Normally I'd have a rough idea of where to start, but I'm not sure if this is a NAT/ZBF or IPSEC issue at this stage.
Without the crypto map map1 assigned to the outside interface, everything works fine. Internal hosts can access the internet, I can ping the router externally. So the ZBF is allowing the required traffic.
As soon as I assign crypto map map1 to GigabitEthernet0 (WAN), the inside hosts can no longer access the internet. They can however ping/access hosts across the VPN tunnel. So basically, as soon as the tunnel comes up, access to anything outside that cryptomap ceases to function.
As far as I can tell everything is correct, so I'm a bit baffled. Hoping someone can take a look over the config.
=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2012.09.11 15:38:47 =~=~=~=~=~=~=~=~=~=~=~=
sh run
Building configuration...
Current configuration : 7711 bytes
!
! No configuration change since last restart
version 15.1
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname RTR1
!
boot-start-marker
boot system flash c890-universalk9-mz.151-4.M2.bin
boot-end-marker
!
!
security authentication failure rate 3 log
security passwords min-length 6
logging buffered 4096
logging console critical
!
aaa new-model
!
!
aaa authentication login NetworkAdmins group radius local
aaa authorization console
!
!
!
!
!
aaa session-id common
!
crypto pki token default removal timeout 0
!
!
no ip source-route
!
!
!
ip dhcp excluded-address 10.4.1.1 10.4.1.99
ip dhcp excluded-address 10.4.1.201 10.4.1.254
ip dhcp excluded-address 10.4.2.1 10.4.2.99
ip dhcp excluded-address 10.4.2.201 10.4.2.254
!
ip dhcp pool lv-data
network 10.4.1.0 255.255.255.0
domain-name XXXXX.com
dns-server 10.1.10.1 8.8.8.8
default-router 10.4.1.254
lease 7
!
ip dhcp pool lv-voice
network 10.4.2.0 255.255.255.0
domain-name XXXXX.com
default-router 10.4.2.254
dns-server 10.1.10.1
lease 7
!
!
ip cef
no ip bootp server
ip domain name XXXX.com
ip name-server 10.1.10.1
ip name-server 8.8.8.8
no ipv6 cef
!
!
!
!
multilink bundle-name authenticated
!
!
object-group network locationB-networks
10.4.1.0 255.255.255.0
10.4.2.0 255.255.255.0
!
object-group network locationA-networks
10.1.10.0 255.255.255.0
10.1.11.0 255.255.255.0
10.1.12.0 255.255.255.0
10.1.13.0 255.255.255.0
!
username admin privilege 15 secret
crypto ikev2 proposal ESP-AES-SHA
encryption aes-cbc-128
integrity sha1
group 2
!
crypto ikev2 policy policy1
proposal ESP-AES-SHA
!
crypto ikev2 keyring keyring1
peer locationA
address 209.XX.XX.130
pre-shared-key XXXXXXX
!
!
!
crypto ikev2 profile locationA
match identity remote address 209.XX.XX.130 255.255.255.255
authentication local pre-share
authentication remote pre-share
keyring keyring1
!
!
!
ip tcp synwait-time 10
ip ssh time-out 60
!
class-map type inspect match-all management
match access-group name manage-ports
match access-group name manage-hosts
match protocol tcp
class-map type inspect match-all icmp
match protocol icmp
class-map type inspect match-all vpn-traffic
match access-group name vpn-protocols
class-map type inspect match-any all-protocols
match protocol tcp
match protocol udp
match protocol icmp
!
!
policy-map type inspect inside-to-inside
class class-default
pass
policy-map type inspect inside-to-self
class class-default
pass
policy-map type inspect self-to-any
class class-default
pass
policy-map type inspect inside-to-outside
class type inspect all-protocols
inspect
class class-default
drop
policy-map type inspect outside-to-self
class class-default
pass
!
zone security inside
zone security outside
zone-pair security inside-to-inside source inside destination inside
service-policy type inspect inside-to-inside
zone-pair security inside-to-outside source inside destination outside
service-policy type inspect inside-to-outside
zone-pair security inside-to-self source inside destination self
service-policy type inspect inside-to-self
zone-pair security outside-to-self source outside destination self
service-policy type inspect outside-to-self
!
!
!
!
crypto map map1 10 ipsec-isakmp
set peer 209.XX.XX.130
set ikev2-profile locationA
match address locationA-cryptomap
!
!
!
!
!
interface FastEthernet0
switchport voice vlan 6
no ip address
!
interface FastEthernet1
switchport voice vlan 6
no ip address
!
interface FastEthernet2
switchport voice vlan 6
no ip address
!
interface FastEthernet3
switchport voice vlan 6
no ip address
!
interface FastEthernet4
switchport voice vlan 6
no ip address
!
interface FastEthernet5
switchport voice vlan 6
no ip address
!
interface FastEthernet6
switchport voice vlan 6
no ip address
!
interface FastEthernet7
switchport voice vlan 6
no ip address
!
interface FastEthernet8
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
shutdown
duplex auto
speed auto
no cdp enable
!
interface GigabitEthernet0
description $FW_OUTSIDE$$ETH-WAN$
ip address 24.120.XXX.10X 255.255.255.224
no ip redirects
no ip proxy-arp
ip flow ingress
ip nat outside
ip virtual-reassembly in
ip verify unicast reverse-path
zone-member security outside
duplex auto
speed auto
no cdp enable
!
interface Vlan1
description Data$FW_INSIDE$
ip address 10.4.1.254 255.255.255.0
no ip redirects
ip flow ingress
ip nat inside
ip virtual-reassembly in
zone-member security inside
ip tcp adjust-mss 1452
!
interface Vlan6
description Voice$FW_INSIDE$
ip address 10.4.2.254 255.255.255.0
no ip redirects
no ip proxy-arp
zone-member security inside
ip flow ingress
ip nat inside
ip virtual-reassembly in
ip tcp adjust-mss 1452
!
interface Async1
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
encapsulation slip
!
ip forward-protocol nd
!
!
ip http server
ip http authentication local
no ip http secure-server
ip nat inside source route-map nat-default interface GigabitEthernet0 overload
ip route 0.0.0.0 0.0.0.0 24.XXX.135.XX
!
ip access-list extended manage-hosts
permit ip 209.XX.XX.128 0.0.0.15 any
ip access-list extended manage-protocols
permit tcp any any eq 443
permit tcp any any eq 22
ip access-list extended nat-default
deny ip object-group locationB object-group locationA
permit ip 10.4.1.0 0.0.0.255 any
permit ip 10.4.2.0 0.0.0.255 any
ip access-list extended locationA-cryptomap
permit ip object-group locationB-networks object-group locationA-networks
ip access-list extended vpn-protocols
permit esp any any
permit udp any any eq isakmp
permit udp any any eq non500-isakmp
permit ahp any any
ip access-list extended vty-access
permit tcp 10.4.1.0 0.0.0.255 any eq 22 log
permit tcp 10.1.10.0 0.0.0.255 any eq 22 log
permit tcp 10.1.5.0 0.0.0.255 any eq 22 log
!
logging trap debugging
no cdp run
!
!
!
!
route-map nat-default permit 10
match ip address nat-default
!
!
!
!
!
control-plane
!
!
!
!
mgcp profile default
!
!
!
!
banner login ^C
*************** >>> AUTHORIZED ACCESS ONLY! <<< ***************
Disconnect IMMEDIATELY if you are not an authorized user!!!
All actions are monitored and recorded.
*************** >>> AUTHORIZED ACCESS ONLY! <<< ***************
^C
banner motd ^C
*************** >>> AUTHORIZED ACCESS ONLY! <<< ***************
Disconnect IMMEDIATELY if you are not an authorized user!!!
All actions are monitored and recorded.
*************** >>> AUTHORIZED ACCESS ONLY! <<< ***************
^C
!
line con 0
exec-timeout 30 0
logging synchronous
transport output telnet ssh
line 1
modem InOut
stopbits 1
speed 115200
flowcontrol hardware
line aux 0
transport output telnet ssh
line vty 0 4
access-class vty-access in
privilege level 15
logging synchronous
login authentication NetworkAdmins
transport input ssh
transport output telnet ssh
line vty 5 15
access-class vty-access in
privilege level 15
logging synchronous
login authentication NetworkAdmins
transport input ssh
transport output telnet ssh
!
scheduler interval 500
ntp update-calendar
ntp server 208.73.56.29 prefer source GigabitEthernet0
end
