asked on

VPN

i have a router 1841. i have configured it for site to site connection with an ASA 5510, the configuration is working perfectly. Next i configured the router for VPN remote connection and it worked but it stopped the site to site connection.

my problem was that i configured both with the same NAME of crypto map but with different sequences and different encryption too.

I changed the name of the crypto map for the site to site and it worked again but the VPN remote connection is not working.

Is there a solution for my problem, having one internet connection and one router???

JFrederick29

You need to use the same crypto map name but the key is the remote access VPN sequence number be higher than the site to site. Good practice is to use 65535 for the remote access VPN sequence number.

outlaw17

ASKER

here's the following config. The VPN sequence number is higher than the site to site and i used the 65535 for the remote access VPN

crypto isakmp policy 10
encr aes 256
authentication pre-share
group 5
!
crypto isakmp policy 20
encr 3des
authentication pre-share
group 2
crypto isakmp key vpnkey address xxx.xxx.xxx.xx
!
crypto isakmp client configuration group VPN
key vpnkey
dns xxx.xxx.xxx.xx
pool vpnpool
acl vpn-split-tunnel
netmask 255.255.255.0
!
crypto ipsec security-association lifetime seconds 1800
!
crypto ipsec transform-set set-60 esp-aes 256 esp-sha-hmac
crypto ipsec transform-set set-10 esp-3des esp-sha-hmac
!
crypto dynamic-map dynmap 1
set transform-set set-10
!
!
crypto map vpn client authentication list vpn-authentication
crypto map vpn isakmp authorization list vpn-authorization
crypto map vpn client configuration address respond
crypto map vpn 10 ipsec-isakmp
set peer xxx.xxx.xxx.xx
set transform-set set-60
match address 170
crypto map vpn 65535 ipsec-isakmp dynamic dynmap

JFrederick29

Looks good. Can you post access-list 170 and the vpn-split-tunnel access-list.

outlaw17

ASKER

ip access-list extended vpn-split-tunnel
permit ip 195.125.1.0 0.0.0.255 195.125.10.0 0.0.0.255
!
access-list 170 permit ip 195.125.1.0 0.0.0.255 195.125.50.0 0.0.0.255
access-list 170 permit ip 195.125.1.0 0.0.0.255 195.125.51.0 0.0.0.255
access-list 170 permit ip 195.125.1.0 0.0.0.255 195.125.52.0 0.0.0.255
access-list 170 permit ip 195.125.1.0 0.0.0.255 195.125.53.0 0.0.0.255
access-list 170 permit ip 195.125.1.0 0.0.0.255 195.125.54.0 0.0.0.255
access-list 170 permit ip 195.125.1.0 0.0.0.255 195.125.55.0 0.0.0.255
access-list 170 permit ip 195.125.1.0 0.0.0.255 195.125.56.0 0.0.0.255

ip local pool vpnpool 195.125.10.1 195.125.10.15

these are not public, just private used inside the network

JFrederick29

Looks good also. So with this config, what doesn't work?

outlaw17

ASKER

with this config, the site to site stops from working. Maybe from this access-list???

access-list 180 deny ip 195.125.1.0 0.0.0.255 195.125.10.0 0.0.0.255
access-list 180 permit ip 195.125.1.0 0.0.0.255 195.125.50.0 0.0.0.255
access-list 180 permit ip 195.125.1.0 0.0.0.255 195.125.51.0 0.0.0.255
access-list 180 permit ip 195.125.1.0 0.0.0.255 195.125.52.0 0.0.0.255
access-list 180 permit ip 195.125.1.0 0.0.0.255 195.125.53.0 0.0.0.255
access-list 180 permit ip 195.125.1.0 0.0.0.255 195.125.54.0 0.0.0.255
access-list 180 permit ip 195.125.1.0 0.0.0.255 195.125.55.0 0.0.0.255
access-list 180 permit ip 195.125.1.0 0.0.0.255 195.125.56.0 0.0.0.255

ip nat inside source list 180 interface FastEthernet0/1 overload

ASKER CERTIFIED SOLUTION

JFrederick29

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

outlaw17

ASKER

hi JFrederick, i did what u told me but still didn't work. the problem was with the username and password. The site-to-site was not working coz of it. i created isakmp profile for site-to-site and vpn client so that the site-to-site wouldn't use the username and password and it worked very well. Thank you anyway.