Hello All,
I have the below configs on my ADSL VPN router where i run an IPSEC tunnel to may corporate Palo firewall to establish the VPN connection.
VPn ADSL Cisco 877 Router--> internet--> Palo Firewall (where IPSec VPn terminated)--> Core switch-->10.127.50.50 (Gateway for the sever is on Core switch)
i have everything working except my loopback IP is not pingable from DC server behind my Palo firewall where the VPNs are connected.
Loopback will start pingable once i initiate some traffic from my VPN router to DC server making loopback as source like below.
(ping 10.127.50.50 source Loopback1)
it's works well after i do a source ping until i reboot router, it's looks totally strange for me, Can someone is help i have lost mind :)
==================================================
Building configuration...
Current configuration : 6324 bytes
!
!
!
version 12.4
no service pad
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
!
hostname xxxxvpn05
!
boot-start-marker
boot-end-marker
!
logging buffered 16384
!
aaa new-model
!
!
aaa authentication login default local
aaa authentication enable default enable
aaa authorization console
aaa authorization exec default local
!
!
aaa session-id common
clock timezone GMT 0
clock summer-time BST recurring last Sun Mar 1:00 last Sun Oct 2:00
!
!
dot11 syslog
ip cef
!
!
!
!
no ip bootp server
no ip domain lookup
ip domain name XXXXX
!
multilink bundle-name authenticated
!
!
username xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
!
!
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 2
crypto isakmp key xxxxxxxx address xxxxxxxxxxxxxxxx
crypto isakmp keepalive 10 5 periodic
!
crypto isakmp peer address xxxxxxxxxxxxx
set aggressive-mode password xxxxxxxxxxxxxxxx
set aggressive-mode client-endpoint fqdn xxxxvpn05
!
!
crypto ipsec transform-set xxxx-VPN-SET esp-aes 256 esp-sha-hmac
!
crypto map xxxxxx 10 ipsec-isakmp
set peer xxxxx
set transform-set xxxx-VPN-SET
match address VPN-SUBNET
qos pre-classify
!
archive
log config
hidekeys
!
!
ip tftp source-interface Vlan1
ip ssh time-out 60
ip ssh authentication-retries 2
!
class-map match-any HIGH
match access-group name CITRIX-TRAFFIC
match access-group name ICMP-TRAFFIC
match access-group name SNMP-TRAFFIC
class-map match-any MEDIUM
match access-group name SKYPE-TRAFFIC
match access-group name WEB-TRAFFIC
class-map match-any LOW
match access-group name SCCM-TRAFFIC
match access-group name SEP-TRAFFIC
match access-group name SMB-TRAFFIC
!
!
policy-map xxxx-COS
class HIGH
bandwidth percent 30
class MEDIUM
bandwidth percent 20
class LOW
bandwidth percent 10
class class-default
bandwidth percent 15
!
!
!
!
interface Loopback1
ip address 192.168.85.1 255.255.255.0
ip nat inside
ip virtual-reassembly
!
interface ATM0
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
no ip route-cache cef
no ip route-cache
no ip mroute-cache
no atm ilmi-keepalive
pvc 0/38
vbr-nrt 284 284
tx-ring-limit 3
encapsulation aal5mux ppp dialer
dialer pool-member 1
service-policy output xxxx-COS
!
dsl operating-mode auto
!
interface FastEthernet0
duplex full
speed 100
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface Vlan1
description ***LAN Interface***
ip address 10.150.253.5 255.255.255.252
ip helper-address 10.127.73.20
ip helper-address 10.127.73.30
ip nat inside
ip virtual-reassembly
no autostate
!
interface Dialer1
description --- xxxxxxxxxxx
ip address negotiated
ip mtu 1400
ip nat outside
ip virtual-reassembly
encapsulation ppp
ip tcp adjust-mss 1360
load-interval 30
dialer pool 1
dialer idle-timeout 0
dialer persistent
dialer-group 1
no cdp enable
ppp authentication chap callin
ppp chap hostname xxxxxxx
ppp chap password 7 xxxxxxxxxxxxx
ppp ipcp dns request
crypto map xxxx-VPN
!
ip forward-protocol nd
no ip forward-protocol udp netbios-ns
no ip forward-protocol udp netbios-dgm
ip route 0.0.0.0 0.0.0.0 Dialer1 name DEFAULT
!
!
no ip http server
no ip http secure-server
ip nat inside source route-map NO-NAT interface Dialer1 overload
!
ip access-list standard xxxx-MGT
remark --- xxxx Management Networks
permit 194.74.241.94
permit 10.150.253.5
permit 81.144.223.254
permit 192.168.85.0 0.0.0.255
permit 10.127.0.0 0.0.255.255
permit 10.146.0.0 0.0.255.255
!
ip access-list extended CITRIX-TRAFFIC
remark --- Citrix Traffic ---
permit tcp any any eq 1494
permit tcp any eq 1494 any
permit tcp any any eq 2598
permit tcp any eq 2598 any
permit udp any any range 16500 16509
permit udp any range 16500 16509 any
permit tcp any host 10.127.71.255 eq www
permit tcp any host 10.127.71.255 eq 443
ip access-list extended ICMP-TRAFFIC
remark --- ICMP Traffic ---
permit icmp any any
ip access-list extended NOT-VPN-SUBNET
deny ip 192.168.85.0 0.0.0.255 any
deny ip host 10.150.253.5 any
ip access-list extended SCCM-TRAFFIC
remark --- SCCM Traffic ---
permit tcp any host 10.127.99.99 eq www
permit tcp any host 10.127.99.99 eq 443
permit tcp any any eq 8530
permit tcp any eq 8530 any
ip access-list extended SEP-TRAFFIC
remark --- SEP Traffic ---
permit tcp any host 10.127.99.102 eq www
permit tcp any host 10.127.99.102 eq 443
permit tcp any any eq 8014
permit tcp any eq 8014 any
permit tcp any any eq 9005
permit tcp any eq 9005 any
ip access-list extended SKYPE-TRAFFIC
remark --- Skype for Business Traffic ---
permit tcp any 172.28.254.0 0.0.0.255 eq 443
permit tcp any 172.28.254.0 0.0.0.255 eq 5061
permit udp any 172.28.254.0 0.0.0.255 eq 3478
ip access-list extended SMB-TRAFFIC
remark --- Generic SMB Traffic ---
permit tcp any any eq 139
permit tcp any eq 139 any
permit tcp any any eq 445
permit tcp any eq 445 any
permit udp any any eq 445
permit udp any eq 445 any
ip access-list extended SNMP-TRAFFIC
remark --- Management Traffic ---
permit udp any any eq snmp
permit udp any eq snmp any
ip access-list extended VPN-SUBNET
permit ip 192.168.85.0 0.0.0.255 any
permit ip host 10.150.253.5 any
ip access-list extended WEB-TRAFFIC
remark --- WEB Traffic ---
permit tcp any any eq www
permit tcp any eq www any
permit tcp any any eq 443
permit tcp any eq 443 any
!
dialer-list 1 protocol ip permit
snmp-server community public RO
snmp-server enable traps tty
no cdp run
!
!
!
route-map NO-NAT permit 10
match ip address NOT-VPN-SUBNET
!
!
control-plane
!
!
line con 0
no modem enable
transport preferred telnet
transport output all
line aux 0
transport preferred telnet
transport output all
line vty 0 4
access-class xxxx-MGT in
exec-timeout 120 0
password 7 xxxxxxxxx
length 0
transport preferred telnet
transport input ssh
transport output all
!
scheduler max-task-time 5000
ntp clock-period 17183670
ntp source Vlan1
ntp server 10.127.80.101 source Vlan1
ntp server 10.127.80.102 source Vlan1 prefer
end
xxxxvpn05#
