Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About mtjones83
Stats
Member since
07-09-2008
7
Posts
0
Helpful
0
Solutions
09-09-2010
12:35 AM
Thank you. I've atatched a sh run and a sh cry ipsec sa from both routers. We are not using NAT - if I'm honest the configs were originally written by an ex-colleague, not my self. Cheers, Mike
... View more
09-08-2010
06:07 AM
Hi halijenn, Ive done as you reccomended but no luck... still can't ping a device on the other side of the VPN and still no SNMPR response... Remote 1700 ACL: ip access-list extended WARRINGTON_TUNNEL permit ip 10.200.11.0 0.0.0.255 10.200.0.0 0.0.255.255 permit ip 10.200.11.0 0.0.0.255 10.206.0.0 0.0.255.255 permit ip 10.200.11.0 0.0.0.255 10.10.0.0 0.0.255.255 permit ip host 81.149.170.57 10.200.0.0 0.0.255.255 permit ip host 81.149.170.57 10.206.0.0 0.0.255.255 permit ip host 81.149.170.57 10.10.0.0 0.0.255.255 Head Office 2600 ACL: ip access-list extended STOKE_TUNNEL permit ip 10.200.0.0 0.0.255.255 10.200.11.0 0.0.0.255 permit ip 10.206.0.0 0.0.255.255 10.200.11.0 0.0.0.255 permit ip 10.10.0.0 0.0.255.255 10.200.11.0 0.0.0.255 permit ip 10.200.0.0 0.0.255.255 host 81.149.170.57 permit ip 10.206.0.0 0.0.255.255 host 81.149.170.57 permit ip 10.10.0.0 0.0.255.255 host 81.149.170.57 Cheers, Mike
... View more
09-08-2010
05:21 AM
Thanks fro your reply halijenn. So my current crypto acl looks like this... ip access-list extended WARRINGTON_TUNNEL permit ip 10.200.11.0 0.0.0.255 10.200.0.0 0.0.255.255 permit ip 10.200.11.0 0.0.0.255 10.206.0.0 0.0.255.255 permit ip 10.200.11.0 0.0.0.255 10.10.0.0 0.0.255.255 are you saying I need to add the following... ? permit ip 88.202.219.161 255.255.255.255 10.200.0.0 0.0.255.255 permit ip 88.202.219.161 255.255.255.255 10.206.0.0 0.0.255.255 permit ip 88.202.219.161 255.255.255.255 10.10.0.0 0.0.255.255 88.202.219.161/32 being the router external ip... Thanks, Mike
... View more
09-08-2010
05:00 AM
Hi Everyone, I have a 1700 router configured for a stie-to-site VPN with a 2600 at our head office. The VPN works pefrectly and I've had no problems with conenctivity since the remote router has been installed. I've been trying to configure our SNMP software to poll the router and can detect the interfaces (ATM, FA eg) but do not recieve any SNMP responses after that. I tihnk it could have something to do with the fact it seems any traffic from the routers own interface doens;t seem to get routed down the VPN tunnel... for example a PC conencted to the switch/router has fully connectivity across the VPN and can ping all subnets at our head office, but if I telnet to the routers internal IP (10.200.11.1) and try and ping a device at head office from the command promt it fails every time. Any ideas? Remote 1700 config below... Thanks, Mike -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Building configuration... Current configuration : 4053 bytes ! version 12.2 service timestamps debug uptime service timestamps log uptime service password-encryption ! hostname stoke_wan_rtr1 ! ! username admin privilege 15 password ****** memory-size iomem 25 clock timezone London 0 clock summer-time London recurring last Sun Mar 1:00 last Sun Oct 1:00 ip subnet-zero no ip source-route ! ! no ip domain lookup ip domain name emr.com ip name-server 10.206.188.31 ip name-server 10.206.188.32 ip name-server 212.104.130.9 ip name-server 212.104.130.65 ip dhcp excluded-address 10.200.11.151 10.200.11.254 ip dhcp excluded-address 10.200.11.1 10.200.11.99 ! ip dhcp pool local import all network 10.200.11.0 255.255.255.0 dns-server 10.206.188.31 10.206.188.32 domain-name emr.com default-router 10.200.11.1 netbios-name-server 10.206.188.31 10.206.188.32 lease 7 ! ip audit notify log ip audit po max-events 100 ip cef ! ! crypto isakmp policy 10 encr 3des authentication pre-share group 2 crypto isakmp key ****** address *.*.*.* ! ! crypto ipsec transform-set esp3des-sha esp-3des esp-sha-hmac crypto ipsec df-bit clear ! crypto map EMRCryptoMap 10 ipsec-isakmp set peer *.*.*.* set transform-set esp3des-sha match address WARRINGTON_TUNNEL ! ! ! ! interface ATM0 no ip address no atm ilmi-keepalive dsl operating-mode auto no fair-queue ! interface ATM0.1 point-to-point pvc 0/38 encapsulation aal5mux ppp dialer dialer pool-member 1 ! ! interface FastEthernet0 ip address 10.200.11.1 255.255.255.0 ip tcp adjust-mss 1378 speed auto ! interface Dialer0 ip address *.*.*.* 255.255.255.0 ip access-group 101 in encapsulation ppp dialer pool 1 dialer idle-timeout 0 dialer persistent dialer-group 1 no cdp enable ppp authentication chap callin ppp chap hostname **** ppp chap password **** crypto map EMRCryptoMap ! ip classless ip route 0.0.0.0 0.0.0.0 Dialer0 ip http server ip http authentication local ! ! ip access-list extended WARRINGTON_TUNNEL permit ip 10.200.11.0 0.0.0.255 10.200.0.0 0.0.255.255 permit ip 10.200.11.0 0.0.0.255 10.206.0.0 0.0.255.255 permit ip 10.200.11.0 0.0.0.255 10.10.0.0 0.0.255.255 ! access-list 101 remark External Int In Rule access-list 101 permit ip 10.200.0.0 0.0.255.255 10.0.0.0 0.255.255.255 access-list 101 permit ip 10.206.0.0 0.0.255.255 10.0.0.0 0.255.255.255 access-list 101 permit tcp any any eq telnet access-list 101 permit udp any any eq isakmp access-list 101 permit udp any any eq snmp access-list 101 permit esp any any access-list 101 permit ahp any any access-list 101 permit icmp any any echo access-list 101 permit icmp any any echo-reply access-list 101 permit icmp any any time-exceeded access-list 101 permit icmp any any unreachable access-list 101 deny ip 10.0.0.0 0.255.255.255 any access-list 101 deny ip 172.16.0.0 0.15.255.255 any access-list 101 deny ip 192.168.0.0 0.0.255.255 any access-list 101 deny ip 127.0.0.0 0.255.255.255 any access-list 101 deny ip host 255.255.255.255 any access-list 101 deny ip host 0.0.0.0 any ! snmp-server community ****** RO no snmp-server enable traps tty banner motd ^CC \\\|/// \\ ~ ~ // (/ @ @ /) +-------------------oOOo-(_)-oOOo------------------+ ############################################## # --- WARNING NOTICE --- # # # # THIS SYSTEM IS PRIVATE AND IS RESTRICTED # # TO AUTHORISED PERSONNEL ONLY. # # UNAUTHORISED ACCESS CAN BE TRACED. # # IF YOU ARE UNAUTHORISED DISCONNECT NOW! # # # ############################################## ^C ! line con 0 logging synchronous login local line aux 0 line vty 0 4 login local ! no scheduler allocate end
... View more
Labels:
06-01-2010
11:41 AM
I think I'm gonna go for EIGRP... We already use EIGRP to learn the BT MPLS routes on the core switch in Warrington, so it makes sense to go the same way. I've found a good guy at BT who will help with the changes they need to make and he's happy to use EIGRP... just need to find a simlar helpful engineer at AT&T !!! Thanks for all you help. Mike
... View more
05-28-2010
06:48 AM
Thank you for your reply, Guiseppe. The two MPLS netowrks are fully managed by the telcos, so I do not have direct access to their routers. I was looking for a simple way to link the two networks with minimum contact with the ISP's if possible. In reality this will be a temporary solution for at most 12 months when we will then replace one of the MPLS netowrks with links into the others cloud and have a single global MPLS. Currently the UK network can see all devices in New York & Baton Rouge, but the remote sites on both sides of the atlantic can not see each other. The EIGRP 100 in the UK is already configured and working. I can ping both networks from the C3750 in Baton Rouge but when I try and use this switch as a default gateway between the networks it doesn't work?
... View more
05-27-2010
02:31 PM
Hello, Often browse these forums, but first time posting... I have two telco provided MPLS networks which I need to link together. I'm assuming that the telcos will be using BGP on their MPLS and I have got 3750 switches at the site where the two MPLS networks both have presence. So I'm thinking I could use EIGRP on the 3750's to redistribute the two BGP AS into EIGRP and therfore share the routing tables between them... ? We have two sites where the MPLS netowrks meet so I'd like to use one as primary route and one as secondary. I've attahed a diagram which will probably make more sense than my waffle above! Was hoping some one could advise if I'm on the right track and if any one has any sample configs etc for the EIGRP on the 3750's ? Cheers, Mike
... View more
Labels:
09-09-2010
Thank you.I've atatched a sh run and a sh cry ipsec sa from both
routers.We are not using NAT - if I...
09-08-2010
Hi halijenn,Ive done as you reccomended but no luck... still can't ping
a device on the other side o...
09-08-2010
Thanks fro your reply halijenn.So my current crypto acl looks like
this... ip access-list extended W...
09-08-2010
Hi Everyone,I have a 1700 router configured for a stie-to-site VPN with
a 2600 at our head office. T...
Public Statistics
| Date Registered | 07-09-2008 03:25 AM |
| Date Last Visited | 08-18-2017 03:55 AM |
| Total Messages Posted | 7 |
