protocol ip permit
no cdp run
!
!
line con 0
password 7 09646D1C1E32062203
transport preferred all
transport output all
stopbits 1
speed 115200
line vty 0 4
access-class 3 in
transport preferred all
transport input all
transport output all
!
scheduler max-task-time 5000
end
--------------------------
1721
--------------------------
version 12.3
no service pad
service tcp-keepalives-in
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname 1721
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$b4f/$RtSa/Z0AjmUAjXzB89
!
username Tanguy privilege 15 password 7 07270259493E08351F
username Claude password 7 153E0E29062B32213A
clock timezone France 1
clock summer-time France recurring last Sun Mar 2:00 last Sun Oct 3:00
aaa new-model
!
!
aaa authentication login userauthen local
aaa authorization network groupauthor local
aaa session-id common
ip subnet-zero
!
!
!
!
ip tcp selective-ack
ip tcp path-mtu-discovery
ip domain name PLACE
ip name-server 195.68.0.1
ip cef
ip audit notify log
ip audit po max-events 100
ip ssh break-string
no ftp-server write-enable
no scripting tcl init
no scripting tcl encdir
!
!
!
!
!
crypto isakmp policy 3
hash md5
authentication pre-share
group 2
!
crypto isakmp client configuration group Tanguy
key SnapScan1236
pool Pool-For-Vpn-Client
acl SPLIT
include-local-lan
!
!
crypto ipsec transform-set myset esp-3des esp-md5-hmac
!
crypto dynamic-map dynmap 10
set transform-set myset
!
!
crypto map clientmap client authentication list userauthen
crypto map clientmap isakmp authorization list groupauthor
crypto map clientmap client configuration address initiate
crypto map clientmap client configuration address respond
crypto map clientmap 10 ipsec-isakmp dynamic dynmap
!
!
!
!
interface Ethernet0
ip address 192.168.1.2 255.255.255.0
ip nat outside
half-duplex
no cdp enable
crypto map clientmap
!
interface FastEthernet0
ip address 10.0.0.252 255.255.255.0
ip nat inside
speed auto
no cdp enable
!
ip local pool Pool-For-Vpn-Client 10.10.10.1 10.10.10.10
ip nat inside source static tcp 10.0.0.1 7855 interface Ethernet0 7855
ip nat inside source route-map NoNat interface Ethernet0 overload
ip classless
ip route 0.0.0.0 0.0.0.0 192.168.1.1
no ip http server
no ip http secure-server
!
!
!
ip access-list extended No-Nat-Vpn-Client
deny ip 10.0.0.0 0.0.0.255 10.10.10.0 0.0.0.255
permit ip 10.0.0.0 0.0.0.255 any
ip access-list extended SPLIT
permit ip 10.0.0.0 0.0.0.255 10.10.10.0 0.0.0.255
access-list 1 permit 10.0.0.0 0.0.0.255
access-list 1 permit 192.168.0.0 0.0.0.255
access-list 3 permit 82.225.10.79
access-list 3 permit 10.0.0.0 0.0.0.255
dialer-list 1 protocol ip permit
no cdp run
!
route-map NoNat permit 10
match ip address No-Nat-Vpn-Client
!
!
control-plane
!
!
line con 0
password 7 09646D1C1E32062203
transport preferred all
transport output all
stopbits 1
speed 115200
line aux 0
line vty 0 4
access-class 3 in
transport preferred all
transport input all
transport output all
!
scheduler max-task-time 5000
!
end
--------------------------
So help me please !! and thanks for helping me
plemieux72
Both routers' outside interfaces need to have a public IP address in order to be reachable. Right now it seems like you have a 192.168.x.x address (RFC 1918) which is not routable on the Internet. Can you give us more info on how this is setup?
ASKER
Only the 827 has an internet address, he has two interfaces one dialer/atm and an ethernet which is connected to the ethernet of the 1721. The 1721 has another Fast Ethetnet which is connected to the LAN. The 827 has just to let IPSEC paquets go through...Anything else?
Internet -------- d1 827 e0 --------- e0 1721 fa0 -------- LAN
PAT 192.168.1.0/24 VPN 10.0.0.0/24
Remote access VPN pool: 10.10.10.0/24
Right?
If so, I think the port-forwarding on the 827 is wrong. You should only need to port forward the following:
protocol esp
protocol udp port isakmp
protocol udp port non500-isakmp
You don't need 1723 or 10000 although it should not hurt anything having it. Test with it, then remove, retest, etc.
PAT 192.168.1.0/24 VPN 10.0.0.0/24
Remote access VPN pool: 10.10.10.0/24
Right?
If so, I think the port-forwarding on the 827 is wrong. You should only need to port forward the following:
protocol esp
protocol udp port isakmp
protocol udp port non500-isakmp
You don't need 1723 or 10000 although it should not hurt anything having it. Test with it, then remove, retest, etc.
ASKER
I ve added the line with protocol esp and now I can use "transparent tunneling"-->great
but the other one, i can't I ve to use the port number... I remember on a another that I could enter the name of tcp port...Is it because of my IOS version?
When I waked up this morning nothing was working (no internet connection, could not ping anything), i ve tried to connect it by console and it was written "low on memory", with the same version of IOS for a c820 and VPN fonctionnal, i have never had this message before...How can I solve it?
I ve tried to use this command crypto hardware acceleration to see if my module was activated but this command doesn t exist on my IOS, how can I know if my vpn is using the hardware or software?
but the other one, i can't I ve to use the port number... I remember on a another that I could enter the name of tcp port...Is it because of my IOS version?
When I waked up this morning nothing was working (no internet connection, could not ping anything), i ve tried to connect it by console and it was written "low on memory", with the same version of IOS for a c820 and VPN fonctionnal, i have never had this message before...How can I solve it?
I ve tried to use this command crypto hardware acceleration to see if my module was activated but this command doesn t exist on my IOS, how can I know if my vpn is using the hardware or software?
ASKER
you are right for the network diagram..
<<When I waked up this morning nothing was working (no internet connection, could not ping anything), i ve tried to connect it by console and it was written "low on memory", with the same version of IOS for a c820 and VPN fonctionnal, i have never had this message before...How can I solve it?>>
I don't know. You might want to open a new question about this to get visibility.
<<i can't I ve to use the port number... I remember on a another that I could enter the name of tcp port...Is it because of my IOS version?>>
Perhaps, see if you can enter it with the port number instead of name... UDP non500-isakmp = UDP 4500
I don't know. You might want to open a new question about this to get visibility.
<<i can't I ve to use the port number... I remember on a another that I could enter the name of tcp port...Is it because of my IOS version?>>
Perhaps, see if you can enter it with the port number instead of name... UDP non500-isakmp = UDP 4500
ASKER
I think that s what I did on the config i ve posted :
ip nat inside source static udp 192.168.1.2 4500 interface Ethernet0 4500
ip nat inside source static udp 192.168.1.2 500 interface Dialer1 500
?
ip nat inside source static udp 192.168.1.2 4500 interface Ethernet0 4500
ip nat inside source static udp 192.168.1.2 500 interface Dialer1 500
?
Have you tried it with the dialer1 interface?
ASKER
Yes it was a mistake ethernet0...but when tou told me to try with esp I ve corrected it.
Thanks.
But tell me why don't I have to forward the 1723?
Thanks.
But tell me why don't I have to forward the 1723?
1723 is for PPTP. Because you are using IPSec, port-forwarding 1723 is not needed. So does it work now? If not, please post updated configs.
ASKER
Good for me... Great how do I close?
I thank u for everything !
I thank u for everything !
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Is my english so bad :o) that you know I m french???
Non, c'est parce que claude & tanguy, c'est pas tres anglais... and the time zone gave it away. ;-)
ASKER
en effet c est un fait....Je te remercie en tout cas pour ton intervention tres utile qui me permet de progresser un petit peu...
Have you tried other vpn technology, hardware?
Have you tried other vpn technology, hardware?
De rien :-)
I've tried Microsoft VPN a few times but I don't do that anymore... So no, just Cisco PIX and routers. And, I don't really get any chance to try other stuff because my department strictly works on Cisco routers and switches.
Take care
I've tried Microsoft VPN a few times but I don't do that anymore... So no, just Cisco PIX and routers. And, I don't really get any chance to try other stuff because my department strictly works on Cisco routers and switches.
Take care