How do I let a 3rd party access kit behind Cisco 877 router

One option is to map a port to the 3rd party device which will expose it to the net at large.
The other option is configure a remote VPN that only grants the remote client access to the third party device.
Does the 3rd party device capable of being a VPN end point i.e. running openVPN or similar applications?

ASKER

The 3rd party kit will have some sort of remote control software on, like PC Anywhere.

How would I map a port ? and would a remote VPN sit alongside our current VPN ?

Thanks arnold,

Ste

You can add the access list to allow external traffic to the port of the external device. You then similar to your existing map the traffic destined for port x to get to the IP of the 3rd party device.

YOu currently have two VPN policies, you should be able to add a third that will only allow the remote user access to the 3rd party device.

Are you using SDM to manage the cisco's configuration or are you going through the Command Line Inetrface?

ASKER

I generally use command line, but can access via SDM (though not too familiar with it).

You need to add something like:
ip nat inside source static tcp <internal IP> PORTA <external IP> PORTB

PORTB does not have to equal PORTA. You can use this if you want to move the port so it does not use a common port i.e. 3389, 59xx, etc.
Since you do not seem to have an access-list applied to the outside interface, this should be enough to forward external requests to <external IP> PORTB to reach <internal IP> PORTA.
If you add an access-list to the outside interface, you would need to allow this traffic to <external IP> PORTB to pass through.

Currently you have two VPN policies. A site-to-site and an incoming remote.
I think you can add another one and limit to which systems this VPN can connect.

ASKER

Thanks Arnold. I now have the NAT working :-)

I have successfully mapped a port to the kit in the VLAN 192 range. The only additional requirement is that I need the equipment in the vlan 192 to have access to the Internet, directly or via our VPN through to HQ. Do you know how I can achieve this ?

Thanks again,

Ste

SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

ASKER

Hi Arnold,

I have the kit assigned ip addres 192.168.1.2

The routing table looks spot on and the default gateway is fine. The only other ip addresses I can ping are of the kit in the VLAN 192, i.e. DF gateway (192.168.1.1) and other PCs in vlan. I tried to ping other VLANs on router and internet address 217.146.186.51 (www.yahoo.co.uk) with no joy ???

Thanks

Ste

ASKER CERTIFIED SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

ASKER

Hi,

From my PC plugged into the Vlan192, with the IP addy 192.168.1.2, the netstat -rn returns :

Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.2 20
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
192.168.1.0 255.255.255.0 192.168.1.2 192.168.1.2 20
192.168.1.2 255.255.255.255 127.0.0.1 127.0.0.1 20
192.168.1.255 255.255.255.255 192.168.1.2 192.168.1.2 20
224.0.0.0 240.0.0.0 192.168.1.2 192.168.1.2 20
255.255.255.255 255.255.255.255 192.168.1.2 192.168.1.2 1
255.255.255.255 255.255.255.255 192.168.1.2 10004 1
Default Gateway: 192.168.1.1
===========================================================================
Persistent Routes:
None

To confirm what I can ping ..........
All other VLans on that router, ie VLan1, Vlan101 & Vlan 102. I can not ping anything else. ie accross the VPN or on the internet.

I have done the pings from my PC (192.168.1.2) and using the extended ping command from 192.168.1.1, same results for both.

Other VLan's on that router send ALL traffic including port 80 traffic accross the VPN to our HQ where we filter and route all traffic appropriately, we don't have any kit going directly out to the internet through the router. I don't know if this afffects anything ?

I have attached thr router config and the results of the netstat command as a text file.
RHRouter.txt
netstat.txt

SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

ASKER

Hi Arnold,

Thnaks again for the response.

the command made no difference to the result of Pings commands.

The routing table results are attached :

cheers

Ste
routetable.txt

SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.