I am trying to setup a Cisco 2610 running IOS 12.3(1) for remote access VPNs from Cisco VPN Client 4.02(d) running on Windows.
I use certificate authentication (rsa-sig) without XAUTH. Both the router and clients get certificates from a Microsoft Windows 2000 CA. VPN connections are established without problem. However, there is no traffic flowing through the tunnel. I cannot ping from either side.
The client's status bar (bottom of the screen) says:
bytes in(0), bytes out(38434). So it looks like client cannot receive incoming packet.
Any suggestions?
Note that in the IOS config attached below, the isakmp client configuration group OU1 was never matched. The Cisco documentation said the group name would match the OU field in client certificate. My client cert has the OU field set to "OU1", but it did not work. That's why I also have a "crypto isakmp client configuration address-pool local" statement to define the IP pool.
Here is my IOS config:
version 12.3
!
hostname cmohanan12
!
clock timezone PT -8
no ip subnet-zero
!
!
ip domain name martsoft.com
!
ip audit notify log
ip audit po max-events 100
!
crypto ca trustpoint mart-th
enrollment mode ra
enrollment url http://192.168.10.66:80/certsrv/mscep/mscep.dll
usage ike
serial-number
crl optional
!
crypto ca certificate chain mart-th
certificate xxxxx
certificate xxxxx
nvram:mart#62ACA.cer
!
crypto isakmp policy 1
encr aes 256
group 5
!
crypto isakmp client configuration address-pool local vpn-pool1
!
crypto isakmp client configuration group OU1
dns 192.168.10.11
domain martsoft.com
pool vpn-pool1
acl 199
!
crypto ipsec transform-set tran1 esp-des esp-md5-hmac
crypto ipsec transform-set tran2 esp-des esp-sha-hmac
crypto ipsec transform-set tran3 ah-md5-hmac esp-des
crypto ipsec transform-set tran4 ah-sha-hmac esp-des
crypto ipsec transform-set tran5 esp-3des esp-md5-hmac
crypto ipsec transform-set tran6 esp-3des esp-sha-hmac
crypto ipsec transform-set tran7 esp-aes esp-md5-hmac
crypto ipsec transform-set tran8 esp-aes esp-sha-hmac
!
crypto dynamic-map dyntmp1 1
set transform-set tran1 tran2 tran8 tran7 tran5 tran6
!
!
crypto map dynmap1 client configuration address respond
crypto map dynmap1 1 ipsec-isakmp dynamic dyntmp1
!
interface Ethernet0/0
ip address 192.168.10.23 255.255.255.0
half-duplex
!
interface Serial0/0
no ip address
no ip mroute-cache
shutdown
!
interface Serial0/1
no ip address
shutdown
!
interface Ethernet1/0
ip address 172.16.172.40 255.255.255.0
half-duplex
crypto map dynmap1
!
interface Ethernet1/1
no ip address
shutdown
half-duplex
!
interface Ethernet1/2
no ip address
shutdown
half-duplex
!
interface Ethernet1/3
no ip address
shutdown
half-duplex
!
ip local pool vpn-pool1 192.168.10.205 192.168.10.209
ip http server
no ip http secure-server
ip classless
ip route 0.0.0.0 0.0.0.0 192.168.10.1
!
access-list 199 permit ip 192.168.10.0 0.0.0.255 any
!
line con 0
timeout login response 0
line aux 0
line vty 0 4
password cisco
login
!
end
