VPN issue after configuring the Firewall by using CCP on Cisco 881 router

[phyopaingag]

Hi,

I have got a problem to access to the servers inside the LAN through VPN tunnel after setting up the firewall on the Cisco 881-K9 router.

The configuration, attached file (RunningConfig_with_vpn_before_firewall_enabled.txt), is working fine for VPN users to access to the LAN servers.

I used the CLI when I was doing that configuration.

But for firewall, I used the Cisco Configuration Professional. After setting up the firewall by using CCP, the problem occured like, VPN connection from the client machine to the server is still OK to connect. NAT is still working fine. E-mail traffic to the Mail Server don't get problem. Still can use Outlook Web Access.

But vpn users can ping only to one server which is mail server. Actually there are 2 more servers and vpn users can't get to these 2 servers.

Please someone check my configuration files attached and advise me back.

Thanks a lot in advance.

[Atul Singh · Accepted solution]

Hi Phyo,

I think, with this config they are able to reach only 192.168.1.2. VPN users also fall in the outside zone and you should inspect the traffic from VPN users to Internal n/w (Or servers) in out-in zone pair.

Something like this:

access-list 199 permit ip

!

class-map type inspect vpn-inbound

match access-group 199

!

policy-map type inspect sdm-pol-NATOutsideToInside-1

class type inspect vpn-inbound

inspect

!

-Atul