I have a Cisco 881 VPN Router (TX) which connects to the Concentrator at our corporate office (NY). The TX subnet is 10.16.x.x. The corporate subnet is 10.1.x.x, 10.2.x.x, 10.9.x.x.
Right now, the 881 router is only used for VPN to corporate, but, I would like to use it our primary router. We have to ISP's, and I would like to allow traffic to come in on either interface to our internal LAN to a few servers.
LAN - 10.16.1.3 / 255.255.0.0
ISP1 - 175.15.110.242 / 255.255.255.240: Gateway: 175.15.110.254
ISP2 - 211.106.234.114 255.255.255.240, Gateway: 211.106.234.113
Required NAT / port forwarding:
211.106.234.115 -> 10.16.9.104 / Forward ports 443 and 25
175.15.110.243 -> 10.16.9.104 / Forward ports 443 and 25
211.106.234.117 -> 10.16.9.109 / Forward port 80
175.15.110.145 -> 10.16.9.109 / Forward port 80
211.106.234.118 -> 10.16.9.112 / Forward port 3389
175.15.110.247 -> 10.16.9.112 / Forward port 3389
I would like ISP1 to be the primary route out to the Internet. But, I would like it to route out ISP2 if ISP1 fails
Here is current configuration. I removed most of the crypto / certificate info and included only the most relevant information. Please correct any mistakes in this configuration as needed.
version 15.0
no service pad
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
no service password-encryption
!
hostname TXFW1
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 warnings
enable secret 5 12345
!
no aaa new-model
!
!
!
memory-size iomem 10
!
ip source-route
!
ip cef
no ip domain lookup
ip domain name mydomain.com
ip name-server 10.1.9.101
ip name-server 10.1.9.102
ip inspect max-incomplete low 320
ip inspect max-incomplete high 400
ip inspect name FIREWALL ftp
ip inspect name FIREWALL tcp
ip inspect name FIREWALL udp
no ipv6 cef
!
!
multilink bundle-name authenticated
license udi pid
!
archive
log config
hidekeys
username admin password password
!
!
!
!
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key 12345 address 75.98.63.100
crypto isakmp invalid-spi-recovery
crypto isakmp keepalive 10 periodic
!
crypto ipsec security-association lifetime seconds 28800
!
crypto ipsec transform-set myset esp-3des esp-md5-hmac
crypto ipsec df-bit clear
!
crypto map mymap 10 ipsec-isakmp
set peer 75.98.63.100
set transform-set myset
match address USTX_2_NY
!
!
!
!
!
interface FastEthernet0
switchport access vlan 2
!
!
interface FastEthernet1
switchport access vlan 4
!
!
interface FastEthernet2
!
!
interface FastEthernet3
switchport access vlan 3
!
!
interface FastEthernet4
ip address 175.15.110.242 255.255.255.240
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
crypto map mymap
!
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$
no ip address
ip virtual-reassembly
ip tcp adjust-mss 1452
shutdown
!
!
interface Vlan2
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$
ip address 10.16.1.3 255.255.0.0
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1418
!
!
interface Vlan3
ip address 211.106.234.114 255.255.255.240
ip nat outside
ip virtual-reassembly
!
!
interface Vlan4
no ip address
ip nat inside
ip virtual-reassembly
!
!
no ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
ip nat inside source route-map nonat interface FastEthernet4 overload
ip route 0.0.0.0 0.0.0.0 175.15.110.254
ip route 10.0.0.0 255.0.0.0 175.15.110.254
!
ip access-list extended USTX_2_NY
permit ip 10.16.0.0 0.0.255.255 10.0.0.0 0.255.255.255
!
access-list 103 deny ip 10.16.0.0 0.0.255.255 10.0.0.0 0.255.255.255
access-list 103 permit ip 10.16.0.0 0.0.255.255 any
no cdp run
!
!
route-map nonat permit 10
match ip address 103
!
!
control-plane
!
!
!
!
scheduler max-task-time 5000
scheduler allocate 4000 1000
scheduler interval 500
end
