Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 628
  • Last Modified:

2 Cisco, vpn problem, can't access ressources from remote lan

I have two cisco : one 827 and one 1721
The 1721 must be the endpoint router and the 827 is conencted to the Internet. My problem is I can't access ressources by VPN, at the endpoint I can't ping the remote lan...I don t know how to do.
Another thing : on the cisco client if I check "enable tranpsarent tunneling", I can't connect (I m not asked to enter my login/password). I'd like this fonction to be enabled to pass through an ISA server that I will deploy.
HEre are my configurations :

C827 :
version 12.3
no service pad
service tcp-keepalives-in
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
service tcp-small-servers
!
hostname GoXi
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$8PzU$AJ5B7lTOrvOtDhS51RPvB1
!
username Tanguy privilege 15 password 7 03305A05011A38
clock summer-time GMT+01:00 recurring last Sun Mar 2:00 last Sun Oct 3:00
aaa new-model
!
!
aaa session-id common
ip subnet-zero
no ip source-route
ip tcp selective-ack
ip tcp path-mtu-discovery
ip domain name PLACE
ip name-server 10.0.0.253
ip dhcp excluded-address 10.0.0.100 10.0.0.254
!
no ip bootp server
ip cef
!
!
!
no crypto isakmp enable
!
!
!
interface Ethernet0
 ip address 192.168.1.1 255.255.255.0
 ip verify unicast reverse-path
 no ip proxy-arp
 ip nat inside
 no cdp enable
 hold-queue 100 out
!
interface ATM0
 no ip address
 no atm ilmi-keepalive
 dsl operating-mode auto
 pvc 8/35
  encapsulation aal5mux ppp dialer
  dialer pool-member 1
 !
!
interface Dialer1
 mtu 1492
 ip address negotiated
 ip verify unicast reverse-path
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat outside
 encapsulation ppp
 dialer pool 1
 dialer-group 1
 no cdp enable
 ppp authentication chap pap callin
 ppp chap hostname fti/rhXPeP2
 ppp chap password 7 14300B0E381D123220
 ppp pap sent-username fti/rhXPeP2 password 7 153512093033133D2C
 hold-queue 100 out
!
ip nat inside source list 1 interface Dialer1 overload
ip nat inside source static udp 192.168.1.2 10000 interface Ethernet0 10000
ip nat inside source static udp 192.168.1.2 4500 interface Ethernet0 4500
ip nat inside source static tcp 192.168.1.2 1723 interface Dialer1 1723
ip nat inside source static udp 192.168.1.2 1723 interface Dialer1 1723
ip nat inside source static udp 192.168.1.2 500 interface Dialer1 500
ip nat inside source static tcp 192.168.1.2 500 interface Dialer1 500
ip nat inside source static tcp 192.168.1.2 7855 interface Dialer1 7855
ip classless
ip route 0.0.0.0 0.0.0.0 193.253.160.3
ip route 10.0.0.0 255.255.255.0 192.168.1.2
no ip http server
no ip http secure-server
!
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 3 permit 82.225.10.79
access-list 3 permit 10.0.0.0 0.0.0.255
access-list 8 deny   192.168.0.5
access-list 100 deny   udp any eq netbios-dgm any
access-list 100 deny   udp any eq netbios-ns any
access-list 100 deny   udp any eq netbios-ss any
access-list 100 deny   tcp any eq discard any
access-list 100 deny   tcp any eq chargen any
access-list 100 deny   tcp any eq 137 any
access-list 100 deny   tcp any eq 138 any
access-list 100 deny   tcp any eq 139 any
access-list 100 deny   ip 192.168.0.0 0.0.255.255 any
access-list 100 deny   ip 10.0.0.0 0.255.255.255 any
access-list 100 deny   ip 172.16.0.0 0.15.255.255 any
access-list 100 deny   ip 127.0.0.0 0.255.255.255 any
access-list 100 permit ip any any
access-list 101 permit tcp any 10.0.0.0 0.0.0.255
dialer-list 1 protocol ip permit
no cdp run
!
!
line con 0
 password 7 09646D1C1E32062203
 transport preferred all
 transport output all
 stopbits 1
 speed 115200
line vty 0 4
 access-class 3 in
 transport preferred all
 transport input all
 transport output all
!
scheduler max-task-time 5000
end
----------------------------------------
1721
----------------------------------------
version 12.3
no service pad
service tcp-keepalives-in
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname 1721
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$b4f/$RtSa/Z0AjmUAjXzB89il3/
!
username Tanguy privilege 15 password 7 07270259493E08351F
username Claude password 7 153E0E29062B32213A
clock timezone France 1
clock summer-time France recurring last Sun Mar 2:00 last Sun Oct 3:00
aaa new-model
!
!
aaa authentication login userauthen local
aaa authorization network groupauthor local
aaa session-id common
ip subnet-zero
!
!
!
!
ip tcp selective-ack
ip tcp path-mtu-discovery
ip domain name PLACE
ip name-server 195.68.0.1
ip cef
ip audit notify log
ip audit po max-events 100
ip ssh break-string
no ftp-server write-enable
no scripting tcl init
no scripting tcl encdir
!
!
!
!
!
crypto isakmp policy 3
 hash md5
 authentication pre-share
 group 2
!
crypto isakmp client configuration group Tanguy
 key SnapScan1236
 pool Pool-For-Vpn-Client
 acl SPLIT
 include-local-lan
!
!
crypto ipsec transform-set myset esp-3des esp-md5-hmac
!
crypto dynamic-map dynmap 10
 set transform-set myset
!
!
crypto map clientmap client authentication list userauthen
crypto map clientmap isakmp authorization list groupauthor
crypto map clientmap client configuration address initiate
crypto map clientmap client configuration address respond
crypto map clientmap 10 ipsec-isakmp dynamic dynmap
!
!
!
!
interface Ethernet0
 ip address 192.168.1.2 255.255.255.0
 ip nat outside
 half-duplex
 no cdp enable
 crypto map clientmap
!
interface FastEthernet0
 ip address 10.0.0.252 255.255.255.0
 ip nat inside
 speed auto
 no cdp enable
!
ip local pool Pool-For-Vpn-Client 10.10.10.1 10.10.10.10
ip nat inside source static tcp 10.0.0.1 7855 interface Ethernet0 7855
ip nat inside source route-map NoNat interface Ethernet0 overload
ip classless
ip route 0.0.0.0 0.0.0.0 192.168.1.1
no ip http server
no ip http secure-server
!
!
!
ip access-list extended No-Nat-Vpn-Client
 deny   ip 10.0.0.0 0.0.0.255 10.10.10.0 0.0.0.255
 permit ip 10.0.0.0 0.0.0.255 any
ip access-list extended SPLIT
 permit ip 10.0.0.0 0.0.0.255 10.10.10.0 0.0.0.255
access-list 1 permit 10.0.0.0 0.0.0.255
access-list 1 permit 192.168.0.0 0.0.0.255
access-list 3 permit 82.225.10.79
access-list 3 permit 10.0.0.0 0.0.0.255
dialer-list 1 protocol ip permit
no cdp run
!
route-map NoNat permit 10
 match ip address No-Nat-Vpn-Client
!
!
control-plane
!
!
line con 0
 password 7 09646D1C1E32062203
 transport preferred all
 transport output all
 stopbits 1
 speed 115200
line aux 0
line vty 0 4
 access-class 3 in
 transport preferred all
 transport input all
 transport output all
!
scheduler max-task-time 5000
!
end
-----------------------------------------------------------------------

So help me please !! and thanks for helping me
0
Guygox
Asked:
Guygox
  • 8
  • 8
1 Solution
 
plemieux72Commented:
Both routers' outside interfaces need to have a public IP address in order to be reachable.  Right now it seems like you have a 192.168.x.x address (RFC 1918) which is not routable on the Internet.  Can you give us more info on how this is setup?
0
 
GuygoxAuthor Commented:
Only the 827 has an internet address, he has two interfaces one dialer/atm and an ethernet which is connected to the ethernet of the 1721. The 1721 has another Fast Ethetnet which is connected to the LAN. The 827 has just to let IPSEC paquets go through...Anything else?
0
 
plemieux72Commented:
Internet -------- d1 827 e0 --------- e0 1721 fa0 -------- LAN
                         PAT    192.168.1.0/24     VPN    10.0.0.0/24

Remote access VPN pool:  10.10.10.0/24

Right?

If so, I think the port-forwarding on the 827 is wrong.  You should only need to port forward the following:
 protocol esp
 protocol udp port isakmp
 protocol udp port non500-isakmp

You don't need 1723 or 10000 although it should not hurt anything having it.  Test with it, then remove, retest, etc.
0
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
GuygoxAuthor Commented:
I ve added the line with protocol esp and now I can use "transparent tunneling"-->great
but the other one, i can't I ve to use the port number... I remember on a another that I could enter the name of tcp port...Is it because of my IOS version?

When I waked up this morning nothing was working (no internet connection, could not ping anything), i ve tried to connect it by console and it was written "low on memory", with the same version of IOS for a c820 and VPN fonctionnal, i have never had this message before...How  can I solve it?

I ve tried to use this command crypto hardware acceleration to see if my module was activated but this command doesn t exist on my IOS, how can I know if my vpn is using the hardware or software?
0
 
GuygoxAuthor Commented:
you are right for the network diagram..
0
 
plemieux72Commented:
<<When I waked up this morning nothing was working (no internet connection, could not ping anything), i ve tried to connect it by console and it was written "low on memory", with the same version of IOS for a c820 and VPN fonctionnal, i have never had this message before...How  can I solve it?>>

I don't know.  You might want to open a new question about this to get visibility.

<<i can't I ve to use the port number... I remember on a another that I could enter the name of tcp port...Is it because of my IOS version?>>

Perhaps, see if you can enter it with the port number instead of name... UDP non500-isakmp = UDP 4500
0
 
GuygoxAuthor Commented:
I think that s what  I did on the config i ve posted :
ip nat inside source static udp 192.168.1.2 4500 interface Ethernet0 4500
ip nat inside source static udp 192.168.1.2 500 interface Dialer1 500

?
0
 
plemieux72Commented:
Have you tried it with the dialer1 interface?
0
 
GuygoxAuthor Commented:
Yes it was a mistake ethernet0...but when tou told me to try with esp I ve corrected it.
Thanks.

But tell me why don't I have to forward the 1723?
0
 
plemieux72Commented:
1723 is for PPTP.  Because you are using IPSec, port-forwarding 1723 is not needed.  So does it work now?  If not, please post updated configs.
0
 
GuygoxAuthor Commented:
Good for me... Great how do I close?
I thank u for everything !
0
 
plemieux72Commented:
Awesome!  There should be an "accept answer" button on each reply from experts...  Just click the one that actually helped you resolve the problem.  Bonne soiree!
0
 
GuygoxAuthor Commented:
Is my english so bad  :o) that you know I m french???
0
 
plemieux72Commented:
Non, c'est parce que claude & tanguy, c'est pas tres anglais... and the time zone gave it away.  ;-)
0
 
GuygoxAuthor Commented:
en effet c est un fait....Je te remercie en tout cas pour ton intervention tres utile qui me permet de progresser un petit peu...
Have you tried other vpn technology, hardware?
0
 
plemieux72Commented:
De rien :-)

I've tried Microsoft VPN a few times but I don't do that anymore...  So no, just Cisco PIX and routers.  And, I don't really get any chance to try other stuff because my department strictly works on Cisco routers and switches.

Take care
0

Featured Post

Who's Defending Your Organization from Threats?

Protecting against advanced threats requires an IT dream team – a well-oiled machine of people and solutions working together to defend your organization. Download our resource kit today to learn more about the tools you need to build you IT Dream Team!

  • 8
  • 8
Tackle projects and never again get stuck behind a technical roadblock.
Join Now