Hi,
I have an 1811 with dual WAN set up. There is a policy based route which sends all traffic from workstations out over our ADSL line whilst allowing certain servers access accross our Bonded ADSL. This works nicely.
There are NAT rules set up as well that allow access to the servers and some machines from both external WAN addresses. Unfortunately it seems that only the servers denied by the PBR are capable of being RDPd to on both external addresses.
For example, the server on local ip 192.168.2.240 can be RDPd to externally on 80.229.x.x:33899 and 141.0.x.b:33899 but the workstation on 192.168.2.50 can only be reached via 80.229.x.x:33893 but not 141.0.x.x:33897.
I imagine denying the various workstations on the PBR access list will allow them to be accessed from both external IP addresses, but ideally I still want them to use the ADSL for their outbound connections.
hostname mydomainFirewall
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 warnings
!
username xxxxx privilege 15 secret 5 $1$cJt8$sh/b4HM9bdUQkgvRylyOV.
username xxx privilege 15 secret 5 $1$rPuf$JJA4UwlqbRwLc.sarSgMp.
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
no aaa new-model
ip subnet-zero
!
!
ip cef
!
!
ip domain name mydomain.com
ip name-server 8.8.8.8
ip name-server 8.8.4.4
ip ips po max-events 100
no ftp-server write-enable
vty-async
!
!
!
!
!
crypto isakmp policy 10
encr 3des
authentication pre-share
group 2
lifetime 28800
crypto isakmp key xxxxxxxxxxxx address 31.24.x.x no-xauth
crypto isakmp key xxxxxxxxxxxx address 109.238.x.x
crypto isakmp keepalive 10 periodic
!
!
crypto ipsec transform-set 3DESSHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-SHA1 esp-3des esp-sha-hmac
!
crypto map SDM_CMAP_1 1 ipsec-isakmp
description Tunnel to31.24.x.x
set peer 31.24.x.x
set transform-set ESP-3DES-SHA
match address 100
crypto map SDM_CMAP_1 2 ipsec-isakmp
description Tunnel to109.238.x.x
set peer 109.238.x.x
set transform-set ESP-3DES-SHA1
match address 102
!
!
!
interface FastEthernet0
description $ETH-WAN$
ip address 141.0.a.b 255.255.255.248
ip access-group WAN_Fast in
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
no cdp enable
crypto map SDM_CMAP_1
!
interface FastEthernet1
description $ETH-WAN$
ip address dhcp
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
no cdp enable
!
interface FastEthernet2
switchport access vlan 2
no ip address
no cdp enable
!
interface FastEthernet3
no ip address
no cdp enable
!
interface FastEthernet4
no ip address
no cdp enable
!
interface FastEthernet5
no ip address
no cdp enable
!
interface FastEthernet6
switchport access vlan 2
no ip address
no cdp enable
!
interface FastEthernet7
no ip address
no cdp enable
!
interface FastEthernet8
no ip address
no cdp enable
!
interface FastEthernet9
no ip address
no cdp enable
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-FE 2$
ip address 192.168.2.2 255.255.255.0
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1452
ip policy route-map PBR_VLAN1
!
interface Async1
no ip address
!
ip classless
ip route 0.0.0.0 0.0.0.0 141.0.a.a
ip route 192.168.4.0 255.255.255.0 192.168.2.254
!
!
ip http server
ip http access-class 52
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source route-map SDM_RMAP_1 interface FastEthernet0 overload
ip nat inside source route-map SDM_RMAP_2 interface FastEthernet1 overload
ip nat inside source static tcp 192.168.2.51 3389 80.229.x.x 3389 route-map SDM_RMAP_2 extendable
ip nat inside source static tcp 192.168.2.50 3389 80.229.x.x 33891 route-map SDM_RMAP_2 extendable
ip nat inside source static tcp 192.168.2.53 3389 80.229.x.x 33892 route-map SDM_RMAP_2 extendable
ip nat inside source static tcp 192.168.2.51 3389 80.229.x.x 33893 route-map SDM_RMAP_2 extendable
ip nat inside source static tcp 192.168.2.240 3389 80.229.x.x 33899 route-map SDM_RMAP_2 extendable
ip nat inside source static tcp 192.168.2.240 5001 141.0.a.b 5001 route-map SDM_RMAP_1 extendable
ip nat inside source static tcp 192.168.2.51 3389 141.0.a.b 33897 route-map SDM_RMAP_1 extendable
ip nat inside source static tcp 192.168.2.53 3389 141.0.a.b 33898 route-map SDM_RMAP_1 extendable
ip nat inside source static tcp 192.168.2.240 3389 141.0.a.b 33899 route-map SDM_RMAP_1 extendable
ip nat inside source static 192.168.2.200 141.0.a.c route-map SDM_RMAP_1
ip nat inside source static 192.168.2.204 141.0.a.d route-map SDM_RMAP_1
!
ip access-list extended WAN_Fast
remark CCP_ACL Category=17
remark IPSec Rule
permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
permit udp host 109.238.x.x host 141.0.a.b eq non500-isakmp
permit udp host 109.238.x.x host 141.0.a.b eq isakmp
permit esp host 109.238.x.x host 141.0.a.b
permit ahp host 109.238.x.x host 141.0.a.b
remark IPSec Rule
permit ip 192.168.3.0 0.0.0.255 192.168.2.0 0.0.0.255
permit udp host 31.24.x.x host 141.0.a.b eq non500-isakmp
permit udp host 31.24.x.x host 141.0.a.b eq isakmp
permit esp host 31.24.x.x host 141.0.a.b
permit ahp host 31.24.x.x host 141.0.a.b
permit tcp any host 141.0.a.c eq smtp
permit tcp any host 141.0.a.c eq www
permit tcp any host 141.0.a.c eq 443
permit tcp any host 141.0.a.d eq 3389
permit tcp any host 141.0.a.c eq 3389
permit tcp any host 141.0.a.c eq 990
permit tcp any host 141.0.a.c eq 999
permit tcp any host 141.0.a.c eq 5721
permit tcp any host 141.0.a.c eq 5678
permit tcp any host 141.0.a.c eq 5679
permit tcp any host 141.0.a.c eq 26675
deny ip any host 141.0.a.c
deny ip any host 141.0.a.d
permit ip any any
ip access-list extended WAN_Slow
permit ip any any
ip access-list extended workstations
deny ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
deny ip 192.168.2.0 0.0.0.255 192.168.3.0 0.0.0.255
deny ip 192.168.2.0 0.0.0.255 192.168.4.0 0.0.0.255
deny ip host 192.168.2.200 any
deny ip host 192.168.2.202 any
deny ip host 192.168.2.204 any
deny ip host 192.168.2.240 any
permit ip 192.168.2.0 0.0.0.255 any
permit ip 192.168.4.0 0.0.0.255 any
deny ip any any
!
access-list 51 remark CCP_ACL Category=16
access-list 51 permit 192.168.2.0 0.0.0.255
access-list 52 permit 192.168.3.0 0.0.0.255
access-list 52 permit 192.168.2.0 0.0.0.255
access-list 100 remark CCP_ACL Category=4
access-list 100 remark IPSec Rule
access-list 100 permit ip 192.168.2.0 0.0.0.255 192.168.3.0 0.0.0.255
access-list 101 remark CCP_ACL Category=2
access-list 101 remark IPSec Rule
access-list 101 deny ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 101 remark IPSec Rule
access-list 101 deny ip 192.168.2.0 0.0.0.255 192.168.3.0 0.0.0.255
access-list 101 permit ip 192.168.2.0 0.0.0.255 any
access-list 101 permit ip 192.168.4.0 0.0.0.255 any
access-list 102 remark CCP_ACL Category=4
access-list 102 remark IPSec Rule
access-list 102 permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
no cdp run
!
route-map PBR_VLAN1 permit 10
match ip address workstations
set ip next-hop dynamic dhcp
!
route-map SDM_RMAP_1 permit 1
match ip address 101
match interface FastEthernet0
!
route-map SDM_RMAP_2 permit 1
match ip address 101
match interface FastEthernet1
!
!
!
!
control-plane
!
!
line con 0
login local
line 1
stopbits 1
speed 115200
flowcontrol hardware
line aux 0
line vty 0 4
access-class 52 in
privilege level 15
login local
transport input telnet ssh
line vty 5 15
access-class 52 in
privilege level 15
login local
transport input telnet ssh
!
no scheduler allocate
end
