Hi
after the last changes, the tunnels going to UP, I have access to all private Lans, 192.168.0.0., 10.10.0.0. 172.17.0.0., but I don't have internet access. This is full my running-config:
if I change
crypto ipsec transform-set ESP_SHA_AES256 esp-aes 256 esp-sha-hmac
mode tunnel
to mode transport tunnels going down??
Cisco_R892#show run
Building configuration...
Current configuration : 10266 bytes
!
! Last configuration change at 13:46:55 EEST Tue Oct 15 2019 by test
!
version 15.5
service timestamps debug datetime msec localtime
service timestamps log datetime msec localtime
service password-encryption
!
hostname Cisco_R892
!
boot-start-marker
boot-end-marker
!
aqm-register-fnf
!
logging buffered 51200 warnings
enable secret 4 tnhtc92DXBhelxjYk8LWJrPV36S2i4ntXrpb4RFmfqY
!
no aaa new-model
ethernet lmi ce
clock timezone EET 2 0
clock summer-time EEST recurring last Sun Mar 3:00 last Sun Oct 4:00
!
crypto pki trustpoint TP-self-signed-3548181929
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-3548181929
revocation-check none
rsakeypair TP-self-signed-3548181929
!
!
crypto pki certificate chain TP-self-signed-3548181929
certificate self-signed 01
3082022B 30820194 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
xxxxxx
quit
!
ip vrf WAN
rd 1:0
!
ip dhcp excluded-address 192.168.226.1 192.168.226.50
ip dhcp excluded-address 192.168.226.200 192.168.226.254
ip dhcp excluded-address 10.10.226.1 10.10.226.10
!
ip dhcp pool locallan
network 192.168.226.0 255.255.255.0
default-router 192.168.226.1
dns-server 192.168.100.10 192.168.100.11
option 242 ascii MCIPADD=10.10.100.10,TFTPSRVR=10.10.100.10,HTTPSRVR=10.10.100.10,TLSSRVR=10.10.100.10,SIP_CONTROLLER_LIST=10.10.100.10
option 42 ip 192.168.100.10
!
ip dhcp pool Ip Voice phone
network 10.10.226.0 255.255.255.0
default-router 10.10.226.1
option 242 ascii MCIPADD=10.10.100.10,TFTPSRVR=10.10.100.10,HTTPSRVR=10.10.100.10,HTTPSSRVR=10.10.100.10
dns-server 192.168.100.10
option 42 ip 10.10.100.10
!
!
no ip domain lookup
ip domain name xxxx.bg
ip inspect name INSPECT_TRAFFIC dns
ip inspect name INSPECT_TRAFFIC ftp
ip inspect name INSPECT_TRAFFIC h323
ip inspect name INSPECT_TRAFFIC https
ip inspect name INSPECT_TRAFFIC icmp
ip inspect name INSPECT_TRAFFIC imap
ip inspect name INSPECT_TRAFFIC pop3
ip inspect name INSPECT_TRAFFIC netshow
ip inspect name INSPECT_TRAFFIC rcmd
ip inspect name INSPECT_TRAFFIC realaudio
ip inspect name INSPECT_TRAFFIC rtsp
ip inspect name INSPECT_TRAFFIC esmtp
ip inspect name INSPECT_TRAFFIC sqlnet
ip inspect name INSPECT_TRAFFIC streamworks
ip inspect name INSPECT_TRAFFIC tftp
ip inspect name INSPECT_TRAFFIC tcp
ip inspect name INSPECT_TRAFFIC udp
ip inspect name INSPECT_TRAFFIC vdolive
ip inspect name INSPECT_TRAFFIC http
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
license udi pid C892FSP-K9 sn FCZ210411N0
no spanning-tree vlan 10
username xxx privilege 15 secret 5 $1$yc5I$gKRJZGO4KMfMY55Qkyt0
username xxx privilege 15 secret 5 $1$I22e$cNpyaIpmSLWOI2l9.8O.
username xxx privilege 15 secret 5 $1$HqT6$3mAl/xDadRRu1swSWGVS/
username test privilege 15 secret 5 $1$3DlJ$7DsxCZpORcq5pldWgEA.
!
!
no cdp run
!
!
crypto keyring KEYRING vrf WAN
pre-shared-key address 0.0.0.0 0.0.0.0 key password
!
crypto isakmp policy 2
encr aes 256
authentication pre-share
group 2
crypto isakmp key password address public ip -1 address office 3
crypto isakmp key password address public ip -2 address office 3
crypto isakmp keepalive 10 5
crypto isakmp profile ISAKMP_PROF
keyring KEYRING
match identity address 0.0.0.0 WAN
!
!
crypto ipsec transform-set ESP_SHA_AES256 esp-aes 256 esp-sha-hmac
mode tunnel
!
crypto ipsec profile Cisco_pass
set transform-set ESP_SHA_AES256
set isakmp-profile ISAKMP_PROF
!
!
!
interface Tunnel2
description "Internet Tunnel"
bandwidth 1000
ip address 172.30.2.226 255.255.255.0
ip mtu 1400
ip nhrp authentication DMVPN_NW
ip nhrp map 172.30.2.200 public ip -1 address office 3
ip nhrp network-id 100000
ip nhrp holdtime 360
ip nhrp nhs 172.30.2.200
ip tcp adjust-mss 1300
delay 1000
tunnel source GigabitEthernet9
tunnel destination public ip -1 address office 3
tunnel key 100000
tunnel vrf WAN
tunnel protection ipsec profile Cisco_pass
!
interface Tunnel3
description "Internet Tunnel"
bandwidth 1000
ip address 172.30.4.226 255.255.255.0
ip mtu 1400
ip nhrp authentication DMVPN_NW
ip nhrp map 172.30.4.200 public ip -2 address office 3
ip nhrp network-id 100000
ip nhrp holdtime 360
ip nhrp nhs 172.30.4.200
ip tcp adjust-mss 1300
delay 1000
tunnel source GigabitEthernet9
tunnel destination public ip -2 address office 3
tunnel key 100000
tunnel vrf WAN
tunnel protection ipsec profile Cisco_pass
!
interface GigabitEthernet0
switchport trunk native vlan 200
switchport mode trunk
no ip address
no cdp enable
!
interface GigabitEthernet1
switchport trunk native vlan 200
switchport mode trunk
no ip address
!
interface GigabitEthernet2
switchport trunk native vlan 200
switchport mode trunk
no ip address
!
interface GigabitEthernet3
switchport access vlan 9
no ip address
!
interface GigabitEthernet4
switchport access vlan 20
no ip address
!
interface GigabitEthernet5
switchport access vlan 30
no ip address
!
interface GigabitEthernet6
no ip address
!
interface GigabitEthernet7
switchport access vlan 10
no ip address
!
interface GigabitEthernet8
no ip address
shutdown
duplex auto
speed auto
!
interface GigabitEthernet9
description "To ISP "
ip vrf forwarding WAN
ip address public ip address office 2
ip virtual-reassembly in
duplex auto
speed auto
no cdp enable
!
interface Vlan1
no ip address
shutdown
!
interface Vlan9
ip address 192.168.30.1 255.255.255.0
!
interface Vlan10
no ip address
shutdown
!
interface Vlan20
description "Vlan 20"
ip address 10.20.226.1 255.255.255.0
!
interface Vlan25
description "Voice"
ip address 10.10.226.1 255.255.255.0
!
interface Vlan30
description "Vlan 30"
ip address 172.16.141.105 255.255.255.248
!
interface Vlan200
description "Inside interface"
ip address 192.168.226.1 255.255.255.0
ip virtual-reassembly in
!
!
router eigrp 100
network 10.10.226.0 0.0.0.255
network 10.20.226.0 0.0.0.255
network 172.16.141.104 0.0.0.7
network 172.30.1.0 0.0.0.255
network 172.30.2.0 0.0.0.255
network 192.168.30.0
network 192.168.226.0
passive-interface Vlan200
passive-interface Vlan25
!
ip forward-protocol nd
no ip http server
ip http authentication local
ip http secure-server
!
!
ip tftp source-interface Vlan200
ip route vrf WAN 0.0.0.0 0.0.0.0 gateway ISP office 2
!
!
snmp-server community XXXX RO 1
access-list 1 remark "SNMP allowed"
access-list 1 permit 192.168.96.254
access-list 100 remark "NAT ACL"
access-list 100 permit ip 192.168.226.0 0.0.0.255 any
access-list 110 remark "Outside interface inbound ACL"
access-list 110 permit tcp any host 192.168.1.226 eq 443
access-list 110 permit tcp any host 192.168.1.226 eq 22
access-list 110 permit udp host 80.96.120.253 host 192.168.1.226 eq ntp
access-list 110 permit udp any host 192.168.1.226 eq non500-isakmp
access-list 110 permit udp any host 192.168.1.226 eq isakmp
access-list 110 permit esp any host 192.168.1.226
access-list 110 permit ahp any host 192.168.1.226
access-list 110 permit gre any host 192.168.1.226
access-list 110 permit icmp any host 192.168.1.226 echo
access-list 110 permit icmp any host 192.168.1.226 echo-reply
access-list 110 permit icmp any host 192.168.1.226 time-exceeded
access-list 110 permit icmp any host 192.168.1.226 unreachable
access-list 110 permit icmp any any
access-list 110 deny ip 10.0.0.0 0.255.255.255 any
access-list 110 deny ip 172.16.0.0 0.15.255.255 any
access-list 110 deny ip 192.168.0.0 0.0.255.255 any
access-list 110 deny ip 127.0.0.0 0.255.255.255 any
access-list 110 deny ip host 255.255.255.255 any
access-list 110 deny ip host 0.0.0.0 any
access-list 110 deny ip any any log
access-list 112 permit ip any host 192.168.129.55
access-list 112 permit ip any 172.16.141.0 0.0.0.255
access-list 112 permit ip any host 192.168.0.21
access-list 112 permit ip any host 10.30.14.22
access-list 112 permit udp any host 192.168.200.1 eq domain
access-list 112 permit ip any host 172.16.1.10
access-list 112 deny ip any any
!
control-plane
!
mgcp behavior rsip-range tgcp-only
mgcp behavior comedia-role none
mgcp behavior comedia-check-media-src disable
mgcp behavior comedia-sdp-force disable
!
mgcp profile default
!
line con 0
login local
no modem enable
line aux 0
line vty 0 4
privilege level 15
login local
transport input telnet ssh
line vty 5 15
privilege level 15
login local
transport input telnet ssh
!
scheduler allocate 20000 1000
ntp server 128.138.141.172
!
end
