Dear All,
After trying the config before and with no success, I have tried another config as below and I get some success but still some issues persist.
aaa authentication login default local
aaa authentication login future_tech local
aaa authorization exec default local
aaa authorization network ft-network local
crypto isakmp client configuration group ft-network
key x.x.x.x
dns 202.125.x.x 8.8.8.8
domain future.com.pk
pool ft_pool
acl SPLIT_TUNEL
save-password
max-users 10
netmask 255.255.255.0
crypto isakmp policy 50
encr 3des
authentication pre-share
group 2
crypto isakmp nat keepalive 50
crypto ipsec transform-set easy_vpn esp-3des esp-sha-hmac
crypto dynamic-map EZV 1
set transform-set easy_vpn
reverse-route
!
crypto map EZVPN client authentication list future_tech
crypto map EZVPN isakmp authorization list ft-network
crypto map EZVPN client configuration address respond
crypto map EZVPN 1 ipsec-isakmp dynamic EZV
ip local pool ft_pool 13.13.13.1 13.13.13.10
ip route 0.0.0.0 0.0.0.0 Multilink1
ip nat inside source list DENY_NAT interface Multilink1 overload
ip access-list extended DENY_NAT
deny ip 192.168.22.0 0.0.0.255 13.13.13.0 0.0.0.255
permit ip 192.168.22.0 0.0.0.255 any
ip access-list extended SPLIT_TUNEL
permit ip 192.168.22.0 0.0.0.255 13.13.13.0 0.0.0.255
permit ip 192.168.200.0 0.0.0.255 13.13.13.0 0.0.0.255
FTNet#show run int multilink 1
Building configuration...
Current configuration : 264 bytes
!
interface Multilink1
description INTERNET
ip address public IP 255.255.255.248
ip verify unicast reverse-path
ip inspect SDM_LOW out
ip nat outside
ip virtual-reassembly
no cdp enable
ppp multilink
ppp multilink group 1
crypto map EZVPN
end
FTNet#show run int gigabitEthernet 0/1
Building configuration...
Current configuration : 256 bytes
!
interface GigabitEthernet0/1
description $FW_INSIDE$
ip address 192.168.22.199 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip virtual-reassembly
ip route-cache flow
duplex auto
speed auto
no mop enabled
end
I am able to do the following:
1. My encryption is working fine and counters are increasing on both Client and server side.
2. I can ping some of the IPs but not all of them; mostly two IPs at a time and one of them is the default gateway IP (192.168.22.199)
3. There is No Firewall behind this router and ACL that is blocking
However I want to know one thing:
From VPN Server I am not able to ping the IP Address that is assigned to the client for example 13.13.13.8 is assigned at the moment:
FTNet#ping 13.13.13.8
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 13.13.13.8, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
FTNet#show cry
FTNet#show crypto isa
FTNet#show crypto isakmp sa
dst src state conn-id slot status
x.x.x.x 119.157.177.205 QM_IDLE 1 0 ACTIVE
FTNet#show crypto ipsec sa
interface: Multilink1
Crypto map tag: EZVPN, local addr x.x.x.x
protected vrf: (none)
local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
remote ident (addr/mask/prot/port): (13.13.13.8/255.255.255.255/0/0)
current_peer 119.157.177.205 port 2030 (Dynamic IP of my USB Internet Dongle)
PERMIT, flags={}
#pkts encaps: 23, #pkts encrypt: 23, #pkts digest: 23
#pkts decaps: 23, #pkts decrypt: 23, #pkts verify: 23
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
When I try to ping my USB Internet Dongle from VPN Server I can ping that
FTNet#ping 119.157.177.205
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 119.157.177.205, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 40/44/48 ms
FTNet#
IS the above behaviour is normal with Easy VPN ????
An image of the client side is also attached for your review:
http://i45.tinypic.com/1geux.jpg
