topic I have the route at Linux in Routing and SD-WAN

Connecting two subnets PPTP

Sakura — Tue, 05 Mar 2019 12:05:44 GMT

Hi,

I have a question with a Cisco 1921, working with a VPN interface.

Version are: Cisco IOS Software, C1900 Software (C1900-UNIVERSALK9-M), Version 15.1(4)M5, RELEASE SOFTWARE (fc1)

The problem are:

I have two networks:

- First: (net (172.x.x.x)) -> (soft firewall, linux) -> Cisco 1921 -> Internet

- Second: (net (192.x.x.x)) -> Cisco 1921 -> Internet

The first network have a VPN server on linux machine, granting IPs of another subnet. Firewall are the network gateway.

The second network have a VDSLoPOTS connected to grant Internet Access. Cisco 1921 are the gateway, doing NAT translation for network.

I've configured PPTP VPN client on second net's Cisco, and, with adequate configuration, I can see Network 1 from Network 2 (with NAT too). But, I cannot see Network 2 from Network 1.

Configuration:

!
vpdn enable
!
vpdn-group PPTPC
request-dialin
protocol pptp
rotary-group 2
initiate-to ip x.x.x.x
!
controller VDSL 0/0/0
!
interface GigabitEthernet0/1
ip address 192.x.x.x
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
!
interface Ethernet0/0/0
no ip address
pppoe enable group global
pppoe-client dial-pool-number 1
!
interface Dialer0
ip address negotiated
ip mtu 1452
ip nat outside
ip virtual-reassembly in
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication chap pap callin
ppp chap hostname xxx
ppp chap password 0 xxx
ppp pap sent-username xxx password 0 xxx
no cdp enable
!
interface Dialer2
ip address negotiated
ip nat outside
ip virtual-reassembly in
encapsulation ppp
ip tcp adjust-mss 1360
dialer in-band
dialer idle-timeout 0
dialer string 2
dialer vpdn
dialer-group 2
no peer neighbor-route
ppp authentication pap chap ms-chap-v2 callin
ppp chap hostname xxx
ppp chap password 0 xxx
no cdp enable
!
ip forward-protocol nd
!
ip http server
ip http access-class 1
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip nat inside source route-map R2 interface Dialer2 overload
ip nat inside source route-map R0 interface Dialer0 overload
ip route 0.0.0.0 0.0.0.0 Dialer0
ip route 172.x.x.x Dialer2
!
access-list 1 permit 192.x.x.x
access-list 3 permit 172.x.x.x
dialer-list 1 protocol ip permit
dialer-list 2 protocol ip permit
!
no cdp run
!
!
!
route-map R2 permit 1
match interface Dialer2
!
route-map R0 permit 1
match interface Dialer0
!
!
!
control-plane
!
!
banner exec ^CC^C
banner login ^CC^C
!
line con 0
login local
line aux 0
line 2
no activation-character
no exec
transport preferred none
transport input all
transport output lat pad telnet rlogin lapb-ta mop udptn v120 ssh
stopbits 1
line vty 0 4
access-class 1 in
privilege level 15
login local
transport input telnet ssh
!
scheduler allocate 20000 1000
end

Routing table:

Gateway of last resort is 0.0.0.0 to network 0.0.0.0

S*    0.0.0.0/0 is directly connected, Dialer0
      172.x.x.x is variably subnetted, 2 subnets, 2 masks
C        172.x.x.x is directly connected, Dialer2 <-- My VPN address
S        172.x.x.x is directly connected, Dialer2 <-- Remote subnet
      1.1.0.0/32 is subnetted, 2 subnets
C        1.1.1.1 is directly connected, Dialer0
C        1.1.1.67 is directly connected, Dialer0
      192.x.x.x is variably subnetted, 2 subnets, 2 masks
C        192.x.x.x is directly connected, GigabitEthernet0/1
L        192.x.x.x is directly connected, GigabitEthernet0/1

(1.1.0.0 represents Internet Access IP)

Questions:

1º, I cannot enable MPPE. Why?

2º, Can I connect NET1 and NET2 without NAT? I want all host to see between him.

I can configure anything on Cisco router at second net, and Linux machine on first net. I cannot change configuration of Cisco router on first net.

Does the Linux PPTP server

Philip D'Ath — Fri, 27 May 2016 01:04:04 GMT

Does the Linux PPTP server have a route for your subnet via the dynamic connection that is formed? This is going to be tricky.

I don't think you are doing to succeed. If the 1941 has a crypto licence I would change over to IPSec. I would use strongswan on the Linux box.

I have the route at Linux

Sakura — Mon, 30 May 2016 11:39:17 GMT

I have the route at Linux server.

Maybe, I can try to use IPSec on cisco box, but, my knowledge about them are really limited. I haven't a CCNA, and I have some ciscos boxes for creating a WAN between sites. I'm trying to learn how to use each command and configuration for doing the correct configuration for each site and connection.

The final configuration, are, to have 3 different networks, on different offices, connected between them with VPNs or another tecnology who allows me to see from any network, the another two. My suggested topology are use a central point -the linux box at main office-, and connect the other networks to them.

Now I have more problems too, because, the test site have changed internet connection, and, I have the new connection configured but now I cannot see the linux box IP or any other machine, with the same pptp configuration from top.

I've try to use IPsec, but, i

Sakura — Tue, 07 Jun 2016 13:01:05 GMT

I've try to use IPsec, but, i doesn't know how to configure them between Linux box (server) and Cisco. Can someone give me a hand on this?

I need the server on a Linux Box, because, when I have them working, I need to connect another Ciscos to them. Also, the linux box have the best connection and static IP. (At least, one of the Cisco will be working with dynamic IP assignment).

I would use strongswan on

Philip D'Ath — Tue, 07 Jun 2016 19:35:55 GMT

I would use strongswan on Linux, but you are in for a lot of work.

You would be better off getting an extra Cisco box and putting it next to the Linux box to do the VPN work.