Cisco ISR: Setting up pptp VPN + Router Interface Q's
Posted on 2010-11-27
I recently purchased a cisco router to replace my watchguard x700 firebox that acted as my firewall, router and NAT device. Now it has taken me some time but I have set the router up and have even it got it functioning as a firewall. Here is my next problem VPN. Prior to the cisco router we used the watchguard firebox and SBS2003 builtin IAS to do radius authentication with the firewall terminating the VPN connection. Basically the firewall would provide the VPN connection but would use the SBS2003 server as a radius authentication server.
Now I have been trying to set this up on my cisco route but am having trouble. In an effort to trouble shoot this issue I have tried to instead use local user authentication and am still having trouble. I think the problem lies with the use of the Virtual-Template interface. In all the tutorials I have found on the subject there comes a point where you create a Virtual-Template for the vpdn connection like so:
ip unnumbered GigabitEthernet0/0
peer default ip address pool vpnpool
ppp encrypt mppe auto required
ppp authentication ms-chap ms-chap-v2
This should be just fine accept for the issue with my GigabitEthernet0/0 which is configured like so:
description External Interface - Public IP's
ip address x.x.x.23 255.255.255.224 secondary
ip address x.x.x.3 255.255.255.224 secondary
ip address x.x.x.4 255.255.255.224 secondary
ip address x.x.x.5 255.255.255.224 secondary
ip address x.x.x.30 255.255.255.224 secondary
ip address x.x.x.22 255.255.255.224
So as you can see my external interface has multiple public ip addresses. Which address do I use to connect to with my windows vpn client? I want it to be the x.x.x.22 address but that one is also setup to have static nat to our server as the server also functions as our OWA, exchange, and iis server. Is this too much to ask and am I misconfiguring the router by atttaching multiple public IP's to one interface? i know I cant use sub-interfaces as those are meant for VLAN's and different subnets I believe. Someone suggested in another forum that I use loopback interfaces but I dont know how you would do that and I am not sure if I confused that with something else.
Anyhow some insight as to where to go and how to do this would be greatly appreciated.