Hi
I'm trying to configure a site-to-site VPN between three routers one of which is passive with multiple ACLs and I'm having a bit of a meltdown. Some of the ACLs work , the VPN works If I don't apply the ACLs as soon as I apply the ACLs it stops working
Thanks In advnace
The lab specifies there should be four ACLs :
NETWORK 2 and NETWORK 1 should be able to communicate via the VPN, without restrictions.
NETWORK 2 should be able to communicate to the ciscolab.com server but without the VPN.
NETWORK 1 can only communicate to the INTERNET if the communication is initiated by a NETWORK 1 user. This means that communication initiated by INTERNET devices should not be allowed.
INTERNET devices can communicate only to the pocoloco.com device and only for HTTPS communication. < This seems to work.
Router 1
ip access-list extended VPN Applied with VPN
deny ip host 172.10.0.51 172.10.0.0 0.0.0.31
permit ip 172.10.0.32 0.0.0.15 172.10.0.0 0.0.0.31
permit ip 172.10.0.48 0.0.0.7 172.10.0.0 0.0.0.31
ip access-list extended INTERNET Applied S/0/0/0 OUTBOUND
permit ip 172.10.0.32 0.0.0.15 209.165.100.96 0.0.0.31
permit ip 172.10.0.48 0.0.0.7 209.165.100.96 0.0.0.31
ip access-list extended INTERNET_TO_CISCOLAB.COM Applied s0/0/0 INBOUND
permit tcp 209.165.100.96 0.0.0.31 host 172.10.0.51 eq 443
deny ip any any
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 5
!
crypto isakmp key zDGkUPC5! address 209.165.100.134
!
!
!
crypto ipsec transform-set VPN-SET esp-aes esp-sha-hmac
!
crypto map VPN-MAP 10 ipsec-isakmp
description VPN connection to Router 2
set peer 209.165.100.134
set transform-set VPN-SET
match address VPN
router 2
ip access-list extended VPN
access-list 110 permit ip 172.10.0.0 0.0.0.31 172.10.0.32 0.0.0.15
access-list 110 permit ip 172.10.0.0 0.0.0.31 172.10.0.48 0.0.0.7
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 5
!
crypto isakmp key zDGkUPC5! address 209.165.100.129
!
!
!
crypto ipsec transform-set VPN-SET esp-aes esp-sha-hmac
!
crypto map VPN-MAP 10 ipsec-isakmp
description VPN connection to Router 1
set peer 209.165.100.129
set transform-set VPN-SET
match address VPN
