asked on

Having trouble configuring vpn for Surescripts

I have attempted to configure a tunnel but am not having any luck... I found some older questions regarding this on here and have attempted to step through those as well... I am attaching the instructions I was given and my current running configuration. Can you tell me where I have messed up? Or what I am doing wrong? surescripts-config.txt
current-config.txt

cdusio

looks like at a minimum your nat statements are not right.
Based on the surescripts doc, you need to nat your sip when you are trying to talk to them to a specific ip which I don't see in there.
That's probably what's failing at least the first piece.

You need a static policy nat to do this.

bmanhawks

ASKER

I am not using any voice traffic, just data... So I am not sure what you are asking me to do with SIP. I know the is some lines regarding it but that seems to be default in the device. Can you please elaborate?

bmanhawks

ASKER

I know there are some lines

cdusio

Source IP - sip

you need to nat like this

your source subnet, when trying to contact this host at surescripts is the classifier
the nat is that classifier and then the appropriate natted ip

so say

172.16.2.X/24 source network, destination surescripts 10.10.10.50/32
they want you to present them with 192.168.50.50 only

so your classifier would be 172.16.2.0/24 to 10.10.10.50
your nat would be that classifier and then the address you want to nat to (the 192.168.50.50)

Then in your crypto map, your source ip and desitnation ip's are your natted ip 192.168.50.50 to the surescripts destiantion 10.10.10.50.

bmanhawks

ASKER

LOL, I see what you're saying... I will give it a shot.

cdusio

Here's a real world example.

!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.254.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address XXXXXXXXX

***destination ip's
object-group network DM_INLINE_NETWORK_1
network-object host 192.168.50.83
network-object host 192.168.50.86
network-object host 192.168.50.85

***natted ip to crypto map
access-list outside_cryptomap extended permit ip host 172.28.168.5 object-group DM_INLINE_NETWORK_1

***policy nat
access-list inside_nat_static extended permit ip host 192.168.254.5 object-group DM_INLINE_NETWORK_1
static (inside,outside) 172.28.168.5 access-list inside_nat_static
!

crypto map outside_map 2 match address outside_cryptomap
crypto map outside_map 2 set peer XX.XX.XX.Xx
crypto map outside_map 2 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map interface outside

bmanhawks

ASKER

Made some changes... I should be able to ping the remote hosts from 192.168.2.8 but its still not making it. Thank you for your help BTW.
object-group network remote-vpn-hosts
network-object host 192.168.50.50
network-object host 192.168.50.83
network-object host 192.168.50.85
network-object host 192.168.50.86
access-list inside_nat0_outbound extended permit ip any 192.168.2.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 192.168.2.0 255.255.255.0 192.168.3.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip any 192.168.2.224 255.255.255.224
access-list outside_1_cryptomap extended permit ip 192.168.2.0 255.255.255.0 192.168.3.0 255.255.255.0
access-list outside_access_in extended permit icmp any any
access-list outside_access_in extended permit tcp any interface outside eq smtp
access-list inbound extended permit tcp any interface outside eq smtp
access-list outside_2_cryptomap extended permit ip host 172.38.26.8 object-group remote-vpn-hosts
access-list inside_nat0_outbound_1 extended permit ip 192.168.2.0 255.255.255.0 192.168.3.0 255.255.255.0
access-list inside_nat0_outbound_1 extended permit ip host 172.38.26.8 host 66.179.80.108
access-list inside_nat_outbound extended permit ip host 172.38.26.8 object-group remote-vpn-hosts
access-list outside_1_cryptomap_1 extended permit ip 192.168.2.0 255.255.255.0 192.168.3.0 255.255.255.0

ASKER CERTIFIED SOLUTION

cdusio

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

bmanhawks

ASKER

Thanks a ton CD... We got it up and going, that last little bit of information did the trick!
static (inside,outside) 172.38.26.8 access-list inside_nat_static
ERROR: access-list used in static has different local addresses
was the only thing that stumped me but I did get it going. I will send you a copy of my final config if anyone else has some trouble along these lines and you can have some notes.
latest-config.txt

bmanhawks

ASKER

I did notice one side effect from getting this tunnel back up that I didn't look for straight away... I have a tunnel between Surescripts and my server but all other traffic has stopped working? For example, if I open a browser or attempt to ping an external source like www.yahoo.com the request fails. Any ideas?