mark_06
asked on
Cisco VPN with IOS Firewall
Hi,
I have a Cisco 2811 that I have configured for VPN via CLI. I also have configured the firewall via SDM. However VPN traffic cannot get through and I do not know why. I am sure it's the firewall as if I remove the associated dialer interface which maps the VPN from the firewall then it works fine. However I must have this interface on the firewall.
I have attached the firewall config. What do I need to do to fix it so that VPN traffic will work through the firewall? The access-list defining VPN traffic is 114.
I have a Cisco 2811 that I have configured for VPN via CLI. I also have configured the firewall via SDM. However VPN traffic cannot get through and I do not know why. I am sure it's the firewall as if I remove the associated dialer interface which maps the VPN from the firewall then it works fine. However I must have this interface on the firewall.
I have attached the firewall config. What do I need to do to fix it so that VPN traffic will work through the firewall? The access-list defining VPN traffic is 114.
class-map type inspect match-all sdm-cls-VPNOutsideToInside-1
match access-group 104
class-map type inspect match-any SDM_AH
match access-group name SDM_AH
class-map type inspect match-any sdm-cls-insp-traffic
match protocol cuseeme
match protocol dns
match protocol ftp
match protocol h323
match protocol https
match protocol icmp
match protocol imap
match protocol pop3
match protocol netshow
match protocol shell
match protocol realmedia
match protocol rtsp
match protocol smtp extended
match protocol sql-net
match protocol streamworks
match protocol tftp
match protocol vdolive
match protocol tcp
match protocol udp
class-map type inspect match-all sdm-insp-traffic
match class-map sdm-cls-insp-traffic
class-map type inspect match-any SDM_ESP
match access-group name SDM_ESP
class-map type inspect match-any SDM_VPN_TRAFFIC
match protocol isakmp
match protocol ipsec-msft
match class-map SDM_AH
match class-map SDM_ESP
class-map type inspect match-all SDM_VPN_PT
match access-group 103
match class-map SDM_VPN_TRAFFIC
class-map type inspect match-any vpn1
match protocol tcp
match protocol udp
match class-map SDM_VPN_TRAFFIC
class-map type inspect match-all sdm-cls--1
match class-map vpn1
match access-group name vpn1
class-map type inspect match-any SDM-Voice-permit
match protocol h323
match protocol skinny
match protocol sip
class-map type inspect match-any SDM_IP
match access-group name SDM_IP
class-map type inspect match-any SDM_EASY_VPN_SERVER_TRAFFIC
match protocol isakmp
match protocol ipsec-msft
match class-map SDM_AH
match class-map SDM_ESP
class-map type inspect match-all SDM_EASY_VPN_SERVER_PT
match class-map SDM_EASY_VPN_SERVER_TRAFFIC
class-map type inspect match-any SDM-Voice
match protocol h323
class-map type inspect match-any sdm-cls-icmp-access
match protocol icmp
match protocol tcp
match protocol udp
class-map type inspect match-any ssh
match protocol tcp
class-map type inspect match-all sdm-icmp-access
match class-map sdm-cls-icmp-access
class-map type inspect match-all sdm-invalid-src
match access-group 101
class-map type inspect match-all sdm-protocol-http
match protocol http
!
!
policy-map type inspect sdm-permit-icmpreply
class type inspect sdm-icmp-access
inspect
class type inspect SDM-Voice
inspect
class class-default
pass
policy-map type inspect sdm-pol-VPNOutsideToInside-1
class type inspect sdm-cls-VPNOutsideToInside-1
inspect
class class-default
drop
policy-map type inspect sdm-inspect
class type inspect sdm-invalid-src
drop log
class type inspect sdm-insp-traffic
inspect
class type inspect sdm-protocol-http
inspect
class type inspect SDM-Voice-permit
inspect
class class-default
pass
policy-map type inspect sdm-permit
class type inspect SDM_EASY_VPN_SERVER_PT
pass
class type inspect SDM-Voice
inspect
class class-default
drop log
policy-map type inspect sdm-policy-sdm-cls--1
class type inspect sdm-cls--1
pass
class class-default
drop
policy-map type inspect sdm-permit-ip
class type inspect SDM_IP
pass
class class-default
drop log
!
zone security out-zone
zone security in-zone
zone security ezvpn-zone
zone security vpn1
zone-pair security sdm-zp-self-out source self destination out-zone
service-policy type inspect sdm-permit-icmpreply
zone-pair security sdm-zp-out-self source out-zone destination self
service-policy type inspect sdm-permit
zone-pair security sdm-zp-in-out source in-zone destination out-zone
service-policy type inspect sdm-inspect
zone-pair security sdm-zp-in-ezvpn1 source in-zone destination ezvpn-zone
service-policy type inspect sdm-permit-ip
zone-pair security sdm-zp-out-ezpn1 source out-zone destination ezvpn-zone
service-policy type inspect sdm-permit-ip
zone-pair security sdm-zp-ezvpn-out1 source ezvpn-zone destination out-zone
service-policy type inspect sdm-permit-ip
zone-pair security sdm-zp-ezvpn-in1 source ezvpn-zone destination in-zone
service-policy type inspect sdm-permit-ip
zone-pair security sdm-zp-VPNOutsideToInside-1 source out-zone destination in-zone
service-policy type inspect sdm-pol-VPNOutsideToInside-1
zone-pair security sdm-zp-vpn1-in-zone source vpn1 destination in-zone
service-policy type inspect sdm-policy-sdm-cls--1
!
...(cut)...
ip nat inside source route-map SDM_RMAP_1 interface Dialer1 overload
!
ip access-list extended SDM_AH
remark SDM_ACL Category=1
permit ahp any any
ip access-list extended SDM_ESP
remark SDM_ACL Category=1
permit esp any any
ip access-list extended SDM_IP
remark SDM_ACL Category=1
permit ip any any
ip access-list extended vpn1
remark SDM_ACL Category=128
permit ip 192.168.1.0 0.0.0.255 192.168.4.0 0.0.0.255
!
access-list 100 remark SDM_ACL Category=16
access-list 100 deny ip 192.168.4.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 100 deny ip 192.168.4.0 0.0.0.255 192.168.6.0 0.0.0.255
access-list 100 deny ip 192.168.4.0 0.0.0.255 192.168.8.0 0.0.0.255
access-list 100 deny ip 192.168.4.0 0.0.0.255 192.168.168.0 0.0.0.255
access-list 100 permit ip 192.168.4.0 0.0.0.255 any
access-list 100 deny ip any any
access-list 101 remark SDM_ACL Category=128
access-list 101 permit ip host 255.255.255.255 any
access-list 101 permit ip 127.0.0.0 0.255.255.255 any
access-list 101 permit ip 192.168.4.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 102 remark SDM_ACL Category=4
access-list 102 remark IPSec Rule
access-list 102 permit ip 192.168.4.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 104 remark SDM_ACL Category=0
access-list 104 remark IPSec Rule
access-list 104 permit ip 192.168.1.0 0.0.0.255 192.168.4.0 0.0.0.255
access-list 104 permit ip 192.168.4.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 114 permit ip 192.168.4.0 0.0.0.255 192.168.1.0 0.0.0.255
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.