Solved

Cisco 2600 Routing Issue

Posted on 2006-06-20
6
363 Views
Last Modified: 2010-03-19
I have a site to site VPN between two 2600 routers (main office and satellite office) and the tunnel works fine and without error.  However, the clients behind the 2600 router at the satellite office cannot get on the internet.  The config was written by the gentlemen who worked there before me, and I have spent three days working on it.  If I add to the access list I can get them on the internet but it interferes with vpn traffic.  I have posted the config below for comments and review:

Building configuration...

Current configuration:
!
version 12.0
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname OLDFORT
!
enable secret 5 $1$uwpD$RGCoeqdRUylMtq1MdlIBq1
!
ip subnet-zero
ip name-server XXX.XXX.XXX.XXX
!
!
!
crypto isakmp policy 1
 authentication pre-share
crypto isakmp key password address XXX.XXX.XXX.XXX
!
!
crypto ipsec transform-set metro esp-des esp-md5-hmac
!
!
crypto map metro 10 ipsec-isakmp  
 set peer XXX.XXX.XXX.XXX
 set transform-set metro
 match address 130
!
!
!
!
interface Ethernet0/0
 ip address XXX.XXX.XXX.XXX 255.255.255.0
 no ip directed-broadcast
 ip nat outside
 crypto map metro
 bridge-group 1
!
interface Ethernet0/1
 ip address 192.168.10.1 255.255.255.0
 no ip directed-broadcast
 ip nat inside
 bridge-group 1
!
router rip
 redistribute connected
 network 192.165.0.0
 network 192.168.10.0
 network 216.153.232.0
!
ip default-gateway XXX.XXX.XXX.XXX
ip nat inside source route-map nonat interface Ethernet0/0 overload
ip nat inside source static tcp 192.168.10.200 4662 XXX.XXX.XXX.XXX 4662 extendable
ip nat inside source static udp 192.168.10.200 8465 XXX.XXX.XXX.XXX 8465 extendable
ip nat inside source static tcp 192.168.10.200 3389 XXX.XXX.XXX.XXX 3389 extendable
ip classless
ip route 0.0.0.0 0.0.0.0 XXX.XXX.XXX.XXX
!
access-list 130 permit ip 192.168.10.0 0.0.0.255 192.168.0.0 0.0.0.255
route-map nonat permit 10
 match ip address 100
!
snmp-server community public RO
bridge 1 protocol dec
!
line con 0
 password password
 transport input none
line aux 0
line vty 0 4
 password password
 login
!
end


any assistance would be greatly appreciated as I am totally frustrated.  i will be working on this into the evening tonight.

0
Comment
Question by:jvandeway
  • 3
  • 3
6 Comments
 
LVL 10

Expert Comment

by:naveedb
ID: 16947759
access-list 130 permit ip 192.168.10.0 0.0.0.255 192.168.0.0 0.0.0.255

doesn't look good.

The LAN on this side is 192.168.10.0 / 24, what is it on the other side?

And can you also post the ACL from other router?
0
 

Author Comment

by:jvandeway
ID: 16948175
The lan on the otherside is 192.168.0.0.  Each of the others offices is on a different subnet ie. 192.168.20.x, .30, .40, etc.

Here is the ACL from the primary router.  It is also the main router for several satellite offices VPN connections, all of them using 2600 routers.

Here is the ACL from the main router.

ip classless
ip route 0.0.0.0 0.0.0.0 216.153.239.1
!
access-list 100 deny   ip 192.168.0.0 0.0.0.255 192.168.10.0 0.0.0.255
access-list 100 deny   ip 192.168.0.0 0.0.0.255 192.168.20.0 0.0.0.255
access-list 100 deny   ip 192.168.0.0 0.0.0.255 192.168.30.0 0.0.0.255
access-list 100 deny   ip 192.168.0.0 0.0.0.255 192.168.40.0 0.0.0.255
access-list 100 deny   ip 192.168.0.0 0.0.0.255 192.168.50.0 0.0.0.255
access-list 100 deny   ip 192.168.0.0 0.0.0.255 192.168.60.0 0.0.0.255
access-list 100 deny   ip 192.168.0.0 0.0.0.255 192.168.70.0 0.0.0.255
access-list 100 deny   ip 192.168.0.0 0.0.0.255 192.168.80.0 0.0.0.255
access-list 100 permit ip 192.168.0.0 0.0.0.255 any
access-list 130 permit ip 192.168.0.0 0.0.0.255 192.168.10.0 0.0.0.255
access-list 131 permit ip 192.168.0.0 0.0.0.255 192.168.20.0 0.0.0.255
access-list 132 permit ip 192.168.0.0 0.0.0.255 192.168.30.0 0.0.0.255
access-list 133 permit ip 192.168.0.0 0.0.0.255 192.168.40.0 0.0.0.255
access-list 134 permit ip 192.168.0.0 0.0.0.255 192.168.50.0 0.0.0.255
access-list 135 permit ip 192.168.0.0 0.0.0.255 192.168.60.0 0.0.0.255
access-list 136 permit ip 192.168.0.0 0.0.0.255 192.168.70.0 0.0.0.255
access-list 137 permit ip 192.168.0.0 0.0.0.255 192.168.80.0 0.0.0.255
access-list 140 permit ip 192.168.0.0 0.0.0.255 192.168.10.0 0.0.0.255
access-list 140 permit ip 192.168.0.0 0.0.0.255 192.168.20.0 0.0.0.255
access-list 140 permit ip 192.168.0.0 0.0.0.255 192.168.30.0 0.0.0.255
access-list 140 permit ip 192.168.0.0 0.0.0.255 192.168.40.0 0.0.0.255
access-list 140 permit ip 192.168.0.0 0.0.0.255 192.168.50.0 0.0.0.255
access-list 140 permit ip 192.168.0.0 0.0.0.255 192.168.60.0 0.0.0.255
access-list 140 permit ip 192.168.0.0 0.0.0.255 192.168.70.0 0.0.0.255
access-list 140 permit ip 192.168.0.0 0.0.0.255 192.168.80.0 0.0.0.255
dialer-list 1 protocol ip permit
dialer-list 1 protocol ipx permit
route-map nonatrdp permit 10
 match ip address 140
 set ip next-hop 1.1.1.2

Thanks in advance.
0
 

Author Comment

by:jvandeway
ID: 16948194
also, when I add the following to my satellite router:

access-list 100 permit ip 192.168.20.0 0.0.0.255 any

It then lets me on the internet from the inside, but closes my VPN tunnel.  If I am not mistaken, this ACL:

access-list 130 permit ip 192.168.10.0 0.0.0.255 192.168.0.0 0.0.0.255

is directing all IP traffic inside of the 192.168.10.0 subnet to go to 192.168.0.0 subnet.  So when I add this ACL:

access-list 100 permit ip 192.168.20.0 0.0.0.255 any

it is then allowing all traffic to go out to the internet?  Maybe I am off a bit, I don't know.

Any and all help is appreciated.
0
Flexible connectivity for any environment

The KE6900 series can extend and deploy computers with high definition displays across multiple stations in a variety of applications that suit any environment. Expand computer use to stations across multiple rooms with dynamic access.

 
LVL 10

Accepted Solution

by:
naveedb earned 500 total points
ID: 16948251
try this; remove the 100 list you added (if you haven't already)

no access-list 100 permit ip 192.168.20.0 0.0.0.255 any


then add it like this


access-list 100 deny ip 192.168.10.0 0.0.0.255 192.168.0.0 0.0.0.255
access-list 100 permit ip 192.168.10.0 0.0.0.255 any

Let me know if it works

0
 

Author Comment

by:jvandeway
ID: 16948264
IT WORKED, thank you so much.  I think I tried so many different variations of that that I just got frustrated.

I greatly appreaciate it.
0
 
LVL 10

Expert Comment

by:naveedb
ID: 16948280
No problem. route-map nonat in your configuration is used to identify traffic for the Internet. Whenever you add traffic to VPN tunnel, you will need to filter it through ACL 100 with a deny statement.
0

Featured Post

Register Today - IoT Current and Future Threats

Are you prepared to protect your organization from current and future IoT Threats?  Join our Wi-Fi expert in episode three of our webinar series for a look at the current state of Wi-Fi IoT and what may lie ahead. Register for our live webinar on April 20th at 9 am PDT!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I had an issue with InstallShield not being able to use Computer Browser service on Windows Server 2012. Here is the solution I found.
This article will inform Clients about common and important expectations from the freelancers (Experts) who are looking at your Gig.
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

679 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question