Hi there,
I want to know if it is possible to reach a server via own WAN ip address on dialer, using a internal LAN device.
So lets say Y is wan and X is LAN. I am a client in X i want to reach Y on port 80, not internal but external. so i browse to Y:80.
This is not accepted by out cisco router, tough i do understand why, i was wondering if there was a way to make it work. See below for the configuration of
our cisco router. I read about NAT on a Stick, but i dont realy understand how that works.
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname xxxxxxxxx_RTR001
!
boot-start-marker
boot-end-marker
!
!
logging buffered 52000
!
aaa new-model
!
!
aaa authentication login default local
aaa authentication login ciscocp_vpn_xauth_ml_1 local
aaa authentication login ciscocp_vpn_xauth_ml_2 local
aaa authorization exec default local
aaa authorization network ciscocp_vpn_group_ml_1 local
aaa authorization network ciscocp_vpn_group_ml_2 local
!
!
!
!
!
aaa session-id common
!
!
no ipv6 cef
ip source-route
ip cef
!
!
!
ip dhcp excluded-address xxxxxxxxx.1 xxxxxxxxx.20
ip dhcp excluded-address xxxxxxxxx.240 xxxxxxxxx.254
!
ip dhcp pool VdR_xxxxxxxxx
network xxxxxxxxx.0 255.255.255.0
default-router xxxxxxxxx.254
dns-server xxxxxxxxx
lease infinite
!
!
no ip domain lookup
ip domain name xxxxxxxxx.nl
!
multilink bundle-name authenticated
!
license udi pid CISCO1921/K9 sn xxxxxxxxx
!
!
username xxxxxx privilege 15 secret 4 xxxxxxxxxxxxx
!
!
redundancy
!
!
!
!
!
policy-map custom-shaper-20000kbps
class class-default
shape average 18800000
!
!
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key xxxxxxxxx address xxxxxxxxx
!
crypto isakmp client configuration group VDR-VPN
key xxxxxxxxx
pool SDM_POOL_1
acl 102
include-local-lan
max-users 15
netmask 255.255.255.0
crypto isakmp profile ciscocp-ike-profile-1
match identity group VDR-VPN
client authentication list ciscocp_vpn_xauth_ml_2
isakmp authorization list ciscocp_vpn_group_ml_2
client configuration address respond
virtual-template 1
!
!
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-SHA1 esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-SHA2 esp-3des esp-sha-hmac
!
crypto ipsec profile CiscoCP_Profile1
set transform-set ESP-3DES-SHA2
set isakmp-profile ciscocp-ike-profile-1
!
!
crypto map SDM_CMAP_1 1 ipsec-isakmp
description Tunnel toxxxxxxxxx
set peer xxxxxxxxx
set transform-set ESP-3DES-SHA
match address 100
!
!
!
!
!
interface Embedded-Service-Engine0/0
no ip address
shutdown
!
interface GigabitEthernet0/0
description WAN_DATA
bandwidth 20000
no ip address
no ip route-cache
load-interval 30
duplex full
speed 100
pppoe enable group global
pppoe-client dial-pool-number 1
no keepalive
no cdp enable
service-policy output custom-shaper-20000kbps
!
interface GigabitEthernet0/1
no ip address
no ip route-cache
duplex full
speed 1000
!
interface GigabitEthernet0/1.X
description DATA_VLANX
encapsulation dot1Q X native
ip address xxxxxxxxx.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
ip verify unicast reverse-path
no ip route-cache
ip tcp adjust-mss 1452
no keepalive
no cdp enable
!
interface GigabitEthernet0/1.XX
description VOICE_VLANXX
encapsulation dot1Q XX
ip address xxxxxxxxx.254 255.255.255.0
ip nat inside
ip virtual-reassembly in
ip verify unicast reverse-path
no ip route-cache
ip tcp adjust-mss 1452
no keepalive
no cdp enable
!
interface Virtual-Template1 type tunnel
ip unnumbered Dialer1
tunnel mode ipsec ipv4
tunnel protection ipsec profile CiscoCP_Profile1
!
interface Dialer1
description DIALER_YYYYYYYY
mtu 1492
ip address negotiated
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip virtual-reassembly in
ip verify unicast reverse-path
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication pap callin
ppp pap sent-username xxxxxxxxx password xxxxxxxxx
no cdp enable
crypto map SDM_CMAP_1
!
ip local pool SDM_POOL_1 xxxxxxxxx.10 xxxxxxxxx.25
ip forward-protocol nd
!
no ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
no ip nat service sip udp port 5060
!
ip nat inside source static tcp xxxxxxxxx.75 4096 interface Dialer1 80
ip nat inside source route-map SDM_RMAP_1 interface Dialer1 overload
ip nat inside source static tcp xxxxxxxxx.185 21 yyyyyyyyyy.58 21 extendable
ip nat inside source static tcp xxxxxxxxx.185 80 yyyyyyyyyy.58 80 extendable
ip nat inside source static tcp xxxxxxxxx.185 5800 yyyyyyyyyy.58 5800 extendable
ip nat inside source static tcp xxxxxxxxx.185 5900 yyyyyyyyyy.58 5900 extendable
ip nat inside source static tcp xxxxxxxxx.185 5901 yyyyyyyyyy.58 5901 extendable
ip nat inside source static tcp xxxxxxxxx.122 80 yyyyyyyyyy.59 80 extendable
ip nat inside source static tcp xxxxxxxxx.140 21 yyyyyyyyyy.60 21 extendable
ip nat inside source static tcp xxxxxxxxx.140 80 yyyyyyyyyy.60 80 extendable
ip nat inside source static tcp xxxxxxxxx.212 21 yyyyyyyyyy.61 21 extendable
ip nat inside source static tcp xxxxxxxxx.212 25 yyyyyyyyyy.61 25 extendable
ip nat inside source static tcp xxxxxxxxx.213 80 yyyyyyyyyy.61 80 extendable
ip nat inside source static xxxxxxxxx.50 yyyyyyyyyy.62
!
!
ip route 0.0.0.0 0.0.0.0 Dialer1
!
access-list 23 permit xxxxxxxxxxxx
access-list 23 permit xxxxxxxxxxxx
access-list 23 permit xxxxxxxxxxxx
access-list 23 permit xxxxxxxxxxxx 0.0.0.7
access-list 23 remark acl_remote_management
access-list 23 permit xxxxxxxxxxxx 0.0.0.255
access-list 23 permit xxxxxxxxxxxx 0.0.0.255
access-list 100 remark CCP_ACL Category=4
access-list 100 remark IPSec Rule
access-list 100 permit ip xxxxxxxxxxxx 0.0.0.255 xxxxxxxxxxxx 0.0.0.255
access-list 101 remark CCP_ACL Category=4
access-list 101 permit ip xxxxxxxxxxxx 0.0.0.255 any
access-list 102 remark CCP_ACL Category=4
access-list 102 permit ip xxxxxxxxxxxx 0.0.0.255 any
access-list 110 remark CCP_ACL Category=16
access-list 110 remark IPSec Rule
access-list 110 deny ip xxxxxxxxxxxx 0.0.0.255 xxxxxxxxxxxx 0.0.0.255
access-list 110 permit ip xxxxxxxxxxxx 0.0.0.255 any
access-list 110 permit ip xxxxxxxxxxxx 0.0.0.255 any
dialer-list 1 protocol ip permit
!
!
!
!
route-map SDM_RMAP_1 permit 1
match ip address 110
!
!
snmp-server community RSO RO 23
!
!
!
control-plane
!
!
banner motd ^CCC
****BANNER MOTD****
^C
!
line con 0
line aux 0
line 2
no activation-character
no exec
transport preferred none
transport input all
transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
stopbits 1
line vty 0 4
access-class 23 in
transport input all
line vty 5 15
access-class 23 in
transport input telnet ssh
!
scheduler allocate 20000 1000
