Hi Alain
I have no access to the other end of the VPN tunnel as this is controlled by the National Health service. However, we have been using the VPN tunnel sucessfully for over a year from the 10.88 network.
Perhaps I need to clarify in my own head what the source IP is for traffic arriving from the 192.168 network. It originates from a server 192.168.0.170..It gets routed to the FE8 port of the Cisco which is configured to 192.168.0.235. I then do a NAT inside which I presume converts the IP address to a 10.88 address??(Bit shaky on this bit). It is then NATed again by the Outside/Internet port Gigabit Port 0 before going out on to the web.. is this correct?
Howewever, if using a VPN tunnel is any NAT required?? as this will be a direct connection between two sites/routers and hence will not appear on the web??
Apologies for the silly questions and thankyou for your kind assistance.
Carl
Please see config for ZBF and ACL's below..as Requested..
class-map type inspect match-all sdm-cls-VPNOutsideToInside-1
match access-group 104
class-map type inspect match-all sdm-cls-VPNOutsideToInside-3
match access-group 108
class-map type inspect match-all sdm-cls-VPNOutsideToInside-2
match access-group 107
class-map type inspect imap match-any ccp-app-imap
match invalid-command
class-map type inspect match-all sdm-cls-VPNOutsideToInside-5
match access-group 110
class-map type inspect match-any ccp-cls-protocol-p2p
match protocol edonkey signature
match protocol gnutella signature
match protocol kazaa2 signature
match protocol fasttrack signature
match protocol bittorrent signature
class-map type inspect match-all sdm-cls-VPNOutsideToInside-4
match access-group 109
class-map type inspect match-all sdm-cls-VPNOutsideToInside-7
match access-group 112
class-map type inspect match-all sdm-cls-VPNOutsideToInside-6
match access-group 111
class-map type inspect match-all sdm-cls-VPNOutsideToInside-9
match access-group 114
class-map type inspect match-all sdm-cls-VPNOutsideToInside-8
match access-group 113
class-map type inspect smtp match-any ccp-app-smtp
match data-length gt 5000000
class-map type inspect match-any SDM_AH
match access-group name SDM_AH
class-map type inspect match-any ccp-skinny-inspect
match protocol skinny
class-map type inspect http match-any ccp-app-nonascii
match req-resp header regex ccp-regex-nonascii
class-map type inspect match-any SDM_ESP
match access-group name SDM_ESP
class-map type inspect match-any SDM_VPN_TRAFFIC
match protocol isakmp
match protocol ipsec-msft
match class-map SDM_AH
match class-map SDM_ESP
class-map type inspect match-all SDM_VPN_PT
match access-group 103
match class-map SDM_VPN_TRAFFIC
class-map type inspect match-any ccp-cls-insp-traffic
match protocol dns
match protocol https
match protocol icmp
match protocol imap
match protocol pop3
match protocol tcp
match protocol udp
class-map type inspect match-all ccp-insp-traffic
match class-map ccp-cls-insp-traffic
class-map type inspect match-any ccp-h323nxg-inspect
match protocol h323-nxg
class-map type inspect match-all sdm-cls-VPNOutsideToInside-10
match access-group 115
class-map type inspect match-all sdm-cls-VPNOutsideToInside-11
match access-group 116
class-map type inspect match-any ccp-cls-icmp-access
match protocol icmp
match protocol tcp
match protocol udp
class-map type inspect match-all sdm-cls-VPNOutsideToInside-12
match access-group 117
class-map type inspect match-any ccp-cls-protocol-im
match protocol ymsgr yahoo-servers
match protocol msnmsgr msn-servers
match protocol aol aol-servers
class-map type inspect match-all sdm-cls-VPNOutsideToInside-13
match access-group 118
class-map type inspect match-all ccp-protocol-pop3
match protocol pop3
class-map type inspect match-any ccp-h225ras-inspect
match protocol h225ras
class-map type inspect match-any IDS7
match protocol http
match protocol tcp
match protocol icmp
class-map type inspect match-all ccp-cls-ccp-inspect-1
match access-group name NWIH
match class-map IDS7
class-map type inspect match-any ccp-h323annexe-inspect
match protocol h323-annexe
class-map type inspect pop3 match-any ccp-app-pop3
match invalid-command
class-map type inspect match-all ccp-protocol-p2p
match class-map ccp-cls-protocol-p2p
class-map type inspect match-any ccp-h323-inspect
match protocol h323
class-map type inspect match-all ccp-protocol-im
match class-map ccp-cls-protocol-im
class-map type inspect match-all ccp-icmp-access
match class-map ccp-cls-icmp-access
class-map type inspect match-all ccp-invalid-src
match access-group 100
class-map type inspect http match-any ccp-app-httpmethods
match request method bcopy
match request method bdelete
match request method bmove
match request method bpropfind
match request method bproppatch
match request method connect
match request method copy
match request method delete
match request method edit
match request method getattribute
match request method getattributenames
match request method getproperties
match request method index
match request method lock
match request method mkcol
match request method mkdir
match request method move
match request method notify
match request method options
match request method poll
match request method post
match request method propfind
match request method proppatch
match request method put
match request method revadd
match request method revlabel
match request method revlog
match request method revnum
match request method save
match request method search
match request method setattribute
match request method startrev
match request method stoprev
match request method subscribe
match request method trace
match request method unedit
match request method unlock
match request method unsubscribe
class-map type inspect match-any ccp-sip-inspect
match protocol sip
class-map type inspect http match-any ccp-http-blockparam
match request port-misuse im
match request port-misuse p2p
match request port-misuse tunneling
class-map type inspect match-all ccp-protocol-imap
match protocol imap
class-map type inspect match-all ccp-protocol-smtp
match protocol smtp
class-map type inspect match-all ccp-protocol-http
match protocol http
!
!
policy-map type inspect ccp-permit-icmpreply
class type inspect ccp-icmp-access
inspect
class class-default
pass
policy-map type inspect sdm-pol-VPNOutsideToInside-1
class type inspect sdm-cls-VPNOutsideToInside-1
inspect
class type inspect sdm-cls-VPNOutsideToInside-2
inspect
class type inspect sdm-cls-VPNOutsideToInside-3
pass
class type inspect sdm-cls-VPNOutsideToInside-4
pass
class type inspect sdm-cls-VPNOutsideToInside-5
pass
class type inspect sdm-cls-VPNOutsideToInside-6
pass
class type inspect sdm-cls-VPNOutsideToInside-7
pass
class type inspect sdm-cls-VPNOutsideToInside-8
pass
class type inspect sdm-cls-VPNOutsideToInside-9
pass
class type inspect sdm-cls-VPNOutsideToInside-10
pass
class type inspect sdm-cls-VPNOutsideToInside-11
pass
class type inspect sdm-cls-VPNOutsideToInside-12
pass
class type inspect sdm-cls-VPNOutsideToInside-13
pass
class class-default
drop
policy-map type inspect smtp ccp-action-smtp
class type inspect smtp ccp-app-smtp
reset
policy-map type inspect imap ccp-action-imap
class type inspect imap ccp-app-imap
log
reset
policy-map type inspect pop3 ccp-action-pop3
class type inspect pop3 ccp-app-pop3
log
reset
policy-map type inspect ccp-inspect
class type inspect ccp-cls-ccp-inspect-1
inspect
class type inspect ccp-invalid-src
drop log
class type inspect ccp-protocol-http
inspect
class type inspect ccp-protocol-smtp
inspect
service-policy smtp ccp-action-smtp
class type inspect ccp-protocol-imap
inspect
service-policy imap ccp-action-imap
class type inspect ccp-protocol-pop3
inspect
service-policy pop3 ccp-action-pop3
class type inspect ccp-protocol-p2p
drop log
class type inspect ccp-protocol-im
drop log
class type inspect ccp-insp-traffic
inspect
class type inspect ccp-sip-inspect
inspect
class type inspect ccp-h323-inspect
inspect
class type inspect ccp-h323annexe-inspect
inspect
class type inspect ccp-h225ras-inspect
inspect
class type inspect ccp-h323nxg-inspect
inspect
class type inspect ccp-skinny-inspect
inspect
class class-default
drop
policy-map type inspect http ccp-action-app-http
class type inspect http ccp-http-blockparam
log
reset
class type inspect http ccp-app-httpmethods
log
reset
class type inspect http ccp-app-nonascii
log
reset
policy-map type inspect ccp-permit
class type inspect SDM_VPN_PT
pass
class class-default
drop
!
zone security in-zone
zone security out-zone
zone-pair security ccp-zp-out-self source out-zone destination self
service-policy type inspect ccp-permit
zone-pair security ccp-zp-in-out source in-zone destination out-zone
service-policy type inspect ccp-inspect
zone-pair security ccp-zp-self-out source self destination out-zone
service-policy type inspect ccp-permit-icmpreply
zone-pair security sdm-zp-VPNOutsideToInside-1 source out-zone destination in-zone
service-policy type inspect sdm-pol-VPNOutsideToInside-1
!
!
crypto isakmp policy 1
encr aes
authentication pre-share
group 5
lifetime 3600
!
crypto isakmp policy 2
encr 3des
authentication pre-share
group 2
!
crypto isakmp policy 3
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key XA1APhRF97QSJJ28d3UXc2UbinTapLZjR5oi7igxbCULuDc3fq9BTbLyME4Jmqn address 194.168.231.2
crypto isakmp key ScannerMRI321 address 194.138.39.1
crypto isakmp key MRIScanner2010 address 81.133.132.134
!
!
crypto ipsec transform-set ESP-3DES-SHA7 esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-AES128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set Siemens esp-3des esp-md5-hmac
!
crypto map SDM_CMAP_1 3 ipsec-isakmp
description Tunnel to194.168.231.2
set peer 194.168.231.2
set security-association lifetime seconds 1800
set transform-set ESP-AES128-SHA
set pfs group5
match address 106
crypto map SDM_CMAP_1 4 ipsec-isakmp
description Dr Taylor
set peer 81.133.132.134
set transform-set ESP-3DES-SHA7
set pfs group2
match address 102
crypto map SDM_CMAP_1 5 ipsec-isakmp
description Tunnel to194.138.39.1
set peer 194.138.39.1
set transform-set Siemens
match address 105
