Having trouble configuring vpn for Surescripts

I have attempted to configure a tunnel but am not having any luck... I found some older questions regarding this on here and have attempted to step through those as well... I am attaching the instructions I was given and my current running configuration. Can you tell me where I have messed up? Or what I am doing wrong? surescripts-config.txt
current-config.txt
bmanhawksAsked:
Who is Participating?
 
cdusioConnect With a Mentor Commented:
try this..
I can't see your tunnel config atm but this sb right for the nats.

object-group network remote-vpn-hosts
 network-object host 192.168.50.50
 network-object host 192.168.50.83
 network-object host 192.168.50.85
 network-object host 192.168.50.86

access-list inside_nat_static extended permit ip 192.168.2.0 255.255.255.0 object-group remote-vpn-hosts

static (inside,outside) 172.38.26.8 access-list inside_nat_static
access-list outside_2_cryptomap extended permit ip host 172.38.26.8 object-group remote-vpn-hosts




crypto map outside_map 2 match address outside_2_cryptomap
crypto map outside_map 2 set peer XX.XX.XX.XX
crypto map outside_map 2 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map interface outside
0
 
cdusioCommented:
looks like at a minimum your nat statements are not right.
Based on the surescripts doc, you need to nat your sip when you are trying to talk to them to a specific ip which I don't see in there.
That's probably what's failing at least the first piece.

You need a static policy nat to do this.
0
 
bmanhawksAuthor Commented:
I am not using any voice traffic, just data... So I am not sure what you are asking me to do with SIP. I know the is some lines regarding it but that seems to be default in the device. Can you please elaborate?
0
Become an IT Security Management Expert

In today’s fast-paced, digitally transformed world of business, the need to protect network data and ensure cloud privacy has never been greater. With a B.S. in Network Operations and Security, you can get the credentials it takes to become an IT security management expert.

 
bmanhawksAuthor Commented:
I know there are some lines
0
 
cdusioCommented:
Source IP - sip

you need to nat like this

your source subnet, when trying to contact this host at surescripts is the classifier
the nat is that classifier and then the appropriate natted ip

so say

172.16.2.X/24 source network, destination surescripts 10.10.10.50/32
they want you to present them with 192.168.50.50 only

so your classifier would be 172.16.2.0/24 to 10.10.10.50
your nat would be that classifier and then the address you want to nat to (the 192.168.50.50)

Then in your crypto map, your source ip and desitnation ip's are your natted ip 192.168.50.50 to the surescripts destiantion 10.10.10.50.


0
 
bmanhawksAuthor Commented:
LOL, I see what you're saying... I will give it a shot.
0
 
cdusioCommented:

Here's a real world example.

!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.254.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address XXXXXXXXX




***destination ip's
object-group network DM_INLINE_NETWORK_1
 network-object host 192.168.50.83
 network-object host 192.168.50.86
 network-object host 192.168.50.85


***natted ip to crypto map
access-list outside_cryptomap extended permit ip host 172.28.168.5 object-group DM_INLINE_NETWORK_1

***policy nat
access-list inside_nat_static extended permit ip host 192.168.254.5 object-group DM_INLINE_NETWORK_1
static (inside,outside) 172.28.168.5  access-list inside_nat_static
!


crypto map outside_map 2 match address outside_cryptomap
crypto map outside_map 2 set peer XX.XX.XX.Xx
crypto map outside_map 2 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map interface outside

0
 
bmanhawksAuthor Commented:
Made some changes... I should be able to ping the remote hosts from 192.168.2.8 but its still not making it. Thank you for your help BTW.
object-group network remote-vpn-hosts
 network-object host 192.168.50.50
 network-object host 192.168.50.83
 network-object host 192.168.50.85
 network-object host 192.168.50.86
access-list inside_nat0_outbound extended permit ip any 192.168.2.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 192.168.2.0 255.255.255.0 192.168.3.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip any 192.168.2.224 255.255.255.224
access-list outside_1_cryptomap extended permit ip 192.168.2.0 255.255.255.0 192.168.3.0 255.255.255.0
access-list outside_access_in extended permit icmp any any
access-list outside_access_in extended permit tcp any interface outside eq smtp
access-list inbound extended permit tcp any interface outside eq smtp
access-list outside_2_cryptomap extended permit ip host 172.38.26.8 object-group remote-vpn-hosts
access-list inside_nat0_outbound_1 extended permit ip 192.168.2.0 255.255.255.0 192.168.3.0 255.255.255.0
access-list inside_nat0_outbound_1 extended permit ip host 172.38.26.8 host 66.179.80.108
access-list inside_nat_outbound extended permit ip host 172.38.26.8 object-group remote-vpn-hosts
access-list outside_1_cryptomap_1 extended permit ip 192.168.2.0 255.255.255.0 192.168.3.0 255.255.255.0
0
 
bmanhawksAuthor Commented:
Thanks a ton CD... We got it up and going, that last little bit of information did the trick!
static (inside,outside) 172.38.26.8 access-list inside_nat_static
ERROR: access-list used in static has different local addresses
was the only thing that stumped me but I did get it going. I will send you a copy of my final config if anyone else has some trouble along these lines and you can have some notes.
latest-config.txt
0
 
bmanhawksAuthor Commented:
I did notice one side effect from getting this tunnel back up that I didn't look for straight away... I have a tunnel between Surescripts and my server but all other traffic has stopped working? For example, if I open a browser or attempt to ping an external source like www.yahoo.com the request fails. Any ideas?
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.