[Last Call] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 5307
  • Last Modified:

Remote SDM/SSH/Telnet access to a Cisco 877

I've been playing around with a Cisco 877 and have been trying to figure out how to allow remote access to the SDM and Telnet from external clients.

Basically I need to be able to jump on this router from any location ideally without having a VPN up first so SSH / HTTPS would be nice.

I've read several buts on how to configure SSH and some of the Access list details but whenever I try them it doesnt seem to let me in remotely. Local access is fine, heres the clean config. Any help / suggestions appreciated.
!
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname router
!
boot-start-marker
boot-end-marker
!
logging buffered 51200
logging console critical
enable secret 5 *****.
!
aaa new-model
!
!
aaa authentication login local_authen local
aaa authorization exec local_author local 
!
!
aaa session-id common
clock timezone PCTime 0
clock summer-time PCTime date Mar 30 2003 1:00 Oct 26 2003 2:00
!
crypto pki trustpoint TP-self-signed-849564243
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-849564243
 revocation-check none
 rsakeypair TP-self-signed-849564243
!
!
dot11 syslog
!
dot11 ssid companyname
   authentication open 
   authentication key-management wpa
   guest-mode
   wpa-psk ascii 7 *****
!
no ip source-route
ip cef
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.xx.1 192.168.xx.9
ip dhcp excluded-address 192.168.xx.101 192.168.xx.254
!
ip dhcp pool sdm-pool1
   import all
   network 192.168.xx.0 255.255.255.0
   dns-server 4.2.2.1 4.2.2.2 
   default-router 192.168.xx.254 
!
!
ip port-map user-protocol--1 port tcp 7401
no ip bootp server
no ip domain lookup
ip domain name companyname.local
ip name-server 4.2.2.1
ip name-server 4.2.2.2
!
!
!
username ***** privilege 15 secret 5 *****
! 
!
crypto isakmp policy 1
 encr 3des
 authentication pre-share
 group 2
crypto isakmp key ***** address 77.xx.xx.xx
crypto isakmp key ***** address 62.xx.xx.xx
!
!
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac 
crypto ipsec transform-set ESP-3DES-SHA1 esp-3des esp-sha-hmac 
!
crypto map SDM_CMAP_1 1 ipsec-isakmp 
 description Tunnel to77.xx.xx.xx
 set peer 77.xx.xx.xx
 set transform-set ESP-3DES-SHA 
 match address 103
crypto map SDM_CMAP_1 2 ipsec-isakmp 
 description Tunnel to62.xx.xx.xx
 set peer 62.xx.xx.xx
 set transform-set ESP-3DES-SHA1 
 match address 107
!
archive
 log config
  hidekeys
!
!
ip tcp synwait-time 10
ip ssh time-out 60
ip ssh authentication-retries 2
ip ssh version 1
!
class-map type inspect match-all sdm-cls-VPNOutsideToInside-1
 match access-group 105
class-map type inspect match-all sdm-cls-VPNOutsideToInside-3
 match access-group 109
class-map type inspect match-all sdm-cls-VPNOutsideToInside-2
 match access-group 108
class-map type inspect match-all sdm-nat-user-protocol--1-1
 match access-group 101
 match protocol user-protocol--1
class-map type inspect match-any SDM_AH
 match access-group name SDM_AH
class-map type inspect match-any sdm-cls-insp-traffic
 match protocol cuseeme
 match protocol dns
 match protocol ftp
 match protocol h323
 match protocol https
 match protocol icmp
 match protocol imap
 match protocol pop3
 match protocol netshow
 match protocol shell
 match protocol realmedia
 match protocol rtsp
 match protocol smtp extended
 match protocol sql-net
 match protocol streamworks
 match protocol tftp
 match protocol vdolive
 match protocol tcp
 match protocol udp
class-map type inspect match-all sdm-insp-traffic
 match class-map sdm-cls-insp-traffic
class-map type inspect match-any SDM_ESP
 match access-group name SDM_ESP
class-map type inspect match-any SDM_VPN_TRAFFIC
 match protocol isakmp
 match protocol ipsec-msft
 match class-map SDM_AH
 match class-map SDM_ESP
class-map type inspect match-all SDM_VPN_PT
 match access-group 104
 match class-map SDM_VPN_TRAFFIC
class-map type inspect match-any sdm-cls-icmp-access
 match protocol icmp
 match protocol tcp
 match protocol udp
class-map type inspect match-all sdm-invalid-src
 match access-group 100
class-map type inspect match-all sdm-icmp-access
 match class-map sdm-cls-icmp-access
class-map type inspect match-all sdm-protocol-http
 match protocol http
!
!
policy-map type inspect sdm-permit-icmpreply
 class type inspect sdm-icmp-access
  inspect
 class class-default
  pass
policy-map type inspect sdm-pol-NATOutsideToInside-1
 class type inspect sdm-nat-user-protocol--1-1
  inspect
 class type inspect sdm-cls-VPNOutsideToInside-1
  inspect
 class type inspect sdm-cls-VPNOutsideToInside-2
  inspect
 class type inspect sdm-cls-VPNOutsideToInside-3
  inspect
 class class-default
policy-map type inspect sdm-inspect
 class type inspect sdm-invalid-src
  drop log
 class type inspect sdm-insp-traffic
  inspect
 class type inspect sdm-protocol-http
  inspect
 class class-default
policy-map type inspect sdm-permit
 class type inspect SDM_VPN_PT
  pass
 class class-default
!
zone security out-zone
zone security in-zone
zone-pair security sdm-zp-self-out source self destination out-zone
 service-policy type inspect sdm-permit-icmpreply
zone-pair security sdm-zp-NATOutsideToInside-1 source out-zone destination in-zone
 service-policy type inspect sdm-pol-NATOutsideToInside-1
zone-pair security sdm-zp-out-self source out-zone destination self
 service-policy type inspect sdm-permit
zone-pair security sdm-zp-in-out source in-zone destination out-zone
 service-policy type inspect sdm-inspect
!
bridge irb
!
!
interface Null0
 no ip unreachables
!
interface ATM0
 no ip address
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip route-cache flow
 no atm ilmi-keepalive
 dsl operating-mode auto 
!
interface ATM0.1 point-to-point
 description $ES_WAN$$FW_OUTSIDE$
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 pvc 0/38 
  encapsulation aal5mux ppp dialer
  dialer pool-member 1
 !
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface Dot11Radio0
 description WLAN
 no ip address
 no dot11 qos mode
 !
 encryption mode ciphers tkip 
 !
 broadcast-key change 3600 membership-termination
 !
 !
 ssid companyname
 !
 speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
 channel 2462
 station-role root
 world-mode dot11d country GB both
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 spanning-disabled
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
!
interface Vlan1
 description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$FW_INSIDE$
 no ip address
 ip tcp adjust-mss 1452
 bridge-group 1
!
interface Dialer0
 description $FW_OUTSIDE$
 ip address negotiated
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat outside
 ip virtual-reassembly
 zone-member security out-zone
 encapsulation ppp
 ip route-cache flow
 dialer pool 1
 dialer-group 1
 no cdp enable
 ppp authentication chap pap callin
 ppp chap hostname *****
 ppp chap password 7 *****
 ppp pap sent-username ***** password 7 *****
 crypto map SDM_CMAP_1
!
interface BVI1
 description $ES_LAN$$FW_INSIDE$
 ip address 192.168.xx.254 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat inside
 ip virtual-reassembly
 zone-member security in-zone
 ip route-cache flow
 ip tcp adjust-mss 1412
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Dialer0
!
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source static tcp 192.168.xx.200 7401 interface Dialer0 7401
ip nat inside source route-map SDM_RMAP_1 interface Dialer0 overload
!
ip access-list extended SDM_AH
 remark SDM_ACL Category=1
 permit ahp any any
ip access-list extended SDM_ESP
 remark SDM_ACL Category=1
 permit esp any any
!
logging trap debugging
access-list 1 remark INSIDE_IF=BVI1
access-list 1 remark SDM_ACL Category=2
access-list 1 permit 192.168.xx.0 0.0.0.255
access-list 100 remark SDM_ACL Category=128
access-list 100 permit ip host 255.255.255.255 any
access-list 100 permit ip 127.0.0.0 0.255.255.255 any
access-list 101 remark SDM_ACL Category=0
access-list 101 permit ip any host 192.168.xx.200
access-list 102 remark VTY Access-class list
access-list 102 remark SDM_ACL Category=1
access-list 102 permit ip 192.168.xx.0 0.0.0.255 any
access-list 102 deny   ip any any
access-list 103 remark SDM_ACL Category=4
access-list 103 remark IPSec Rule
access-list 103 permit ip 192.168.xx.0 0.0.0.255 10.0.0.0 0.0.0.255
access-list 104 remark SDM_ACL Category=128
access-list 104 permit ip host 77.xx.xx.xx any
access-list 104 permit ip host 62.xx.xx.xx any
access-list 105 remark SDM_ACL Category=0
access-list 105 remark IPSec Rule
access-list 105 permit ip 10.0.0.0 0.0.0.255 192.168.xx.0 0.0.0.255
access-list 106 remark SDM_ACL Category=2
access-list 106 remark IPSec Rule
access-list 106 deny   ip 192.168.xx.0 0.0.0.255 172.28.xx.0 0.0.0.255
access-list 106 remark IPSec Rule
access-list 106 deny   ip 192.168.xx.0 0.0.0.255 10.0.0.0 0.0.0.255
access-list 106 permit ip 192.168.xx.0 0.0.0.255 any
access-list 107 remark SDM_ACL Category=4
access-list 107 remark IPSec Rule
access-list 107 permit ip 192.168.xx.0 0.0.0.255 172.28.xx.0 0.0.0.255
access-list 108 remark SDM_ACL Category=0
access-list 108 remark IPSec Rule
access-list 108 permit ip 172.28.xx.0 0.0.0.255 192.168.xx.0 0.0.0.255
access-list 108 remark IPSec Rule
access-list 108 permit ip 10.0.0.0 0.0.0.255 192.168.xx.0 0.0.0.255
access-list 109 remark SDM_ACL Category=0
access-list 109 remark IPSec Rule
access-list 109 permit ip 172.28.xx.0 0.0.0.255 192.168.xx.0 0.0.0.255
access-list 109 remark IPSec Rule
access-list 109 permit ip 10.0.0.0 0.0.0.255 192.168.xx.0 0.0.0.255
dialer-list 1 protocol ip permit
no cdp run
!
!
route-map SDM_RMAP_1 permit 1
 match ip address 106
!
!
control-plane
!
bridge 1 protocol ieee
bridge 1 route ip
banner exec CAuthorized access only!
 Disconnect IMMEDIATELY if you are not an authorized user!
banner login Authorized access only!
 Disconnect IMMEDIATELY if you are not an authorized user!

!
line con 0
 login authentication local_authen
 no modem enable
 transport output telnet
line aux 0
 login authentication local_authen
 transport output telnet
line vty 0 4
 privilege level 15
 authorization exec local_author
 login authentication local_authen
 transport input telnet ssh
!
scheduler max-task-time 5000
scheduler allocate 4000 1000
scheduler interval 500
ntp server 194.164.127.6 source ATM0.1 prefer
ntp server 194.35.252.7 source ATM0.1 prefer
end

Open in new window

0
v0r73x
Asked:
v0r73x
  • 2
  • 2
1 Solution
 
JFrederick29Commented:
The Firewall is not allowing SSH.

Add this:

class-map type inspect match-any router-access
match protocol ssh
match protocol https

policy-map type inspect sdm-permit
 class type inspect router-access
  inspect
0
 
v0r73xAuthor Commented:
Have tried entering the above although get the following error?

%Protocol ssh configured in class-map router-access cannot be configured for the
 self zone. Please remove the protocol and retry
0
 
JFrederick29Commented:
Okay, do this instead.

conf t
ip access-list ext 150
permit tcp any any eq 22
permit tcp any any eq https
permit tcp any any eq 23

class-map type inspect match-any router-access
 no match protocol ssh
 no match protocol https
 match access-group 150

policy-map type inspect sdm-permit
 class type inspect router-access
  inspect

In access-list 150, you can restrict the source IP to "allowed" IP addresses to lock down SSH/HTTPS/TELNET access from the Internet if desired or leave it like above which allows that access from any IP.
0
 
v0r73xAuthor Commented:
Thanks for the help! Couldn't seem to get it running with the CLI as it kept failing with an error, but with the above in mind I used the SDM to add the allow rules for the self zone and to inspect the traffic and its done the job.
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

  • 2
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now