Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About lars.arler
09-04-2019
Stats
Member since
03-26-2007
18
Posts
0
Helpful
1
Solution
09-06-2019
05:20 AM
Hey Georg I’m a little challenged by the fact that the 2921 Router is a live production Router. But I’ll start to be 100% sure that the ZBF could be the problem by removing all the ZBF statements "zone-member security xxxx” from the interfaces - and see if the issue with VPN is still there. I might have been taking for granted that the old 1811 Router Config would act likewise on the 2921 Router. And Second I’ll try to put my 1811 router up live again to see if my old VPN settings still is covering my tracks. I don’t want to blame ZBF falsely ;-) I’ll report back soon
... View more
09-01-2019
11:13 AM
Thanks again I’ll try it out as soon as possible and let you know
... View more
08-29-2019
04:22 AM
Thanks again George Pauwen Here is the complete config.. version 15.2 hostname R2911 boot-start-marker boot system flash c2900-universalk9-mz.SPA.154-3.M.bin boot-end-marker ! card type command needed for slot/vwic-slot 0/2 no logging console enable secret 5 aaa new-model aaa authentication login userauthen local aaa authorization network userauthen local aaa session-id common memory-size iomem 25 clock timezone CPH 2 0 clock summer-time CPH recurring 4 Sun Mar 2:00 4 Sun Oct 2:00 no ipv6 cef no ip source-route ip dhcp excluded-address 192.168.100.1 192.168.100.49 ip dhcp excluded-address 192.168.50.1 192.168.50.49 ip dhcp pool VLAN200 network 80.xxx.xxx.96 255.255.255.240 default-router 80.xxx.xxx.97 dns-server 208.67.222.222 208.67.220.220 8.8.8.8 4.4.4.4 ip dhcp pool VLAN100 network 192.168.100.0 255.255.255.0 default-router 192.168.100.1 dns-server 208.67.222.222 208.67.220.220 8.8.8.8 4.4.4.4 ip dhcp pool VLAN50 network 192.168.50.0 255.255.255.0 default-router 192.168.50.1 dns-server 208.67.222.222 208.67.220.220 8.8.8.8 4.4.4.4 ip dhcp pool REMOTE_VPN network 10.10.10.0 255.255.255.0 default-router 10.10.10.1 dns-server 208.67.222.222 208.67.220.220 8.8.8.8 4.4.4.4 ip domain name xxxxxxxxxx ip name-server 208.67.222.222 ip name-server 208.67.220.220 ip name-server 62.243.0.166 ip name-server 194.192.207.166 ip cef ip cef accounting non-recursive multilink bundle-name authenticated crypto pki token default removal timeout 0 crypto pki trustpoint TP-self-signed-2506629599 enrollment selfsigned subject-name cn=IOS-Self-Signed-Certificate-2506629599 revocation-check none rsakeypair TP-self-signed-2506629599 crypto pki certificate chain TP-self-signed-2506629599 certificate self-signed 01 3082022B ----> quit voice-card 0 license feature snasw license udi pid CISCO2911/K9 sn xxxxxxxxxx license accept end user agreement license boot module c2900 technology-package securityk9 license boot module c2900 technology-package uck9 license boot module c2900 technology-package datak9 hw-module pvdm 0/0 hw-module pvdm 0/1 object-group network GROUP-DMZ-FILEMAKER description IP-POOL for FILEMAKER server in DMZ host xxx.xxx.xxx.99 object-group network GROUP-DMZ-MAIL description IP-POOL for EMAIL-SERVERS in DMZ host xxx.xxx.xxx.100 host xxx.xxx.xxx.115 object-group network GROUP-DMZ-WEBSERVER description IP-POOL for FILE-WWW-FTP SERVER in DMZ host xxx.xxx.xxx.101 host xxx.xxx.xxx.102 host xxx.xxx.xxx.103 host xxx.xxx.xxx.104 host xxx.xxx.xxx.105 username xxxxxxxxxxxxxxx redundancy ip ssh time-out 60 ip ssh version 2 class-map type inspect match-any CLASS-INTERNET-TRAFFIC match protocol http match protocol https match protocol dns match protocol icmp class-map type inspect match-any CLASS-FTP match protocol ftp match protocol ftps class-map type inspect match-any CLASS-SSH match protocol ssh class-map type inspect match-any CLASS-L4-IP match protocol icmp match protocol tcp match protocol udp class-map type inspect match-any CLASS-IMAP-SMTP match protocol dns match access-group name EIMS-MAILSERVER match access-group name EIMS-MAILSERVER-ADMIN class-map type inspect match-any CLASS_CRYPTO_IPSEC_PASS match access-group name IPSEC_TRAFFIC class-map type inspect match-any CLASS-APPLE-AFP match access-group name APPLE-FILE-SHARING class-map type inspect match-all CLASS-MAIL-SERVER-(IP-RANGE-GROUP) match access-group name INTERNET-->DMZ-EMAIL match access-group name EIMS-MAILSERVER class-map type inspect match-all CLASS-FILE-SERVER-(IP-RANGE-GROUP) match access-group name INTERNET-->DMZ-WEBSERVER match class-map CLASS-INTERNET-TRAFFIC class-map type inspect match-any CLASS-APPLE-REMOTE-DESKTOP match access-group name APPLE-REMOTE-DESKTOP policy-map type inspect POLICY-(PRIVATE-->DMZ) class type inspect CLASS-FTP inspect class type inspect CLASS-SSH inspect class type inspect CLASS-APPLE-REMOTE-DESKTOP inspect class type inspect CLASS-APPLE-AFP inspect class type inspect CLASS-INTERNET-TRAFFIC inspect class type inspect CLASS-IMAP-SMTP inspect class type inspect CLASS-L4-IP inspect class class-default drop log policy-map type inspect POLICY-(SELF-->INTERNET) class type inspect CLASS_CRYPTO_IPSEC_PASS pass class type inspect CLASS-L4-IP inspect class class-default drop log policy-map type inspect POLICY-(INTERNET-->SELF) class type inspect CLASS_CRYPTO_IPSEC_PASS pass class type inspect CLASS-L4-IP inspect class class-default drop log policy-map type inspect POLICY-(PRIVATE-->INTERNET) class type inspect CLASS-L4-IP inspect class class-default drop log policy-map type inspect POLICY-(INTERNET-->DMZ) class type inspect CLASS-FILE-SERVER-(IP-RANGE-GROUP) inspect class type inspect CLASS-MAIL-SERVER-(IP-RANGE-GROUP) inspect class class-default drop log policy-map type inspect POLICY-(DMZ-->INTERNET) class type inspect CLASS-L4-IP inspect class class-default drop log zone security PRIVATE-ZONE zone security INTERNET-ZONE zone security DMZ-ZONE zone-pair security PRIVATE-TO-DMZ source PRIVATE-ZONE destination DMZ-ZONE service-policy type inspect POLICY-(PRIVATE-->DMZ) zone-pair security PRIVATE-TO-INTERNET source PRIVATE-ZONE destination INTERNET-ZONE service-policy type inspect POLICY-(PRIVATE-->INTERNET) zone-pair security INTERNET-TO-DMZ source INTERNET-ZONE destination DMZ-ZONE service-policy type inspect POLICY-(INTERNET-->DMZ) zone-pair security DMZ-TO-INTERNET source DMZ-ZONE destination INTERNET-ZONE service-policy type inspect POLICY-(DMZ-->INTERNET) zone-pair security SELF-TO-VPN-INTERNET source self destination INTERNET-ZONE service-policy type inspect POLICY-(SELF-->INTERNET) zone-pair security VPN-INTERNET-TO-SELF source INTERNET-ZONE destination self service-policy type inspect POLICY-(INTERNET-->SELF) crypto isakmp policy 150 encr aes 256 authentication pre-share group 2 crypto isakmp client configuration group SAS-VPN key XXXXXX dns 208.67.222.222 208.67.220.220 pool REMOTE-VPN-UNTRUSTED acl 102 crypto isakmp client configuration group TRUSTED-VPN key XXXXXX dns 208.67.222.222 208.67.220.220 pool REMOTE-VPN-TRUSTED acl 101 crypto isakmp profile SAS-VPN-PROFILE match identity group SAS-VPN client authentication list userauthen isakmp authorization list userauthen client configuration address initiate client configuration address respond virtual-template 1 crypto isakmp profile TRUSTED-VPN-PROFILE match identity group TRUSTED-VPN client authentication list userauthen isakmp authorization list userauthen client configuration address initiate client configuration address respond virtual-template 2 crypto ipsec transform-set SAS-VPN-1 esp-aes 256 esp-sha-hmac crypto ipsec transform-set TRUSTED-VPN-1 esp-aes 256 esp-sha-hmac crypto ipsec profile SAS-VPN-VTUNNEL-PROFILE set security-association lifetime kilobytes disable set security-association lifetime seconds 28800 set transform-set SAS-VPN-1 set isakmp-profile SAS-VPN-PROFILE crypto ipsec profile TRUSTED-VPN-VTUNNEL-PROFILE set security-association lifetime kilobytes disable set security-association lifetime seconds 28800 set transform-set TRUSTED-VPN-1 set isakmp-profile TRUSTED-VPN-PROFILE interface Loopback0 ip address 10.108.1.1 255.255.255.0 interface Embedded-Service-Engine0/0 no ip address interface GigabitEthernet0/0 description ISP WAN (Wide Area Network) ip address xxx.xxx.xxx.190 255.255.255.252 ip nat outside ip virtual-reassembly in zone-member security INTERNET-ZONE duplex auto speed auto interface GigabitEthernet0/1 description LAN (Local Area Network) ip address pool VLAN100 ip nat inside ip virtual-reassembly in zone-member security PRIVATE-ZONE duplex auto speed auto interface GigabitEthernet0/2 description LAN (Local Area Network) ip address pool VLAN50 ip nat inside ip virtual-reassembly in zone-member security PRIVATE-ZONE duplex auto speed auto interface Serial0/0/0 no ip address interface FastEthernet0/1/0 switchport access vlan 200 no ip address interface FastEthernet0/1/1 switchport access vlan 200 no ip address interface FastEthernet0/1/2 switchport access vlan 200 no ip address interface FastEthernet0/1/3 switchport access vlan 200 no ip address interface Virtual-Template1 type tunnel description Virtuel VPN Forbindelse ip unnumbered GigabitEthernet0/0 ip nat inside ip virtual-reassembly in zone-member security INTERNET-ZONE tunnel source GigabitEthernet0/0 tunnel mode ipsec ipv4 tunnel protection ipsec profile SAS-VPN-VTUNNEL-PROFILE interface Virtual-Template2 type tunnel description Virtuel TRUSTED-VPN Forbindelse ip unnumbered GigabitEthernet0/0 ip nat inside ip virtual-reassembly in zone-member security DMZ-ZONE tunnel source GigabitEthernet0/0 tunnel mode ipsec ipv4 tunnel protection ipsec profile TRUSTED-VPN-VTUNNEL-PROFILE interface Vlan1 no ip address interface Vlan50 description GUEST NETWORK DHCP POOL no ip address ip nat inside ip virtual-reassembly in interface Vlan100 description INTERNAL NETWORK DHCP POOL ip address dhcp ip nat inside ip virtual-reassembly in interface Vlan200 description HWIC-4ESW_LAN - SERVER PARK ip address xxx.xxx.xxx.97 255.255.255.224 ip nat inside ip virtual-reassembly in zone-member security DMZ-ZONE router eigrp 100 network 10.0.0.0 network 80.0.0.0 network 87.0.0.0 network 192.168.0.0 router ospf 123 network 10.0.0.0 0.255.255.255 area 0 network 80.0.0.0 0.255.255.255 area 0 network 87.0.0.0 0.255.255.255 area 0 network 192.0.0.0 0.255.255.255 area 0 ip local pool REMOTE-VPN-UNTRUSTED 10.10.10.50 10.10.10.100 ip local pool REMOTE-VPN-TRUSTED xxx.xxx.xxx.120 xxx.xxx.xxx.126 ip forward-protocol nd no ip http server ip http authentication local ip http secure-server ip nat inside source list 1 interface GigabitEthernet0/0 overload ip route 0.0.0.0 0.0.0.0 87.63.227.189 ip access-list extended APPLE-FILE-SHARING permit tcp any any eq 427 permit tcp any any eq 548 ip access-list extended APPLE-REMOTE-DESKTOP permit tcp any any eq 22 permit udp any any eq 3283 permit tcp any any eq 5900 permit udp any any eq 5900 permit tcp any any eq 3283 ip access-list extended EIMS-MAILSERVER permit tcp any any eq 587 permit tcp any any eq smtp permit tcp any any eq 143 ip access-list extended EIMS-MAILSERVER-ADMIN permit tcp any any eq 4199 ip access-list extended INTERNET-->DMZ-EMAIL permit ip any object-group GROUP-DMZ-MAIL ip access-list extended INTERNET-->DMZ-FILEMAKER permit ip any object-group GROUP-DMZ-FILEMAKER ip access-list extended INTERNET-->DMZ-WEBSERVER permit ip any object-group GROUP-DMZ-WEBSERVER ip access-list extended IPSEC_TRAFFIC permit udp any any eq isakmp permit ahp any any permit esp any any permit udp any any eq non500-isakmp ip access-list extended SSH_ACCESS_CONTROL permit udp 192.168.100.0 0.0.0.225 any eq 22 permit tcp 192.168.100.0 0.0.0.225 any eq 22 permit udp 192.168.50.0 0.0.0.255 any eq 22 permit tcp 192.168.50.0 0.0.0.255 any eq 22 permit udp xxx.xxx.xxx.96 0.0.0.31 any eq 22 permit tcp xxx.xxx.xxx.96 0.0.0.31 any eq 22 deny udp any any eq 22 deny tcp any any eq 22 permit ip any any access-list 1 permit 192.168.100.0 0.0.0.255 access-list 1 permit 192.168.50.0 0.0.0.255 access-list 1 permit 10.10.10.0 0.0.0.225 access-list 101 permit ip 80.165.151.96 0.0.0.31 any access-list 102 permit ip 10.10.10.0 0.0.0.225 any access-list 105 remark ## FILEMAKER SERVER ## access-list 105 permit ip any host xxx.xxx.xxx.99 no cdp run control-plane mgcp profile default gatekeeper shutdown telephony-service max-ephones 10 max-conferences 8 gain -6 transfer-system full-consult line con 0 line aux 0 line 2 no activation-character no exec transport preferred none transport input all transport output pad telnet rlogin lapb-ta mop udptn v120 ssh stopbits 1 line vty 0 4 session-timeout 30 transport input ssh line vty 5 15 session-timeout 30 transport input ssh scheduler allocate 20000 1000 end R2911#
... View more
08-29-2019
02:59 AM
Hej and thanks in advance for helping out with any clues to resolve this issue... I'm a little confused and puzzeled about how to cover my trails, regarding to the Great China Firewall when using VPN/Zone Based Firewall. My goal is to be able to connect to Facebook/messenger and home country TV when in China and TV when out of Europe on my mobile devices (mobile phone, Pads, laptops) Before using VPN without ZBF there was no issue on - Router 1811 - version 15.1 !! Now on a Router 2921/K9 - Version 15.2(1)T2 ES, with same VPN config !! - but with Zone Based Firewall. My lokal TV suppler suddenly know my location even though that I'm using VPN. My own thoughts is that the issue lays in the " class-map type inspect match-any CLASS-L4-IP" Due to the reason that when I remove it - I can't connect via VPN, so some traffic goes through this Class-map and maybe it is here the TV suppler get there info on my location abroad. ?? Hope you guys have some ideas, pointers or solutions to solve the issue. ZBF (VPN) - Related config class-map type inspect match-any CLASS-L4-IP match protocol icmp match protocol tcp match protocol udp class-map type inspect match-any CLASS_CRYPTO_IPSEC_PASS match access-group name IPSEC_TRAFFIC --------- ip access-list extended IPSEC_TRAFFIC permit udp any any eq isakmp permit ahp any any permit esp any any permit udp any any eq non500-isakmp --------- policy-map type inspect POLICY-(SELF-->INTERNET) class type inspect CLASS_CRYPTO_IPSEC_PASS pass class type inspect CLASS-L4-IP inspect class class-default drop log policy-map type inspect POLICY-(INTERNET-->SELF) class type inspect CLASS_CRYPTO_IPSEC_PASS pass class type inspect CLASS-L4-IP inspect class class-default drop log --------- zone-pair security SELF-TO-VPN-INTERNET source self destination INTERNET-ZONE service-policy type inspect POLICY-(SELF-->INTERNET) zone-pair security VPN-INTERNET-TO-SELF source INTERNET-ZONE destination self service-policy type inspect POLICY-(INTERNET-->SELF) VPN related config crypto isakmp policy 150 encr aes 256 authentication pre-share group 2 crypto isakmp client configuration group TRUSTED-VPN key XXXXXX dns 208.67.222.222 208.67.220.220 pool REMOTE-VPN-TRUSTED acl 101 crypto isakmp profile TRUSTED-VPN-PROFILE match identity group TRUSTED-VPN client authentication list userauthen isakmp authorization list userauthen client configuration address initiate client configuration address respond virtual-template 2 crypto ipsec transform-set TRUSTED-VPN-1 esp-aes 256 esp-sha-hmac crypto ipsec profile TRUSTED-VPN-VTUNNEL-PROFILE set security-association lifetime kilobytes disable set security-association lifetime seconds 28800 set transform-set TRUSTED-VPN-1 set isakmp-profile TRUSTED-VPN-PROFILE interface Virtual-Template2 type tunnel description Virtuel TRUSTED-VPN ip unnumbered GigabitEthernet0/0 ip nat inside ip virtual-reassembly in zone-member security DMZ-ZONE tunnel source GigabitEthernet0/0 tunnel mode ipsec ipv4 tunnel protection ipsec profile TRUSTED-VPN-VTUNNEL-PROFILE access-list 101 permit ip xxx.xxx.xxx.96 0.0.0.31 any
... View more
Labels:
08-24-2019
06:21 AM
Final and Full working config - regarding ZBF object-group network GROUP_DMZ_FILEMAKER description FILEMAKER server in DMZ host XXX.XXX.XXX.99 object-group network GROUP_DMZ_MAIL description EMAIL servers in DMZ host XXX.XXX.XXX.100 host XXX.XXX.XXX.115 object-group network GROUP-DMZ-WEBSERVER description file servers in DMZ host XXX.XXX.XXX.101 host XXX.XXX.XXX.102 host XXX.XXX.XXX.103 host XXX.XXX.XXX.104 host XXX.XXX.XXX.105 class-map type inspect match-any CLASS-INTERNET-TRAFFIC match protocol http match protocol https match protocol dns match protocol icmp class-map type inspect match-any CLASS-FTP match protocol ftp match protocol ftps class-map type inspect match-any CLASS-SSH match protocol ssh class-map type inspect match-any CLASS-IMAP-SMTP match protocol dns match access-group name EIMS-MAILSERVER match access-group name EIMS-MAILSERVER-ADMIN class-map type inspect match-any CLASS-APPLE-AFP match access-group name APPLE-FILE-SHARING class-map type inspect match-all CLASS-MAIL-SERVER-(IP-RANGE-GROUP) match access-group name INTERNET-->DMZ-EMAIL match class-map CLASS-IMAP-SMTP class-map type inspect match-all CLASS-FILE-SERVER-(IP-RANGE-GROUP) match access-group name INTERNET-->DMZ-WEBSERVER match class-map CLASS-INTERNET-TRAFFIC class-map type inspect match-all CLASS-FILEMAKER-SERVER-(IP-RANGE-GROUP) match access-group name INTERNET-->DMZ-FILEMAKER class-map type inspect match-any CLASS-APPLE-REMOTE-DESKTOP match access-group name APPLE-REMOTE-DESKTOP class-map type inspect match-any CLASS_CRYPTO_IPSEC_PASS match access-group name IPSEC_TRAFFIC class-map type inspect match-any CLASS-L4-IP match protocol icmp match protocol tcp match protocol udp policy-map type inspect POLICY-(PRIVATE-->DMZ) class type inspect CLASS-FTP inspect class type inspect CLASS-SSH inspect class type inspect CLASS-APPLE-REMOTE-DESKTOP inspect class type inspect CLASS-APPLE-AFP inspect class type inspect CLASS-INTERNET-TRAFFIC inspect class type inspect CLASS-IMAP-SMTP inspect class type inspect CLASS-L4-IP inspect class class-default drop log policy-map type inspect POLICY-(SELF-->INTERNET) class type inspect CLASS_CRYPTO_IPSEC_PASS pass class type inspect CLASS-L4-IP inspect class class-default drop log policy-map type inspect POLICY-(INTERNET-->SELF) class type inspect CLASS_CRYPTO_IPSEC_PASS pass class type inspect CLASS-L4-IP inspect class class-default drop log policy-map type inspect POLICY-(PRIVATE-->INTERNET) class type inspect CLASS-L4-IP inspect class class-default drop log policy-map type inspect POLICY-(INTERNET-->DMZ) class type inspect CLASS-MAIL-SERVER-(IP-RANGE-GROUP) inspect class type inspect CLASS-FILE-SERVER-(IP-RANGE-GROUP) inspect class class-default drop log policy-map type inspect POLICY-(DMZ-->INTERNET) class type inspect CLASS-L4-IP inspect class class-default drop log zone security PRIVATE-ZONE zone security INTERNET-ZONE zone security DMZ-ZONE zone-pair security PRIVATE-TO-DMZ source PRIVATE-ZONE destination DMZ-ZONE service-policy type inspect POLICY-(PRIVATE-->DMZ) zone-pair security PRIVATE-TO-INTERNET source PRIVATE-ZONE destination INTERNET-ZONE service-policy type inspect POLICY-(PRIVATE-->INTERNET) zone-pair security INTERNET-TO-DMZ source INTERNET-ZONE destination DMZ-ZONE service-policy type inspect POLICY-(INTERNET-->DMZ) zone-pair security DMZ-TO-INTERNET source DMZ-ZONE destination INTERNET-ZONE service-policy type inspect POLICY-(DMZ-->INTERNET) zone-pair security SELF-TO-VPN-INTERNET source self destination INTERNET-ZONE service-policy type inspect POLICY-(SELF-->INTERNET) zone-pair security VPN-INTERNET-TO-SELF source INTERNET-ZONE destination self service-policy type inspect POLICY-(INTERNET-->SELF) interface GigabitEthernet0/0 description ISP WAN (Wide Area Network) ip address XXX.XXX.XXX.190 255.255.255.252 ip nat outside ip virtual-reassembly in zone-member security INTERNET-ZONE duplex auto speed auto interface GigabitEthernet0/1 description LAN (Local Area Network) ip address pool VLAN100 ip nat inside ip virtual-reassembly in zone-member security PRIVATE-ZONE duplex auto speed auto interface GigabitEthernet0/2 description LAN (Local Area Network) ip address pool VLAN50 ip nat inside ip virtual-reassembly in zone-member security PRIVATE-ZONE duplex auto speed auto interface Vlan200 description HWIC-4ESW_LAN - SERVER PARK ip address XXX.XXX.XXX.97 255.255.255.224 ip nat inside ip virtual-reassembly in zone-member security DMZ-ZONE interface Virtual-Template1 type tunnel description Virtuel VPN Forbindelse ip unnumbered GigabitEthernet0/0 ip nat inside ip virtual-reassembly in zone-member security INTERNET-ZONE tunnel source GigabitEthernet0/0 tunnel mode ipsec ipv4 tunnel protection ipsec profile SAS-VPN-VTUNNEL-PROFILE interface Virtual-Template2 type tunnel description Virtuel TRUSTED-VPN Forbindelse ip unnumbered GigabitEthernet0/0 ip nat inside ip virtual-reassembly in zone-member security DMZ-ZONE tunnel source GigabitEthernet0/0 tunnel mode ipsec ipv4 tunnel protection ipsec profile TRUSTED-VPN-VTUNNEL-PROFILE ip access-list extended IPSECtraffic permit esp any any permit udp any any eq isakmp permit ahp any any permit udp any any eq non500-isakmp ip access-list extended APPLE-FILE-SHARING permit tcp any any eq 427 permit tcp any any eq 548 ip access-list extended APPLE-REMOTE-DESKTOP permit tcp any any eq 22 permit udp any any eq 3283 permit tcp any any eq 5900 permit udp any any eq 5900 permit tcp any any eq 3283 ip access-list extended EIMS-MAILSERVER permit tcp any any eq 587 permit tcp any any eq smtp permit tcp any any eq 143 ip access-list extended EIMS-MAILSERVER-ADMIN permit tcp any any eq 4199 ip access-list extended INTERNET-->DMZ-EMAIL permit ip any object-group GROUP-DMZ-MAIL ip access-list extended INTERNET-->DMZ-FILEMAKER permit ip any object-group GROUP-DMZ-FILEMAKER ip access-list extended INTERNET-->DMZ-WEBSERVER permit ip any object-group GROUP-DMZ-WEBSERVER access-list 1 permit 192.168.100.0 0.0.0.255 access-list 1 permit 192.168.50.0 0.0.0.255 access-list 1 permit 10.10.10.0 0.0.0.225
... View more
08-13-2019
04:47 AM
Hi guys and thanks again for taking you time to help explain.. My goal is to only allow 5 ports through from INTERNET-ZONE to DMZ-ZONE and to specific ip addresses in object-groups. HTTP-HTTPS-DNS to my webserver IMAP-SMTP to my mailserver But I'm a little confused and not sure that I'm doing it right - if some of you could entlighte me or correct me, I would be delighted. Is - class-map type inspect match-any CLASS-L4-IP - necessary or does it just let everything through ?? Her is my config object-group network GROUP_DMZ_MAIL description EMAIL servers in DMZ host XXX.XXX.XXX.100 host XXX.XXX.XXX.115 object-group network GROUP-DMZ-WEBSERVER description FILE server in DMZ host XXX.XXX.XXX.101 host XXX.XXX.XXX.102 host XXX.XXX.XXX.103 host XXX.XXX.XXX.104 host XXX.XXX.XXX.105 ip access-list extended INTERNET-->DMZ-EMAIL permit ip any object-group GROUP-DMZ-MAIL ip access-list extended INTERNET-->DMZ-WEBSERVER permit ip any object-group GROUP-DMZ-WEBSERVER class-map type inspect match-any CLASS-L4-IP match protocol icmp match protocol tcp match protocol udp class-map type inspect match-any CLASS-INTERNET-TRAFFIC match protocol http match protocol https match protocol dns match protocol icmp class-map type inspect match-any CLASS-IMAP-SMTP match protocol imap match protocol smtp match protocol icmp class-map type inspect match-all CLASS-MAIL-SERVER-(IP-RANGE-GROUP) match access-group name INTERNET-->DMZ-EMAIL match class-map CLASS-IMAP-SMTP class-map type inspect match-all CLASS-FILE-SERVER-(IP-RANGE-GROUP) match access-group name INTERNET-->DMZ-WEBSERVER match class-map CLASS-INTERNET-TRAFFIC policy-map type inspect POLICY-(INTERNET-->DMZ) class type inspect CLASS-MAIL-SERVER-(IP-RANGE-GROUP) inspect class type inspect CLASS-FILE-SERVER-(IP-RANGE-GROUP) inspect class type inspect CLASS-L4-IP inspect class class-default drop log zone-pair security INTERNET-TO-DMZ source INTERNET-ZONE destination DMZ-ZONE service-policy type inspect POLICY-(INTERNET-->DMZ)
... View more
Labels:
08-09-2019
02:44 AM
I finally found a solution to my problem ;-) My (DMZ) and (Remote VPN) are on the same IP range, BUT in different ZONES - AND that is a problem !! - when (Remote VPN) is in the INTERNET-ZONE. So I had to move (Remote VPN) into the (DMZ-ZONE) and then everything works... And my Remote VPN users is trusted users .. Or keep (Remote VPN) in the (INTERNET-ZONE) and then give it a IP range of it ovn (f.ex. 10.10.10.0 - 255.255.255.0) TESTED and works to interface Virtual-Template1 type tunnel description Virtuel VPN Forbindelse ip unnumbered GigabitEthernet0/0 ip nat inside ip virtual-reassembly in zone-member security DMZ-ZONE tunnel source GigabitEthernet0/0 tunnel mode ipsec ipv4 tunnel protection ipsec profile SAS-VPN-VTUNNEL-PROFILE But anyways thanks to you all for taking your time to review my config.
... View more
08-08-2019
09:57 AM
Hi again and thanks in advance. I had some good help from Georg Pauwen before and he found som issues and directed me in the right direction but I'm still stocked with this problem even after implementing his fixes My Zone Based Firewall setup. My problem is still that when I connect remotely via VPN. I connect with some log issues to my router and data flows through VPN %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Aggressive mode failed with peer at 77.241.128.136 %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access2, changed state to down %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access2, changed state to up %FW-6-DROP_PKT: Dropping Unknown-l4 session 80.XX.XX.126:0 80.XX.XX.100:0 on zone-pair INTERNET-TO-DMZ class class-default due to DROP action found in policy-map with ip ident 0 %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access2, changed state to down %IP_VFR-7-FEATURE_DISABLE_IN: VFR(in) is manually disabled through CLI; VFR support for features that have internally enabled, will be made available only when VFR is enabled manually on interface Virtual-Access2 I have full access to the Internet (Outside) through Remote VPN But can't connect to my servers ( DMZ) %FW-6-DROP_PKT: Dropping Unknown-l4 session 80.XX.XX.126:0 80.XX.XX.100:0 on zone-pair INTERNET-TO-DMZ class class-default due to DROP action found in policy-map with ip ident 0 Indicates that my policy maps in zone-pair INTERNET-TO-DMZ are wrong or inadequate. I can't even ping the servers the DMZ via the VPN connection. but the default-router 80.xx.xx.97 answer the ping request. My Server (DMZ) and VPN are on the same IP range, not that I think matters. I have read CISCO ZBF guide many times now, but I really can't figure out what seems to be the problem. I even deleted all ZBF setting and tried to start all over again but with no luck. So I would be thankful for a pair of keen eyes to see if I have an obvious mis match somewhere in my config... Key elements in my config R2911 boot system flash c2900-universalk9-mz.SPA.154-3.M.bin ip dhcp excluded-address 192.168.100.1 192.168.100.49 ip dhcp excluded-address 192.168.50.1 192.168.50.49 ip dhcp pool VLAN200 network 80.xx.xx.96 255.255.255.240 default-router 80.xx.xx.97 dns-server 8.8.8.8 4.4.4.4 ip dhcp pool VLAN100 network 192.168.100.0 255.255.255.0 default-router 192.168.100.1 dns-server 192.168.100.1 ip dhcp pool VLAN50 network 192.168.50.0 255.255.255.0 default-router 192.168.50.1 dns-server 192.168.50.1 class-map type inspect match-any CLASS_CRYPTO_IPSEC_PASS match access-group name IPSEC_TRAFFIC class-map type inspect match-any CLASS-L4-IP match protocol icmp match protocol tcp match protocol udp class-map type inspect match-any CLASS-APPLE-REMOTE-DESKTOP match access-group name APPLE-REMOTE-DESKTOP class-map type inspect match-any CLASS-APPLE-AFP match access-group name APPLE-FILE-SHARING class-map type inspect match-any CLASS-INTERNET-TRAFFIC match protocol http match protocol https match protocol dns match protocol icmp class-map type inspect match-any CLASS-FTP match protocol ftp match protocol ftps class-map type inspect match-any CLASS-SSH match protocol ssh class-map type inspect match-any CLASS-IMAP-SMTP match protocol imap match protocol smtp class-map type inspect match-any CLASS-ALLOW_ALL_TRAFFIC_THROUGH match access-group name ALLOW_ALL_TRAFFIC_THROUGH policy-map type inspect POLICY-(PRIVATE-->DMZ) class type inspect CLASS-FTP inspect class type inspect CLASS-SSH inspect class type inspect CLASS-APPLE-REMOTE-DESKTOP inspect class type inspect CLASS-APPLE-AFP inspect class type inspect CLASS-INTERNET-TRAFFIC inspect class type inspect CLASS-IMAP-SMTP inspect class type inspect CLASS-L4-IP inspect class class-default drop log policy-map type inspect POLICY-(SELF-->INTERNET) class type inspect CLASS_CRYPTO_IPSEC_PASS pass class type inspect CLASS-L4-IP inspect class class-default drop log policy-map type inspect POLICY-(INTERNET-->SELF) class type inspect CLASS_CRYPTO_IPSEC_PASS pass class type inspect CLASS-L4-IP inspect class class-default drop log policy-map type inspect POLICY-(PRIVATE-->INTERNET) class type inspect CLASS-INTERNET-TRAFFIC inspect class type inspect CLASS-FTP inspect class type inspect CLASS-L4-IP inspect class class-default drop log policy-map type inspect POLICY-(INTERNET-->DMZ) class type inspect CLASS-IMAP-SMTP inspect class type inspect CLASS-INTERNET-TRAFFIC inspect class type inspect CLASS-L4-IP inspect class class-default drop log policy-map type inspect POLICY-(DMZ-->INTERNET) class type inspect CLASS-ALLOW_ALL_TRAFFIC_THROUGH inspect class class-default drop log zone security PRIVATE-ZONE zone security INTERNET-ZONE zone security DMZ-ZONE The Green zone-pairs works fine zone-pair security PRIVATE-TO-DMZ source PRIVATE-ZONE destination DMZ-ZONE service-policy type inspect POLICY-(PRIVATE-->DMZ) zone-pair security PRIVATE-TO-INTERNET source PRIVATE-ZONE destination INTERNET-ZONE service-policy type inspect POLICY-(PRIVATE-->INTERNET) zone-pair security INTERNET-TO-DMZ source INTERNET-ZONE destination DMZ-ZONE service-policy type inspect POLICY-(INTERNET-->DMZ) zone-pair security DMZ-TO-INTERNET source DMZ-ZONE destination INTERNET-ZONE service-policy type inspect POLICY-(DMZ-->INTERNET) zone-pair security SELF-TO-VPN-INTERNET source self destination INTERNET-ZONE service-policy type inspect POLICY-(SELF-->INTERNET) zone-pair security VPN-INTERNET-TO-SELF source INTERNET-ZONE destination self service-policy type inspect POLICY-(INTERNET-->SELF) crypto isakmp policy 150 encr aes 256 authentication pre-share group 2 crypto isakmp client configuration group SAS-VPN key XXXXXX dns 208.67.222.222 208.67.220.220 pool REMOTE-VPN-CLIENTS acl 101 crypto isakmp profile SAS-VPN-PROFILE match identity group SAS-VPN client authentication list userauthen isakmp authorization list userauthen client configuration address initiate client configuration address respond virtual-template 1 crypto ipsec transform-set SAS-VPN-1 esp-aes 256 esp-sha-hmac crypto ipsec profile SAS-VPN-VTUNNEL-PROFILE set security-association lifetime kilobytes disable set security-association lifetime seconds 86400 set transform-set SAS-VPN-1 set isakmp-profile SAS-VPN-PROFILE interface GigabitEthernet0/0 description ISP WAN (Wide Area Network) ip address 87.XXX.XXX.190 255.255.255.252 ip nat outside ip virtual-reassembly in zone-member security INTERNET-ZONE duplex auto speed auto interface GigabitEthernet0/1 description LAN (Local Area Network) ip address pool VLAN100 ip nat inside ip virtual-reassembly in zone-member security PRIVATE-ZONE duplex auto speed auto interface GigabitEthernet0/2 description LAN (Local Area Network) ip address pool VLAN50 ip nat inside ip virtual-reassembly in zone-member security PRIVATE-ZONE duplex auto speed auto interface Vlan200 description HWIC-4ESW_LAN - SERVER PARK ip address 80.XXX.XXX.97 255.255.255.224 ip nat inside ip virtual-reassembly in zone-member security DMZ-ZONE interface Virtual-Template1 type tunnel description Virtuel VPN Forbindelse ip unnumbered GigabitEthernet0/0 ip nat inside ip virtual-reassembly in zone-member security INTERNET-ZONE tunnel source GigabitEthernet0/0 tunnel mode ipsec ipv4 tunnel protection ipsec profile SAS-VPN-VTUNNEL-PROFILE router eigrp 100 network 80.0.0.0 network 87.0.0.0 network 192.168.0.0 router ospf 123 network 80.0.0.0 0.255.255.255 area 0 network 87.0.0.0 0.255.255.255 area 0 network 192.0.0.0 0.255.255.255 area 0 ip local pool REMOTE-VPN-CLIENTS 80.xx.xx.123 80.xx.xx.126 ip forward-protocol nd ip nat inside source list 1 interface GigabitEthernet0/0 overload ip route 0.0.0.0 0.0.0.0 87.63.227.189 ip access-list extended ALLOW_ALL_TRAFFIC_TROUGH permit ip any any ip access-list extended APPLE-FILE-SHARING permit tcp any any eq 427 permit tcp any any eq 548 ip access-list extended APPLE-REMOTE-DESKTOP permit tcp any any eq 22 permit udp any any eq 3283 permit tcp any any eq 5900 permit udp any any eq 5900 permit tcp any any eq 3283 ip access-list extended EIMS-MAILSERVER permit tcp any any eq 587 permit tcp any any eq smtp permit tcp any any eq 143 ip access-list extended EIMS-MAILSERVER-ADMIN permit tcp any any eq 4199 ip access-list extended IPSEC_TRAFFIC permit ahp any any permit esp any any permit udp any any eq non500-isakmp permit udp any any eq isakmp access-list 1 permit 192.168.100.0 0.0.0.225 access-list 1 permit 192.168.50.0 0.0.0.255 access-list 123 permit esp any any access-list 123 permit udp any any eq non500-isakmp access-list 123 permit ahp any any access-list 123 permit udp any any eq isakmp
... View more
Labels:
08-02-2019
03:01 AM
Thanks for your time Georg Your solution didn’t solve the issue - But it boosted the general response time and flov speed tremendously So could have been and still was some of the problem. So nice spottet I think I have to analyse my Classes and Policies and Zone-pairs a little deeper Before implementing ZBF again Somebody on the list pointet at that I needed 2 ZONE-PAIR’s one for both ways INTERNET to SELF SELF TO INTERNET That fixed my problem But then I found out that ZONE-PAIR "INTERNET to DMZ" wasn’t running smooth I could ping through but UDP keeps dropping in the log and I have no connection in or out for Application services. I have to dig a little deeper into the manuals to see what’s wrong ;-) Thanks again
... View more
08-01-2019
08:38 AM
Hi Paul and thanks for taking your time. PRIVAT --> INTERNET = Works PRIVAT --> DMZ = Works DMZ --> INTERNET = Works INTERNET --> DMZ = WORKS It is when I try to connect via REMOTE VPN That I can browse the Internet - but I can't browse my own web-server and mail-server So it seems as that I can't connect to the DMZ-ZONE when on REMOTE VPN
... View more
08-01-2019
04:06 AM
hostname R2911 ! boot-start-marker boot system flash c2900-universalk9-mz.SPA.154-3.M.bin boot-end-marker ! ! ! card type command needed for slot/vwic-slot 0/2 no logging console enable secret 5 $1$8LqH$9JXseHd62tFJvW3cp9gxp. ! aaa new-model ! ! aaa authentication login userauthen local aaa authorization network userauthen local ! ! ! ! ! aaa session-id common ! memory-size iomem 25 ! no ipv6 cef no ip source-route ! ! ! ip dhcp excluded-address 192.168.100.1 192.168.100.49 ip dhcp excluded-address 192.168.50.1 192.168.50.49 ! ip dhcp pool VLAN200 network XXX.XXX.XXX. 96 255.255.255.240 default-router XXX.XXX.XXX. 97 dns-server 8.8.8.8 4.4.4.4 ! ip dhcp pool VLAN100 network 192.168.100.0 255.255.255.0 default-router 192.168.100.1 dns-server 192.168.100.1 ! ip dhcp pool VLAN50 network 192.168.50.0 255.255.255.0 default-router 192.168.50.1 dns-server 192.168.50.1 ! ! ip domain name mediadesign.dk ip name-server 208.67.222.222 ip name-server 208.67.220.220 ip name-server 62.243.0.166 ip name-server 194.192.207.166 ip cef ip cef accounting non-recursive ! multilink bundle-name authenticated ! ! ! ! ! crypto pki token default removal timeout 0 ! crypto pki trustpoint TP-self-signed-2506629599 enrollment selfsigned subject-name cn=IOS-Self-Signed-Certificate-2506629599 revocation-check none rsakeypair TP-self-signed-2506629599 ! ! crypto pki certificate chain TP-self-signed-2506629599 certificate self-signed 01 3082022B 30820194 A0030201 02020101 300D0609 2A864886 F70D0101 05050030 31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274 69666963 6174652D 32353036 36323935 3939301E 170D3137 31313231 31383331 34355A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649 4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D32 35303636 32393539 3930819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281 8100B864 001074AA 3ACB326E 0746CC7D 5A1A7E4B 92667702 844CEF49 166B0D95 DAF80B11 3A0C8AF0 A4A4C5D4 491FB34D 28F83027 8E882C56 16890795 80538DF4 754EA389 DBCD4C5F 24ED9E61 D4A5FD94 B2A6DBAA D2A624EB 23D4E3DB CD2B27EC 73277F09 5908425D 70D1212B 946D3A92 9C628C55 96FB2A75 376BF8A4 B2632D47 B3030203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603 551D2304 18301680 1421FD81 D44399EA FFD554A4 97C6A7DC C3C72BD8 FD301D06 03551D0E 04160414 21FD81D4 4399EAFF D554A497 C6A7DCC3 C72BD8FD 300D0609 2A864886 F70D0101 05050003 8181008E 5E8AFBFC 86243F4E AD1785BC 72C1FC2C F2CB747E E70E5983 F1A1F60B 539C67F7 028712AD 1A9A3154 7459C967 A51AE7CD 1C8DB2A5 0BF089EB B9B1A24C 951C677B CBD18212 CC59A5A3 8F3AB203 9B839185 93798F89 141FCCBD F67CCDE2 1428963A 982720ED 59D95C02 DCC9CD7D B842BE47 C37855E0 7901AFD3 B71FA3A4 B48ADD quit voice-card 0 ! ! ! ! ! ! ! ! license feature snasw license udi pid CISCO2911/K9 sn FTX1814ALDX license accept end user agreement license boot module c2900 technology-package securityk9 license boot module c2900 technology-package uck9 license boot module c2900 technology-package datak9 hw-module pvdm 0/0 ! hw-module pvdm 0/1 ! ! ! object-group network DMZ-FILEMAKER description FILEMAKER server in DMZ host XXX.XXX.XXX.99 ! object-group network DMZ-MAIL description EMAIL servers in DMZ host XXX.XXX.XXX.100 host XXX.XXX.XXX.115 ! object-group network DMZ-MEDIADESIGN description MEDIADESIGN file-www-ftp server in DMZ host XXX.XXX.XXX.101 host XXX.XXX.XXX.102 host XXX.XXX.XXX.103 host XXX.XXX.XXX.104 host XXX.XXX.XXX.105 host XXX.XXX.XXX.106 host XXX.XXX.XXX.107 host XXX.XXX.XXX.108 host XXX.XXX.XXX.109 host XXX.XXX.XXX.110 username XXX username xxx ! redundancy ! ! ! ! ! ip ssh time-out 60 ip ssh version 2 ! class-map type inspect match-any L4-ip-class match protocol icmp match protocol tcp match protocol udp class-map type inspect match-any INTERNET-TRAFFIC-CLASS match protocol http match protocol https match protocol dns match protocol icmp class-map type inspect match-all FILEMAKER-SERVER-CLASS match access-group name INTERNET-->DMZ-FILEMAKER match access-group 105 class-map type inspect match-any NTP-CLASS match protocol ntp class-map type inspect match-all MEDIADESIGN-SERVER-CLASS match access-group name INTERNET-->DMZ-MEDIADESIGN match class-map NTP-CLASS class-map type inspect match-any APPLE-REMOTE-DESKTOP match access-group name APPLE-REMOTE-DESKTOP class-map type inspect match-any FTP-CLASS match protocol ftp match protocol ftps class-map type inspect match-any SSH-CLASS match protocol ssh class-map type inspect match-any APPLE-AFP match access-group name APPLE-FILE-SHARING class-map type inspect match-any IMAP-SMTP-CLASS match protocol imap match protocol imap3 match protocol imaps match protocol smtp match protocol pop3 match protocol pop3s class-map type inspect match-all MAIL-SERVER-CLASS match access-group name INTERNET-->DMZ-EMAIL match class-map IMAP-SMTP-CLASS match access-group name EIMS-MAILSERVER class-map type inspect match-any L4-ipsec-class match access-group name IPSECtraffic ! ! policy-map type inspect PRIVATE-->DMZ-POLICY class type inspect FILEMAKER-SERVER-CLASS inspect class type inspect FTP-CLASS inspect class type inspect SSH-CLASS inspect class type inspect APPLE-REMOTE-DESKTOP inspect class type inspect APPLE-AFP inspect class type inspect L4-ip-class inspect class type inspect MAIL-SERVER-CLASS inspect class class-default drop log policy-map type inspect ALLOW-ALL-ISAKMP class type inspect L4-ipsec-class pass class class-default drop policy-map type inspect PRIVATE-->INTERNET-POLICY class type inspect INTERNET-TRAFFIC-CLASS inspect class type inspect FTP-CLASS inspect class type inspect L4-ip-class inspect class class-default drop log policy-map type inspect INTERNET-->DMZ-POLICY class type inspect INTERNET-TRAFFIC-CLASS inspect class type inspect MEDIADESIGN-SERVER-CLASS inspect class type inspect FILEMAKER-SERVER-CLASS inspect class type inspect MAIL-SERVER-CLASS inspect class type inspect L4-ip-class inspect class class-default drop log policy-map type inspect DMZ-->INTERNET class type inspect MAIL-SERVER-CLASS inspect class type inspect L4-ip-class inspect class class-default drop log ! zone security PRIVATE-ZONE zone security INTERNET-ZONE zone security DMZ-ZONE zone security VPN-ZONE zone-pair security PRIVATE-TO-DMZ source PRIVATE-ZONE destination DMZ-ZONE service-policy type inspect PRIVATE-->DMZ-POLICY zone-pair security PRIVATE-TO-INTERNET source PRIVATE-ZONE destination INTERNET-ZONE service-policy type inspect PRIVATE-->INTERNET-POLICY zone-pair security INTERNET-TO-DMZ source INTERNET-ZONE destination DMZ-ZONE service-policy type inspect INTERNET-->DMZ-POLICY zone-pair security DMZ-TO-INTERNET source DMZ-ZONE destination INTERNET-ZONE service-policy type inspect DMZ-->INTERNET zone-pair security VPN-TO-SELFXX source INTERNET-ZONE destination self service-policy type inspect ALLOW-ALL-ISAKMP ! ! crypto isakmp policy 150 encr aes 256 authentication pre-share group 2 ! crypto isakmp client configuration group SAS-VPN key XXXXXX dns 208.67.222.222 208.67.220.220 pool REMOTE-VPN-CLIENTS crypto isakmp profile SAS-VPN-PROFILE match identity group SAS-VPN client authentication list userauthen isakmp authorization list userauthen client configuration address initiate client configuration address respond virtual-template 1 ! ! crypto ipsec transform-set SAS-VPN-1 esp-aes 256 esp-sha-hmac ! crypto ipsec profile SAS-VPN-VTUNNEL-PROFILE set security-association lifetime kilobytes disable set security-association lifetime seconds 86400 set transform-set SAS-VPN-1 set isakmp-profile SAS-VPN-PROFILE ! ! ! ! ! ! ! interface Loopback0 ip address 10.108.1.1 255.255.255.0 ! interface Embedded-Service-Engine0/0 no ip address ! interface GigabitEthernet0/0 description ISP WAN (Wide Area Network) ip address XXX.XXX.XXX.190 255.255.255.252 ip nat outside ip virtual-reassembly in zone-member security INTERNET-ZONE duplex auto speed auto ! interface GigabitEthernet0/1 description LAN (Local Area Network) ip address pool VLAN100 ip nat inside ip virtual-reassembly in zone-member security PRIVATE-ZONE duplex auto speed auto ! interface GigabitEthernet0/2 description LAN (Local Area Network) ip address pool VLAN50 ip nat inside ip virtual-reassembly in zone-member security PRIVATE-ZONE duplex auto speed auto ! interface Serial0/0/0 no ip address ! interface FastEthernet0/1/0 switchport access vlan 200 no ip address ! interface FastEthernet0/1/1 switchport access vlan 200 no ip address ! interface FastEthernet0/1/2 switchport access vlan 200 no ip address ! interface FastEthernet0/1/3 switchport access vlan 200 no ip address ! interface Virtual-Template1 type tunnel description Virtuel VPN Forbindelse ip unnumbered GigabitEthernet0/0 ip nat inside ip virtual-reassembly in zone-member security INTERNET-ZONE tunnel source GigabitEthernet0/0 tunnel mode ipsec ipv4 tunnel protection ipsec profile SAS-VPN-VTUNNEL-PROFILE ! interface Vlan1 no ip address ! interface Vlan50 description GUEST NETWORK DHCP POOL no ip address ip nat inside ip virtual-reassembly in ! interface Vlan100 description INTERNAL NETWORK DHCP POOL ip address dhcp ip nat inside ip virtual-reassembly in ! interface Vlan200 description HWIC-4ESW_LAN - SERVER PARK ip address XXX.XXX.XXX.97 255.255.255.224 ip nat inside ip virtual-reassembly in zone-member security DMZ-ZONE ! ! ! router eigrp 100 network 80.0.0.0 network 87.0.0.0 network 192.168.0.0 ! router ospf 123 network 80.0.0.0 0.255.255.255 area 0 network 87.0.0.0 0.255.255.255 area 0 network 192.0.0.0 0.255.255.255 area 0 ! ip local pool REMOTE-VPN-CLIENTS XXX.XXX.XXX. 123 XXX.XXX.XXX. 126 ip forward-protocol nd ! no ip http server ip http authentication local ip http secure-server ! ip nat inside source list 1 interface GigabitEthernet0/0 overload ip route 0.0.0.0 0.0.0.0 XXX.XXX.XXX. 189 ! ip access-list extended APPLE-FILE-SHARING permit tcp any any eq 427 permit tcp any any eq 548 ip access-list extended APPLE-REMOTE-DESKTOP permit tcp any any eq 22 permit udp any any eq 3283 permit tcp any any eq 5900 permit udp any any eq 5900 permit tcp any any eq 3283 ip access-list extended EIMS-MAILSERVER permit tcp any any eq 587 ip access-list extended INTERNET-->DMZ-EMAIL permit ip any object-group DMZ-MAIL ip access-list extended INTERNET-->DMZ-FILEMAKER permit ip any object-group DMZ-FILEMAKER ip access-list extended INTERNET-->DMZ-MEDIADESIGN permit ip any object-group DMZ-MEDIADESIGN ip access-list extended IPSECtraffic permit esp any any permit udp any any eq isakmp permit ahp any any permit udp any any eq non500-isakmp ! access-list 1 permit 192.168.100.0 0.0.0.225 access-list 1 permit 192.168.50.0 0.0.0.255 access-list 1 permit XXX.XXX.XXX .96 0.0.0.31 access-list 105 remark ## FILEMAKER SERVER ## ! no cdp run ! ! ! ! ! ! ! control-plane ! ! ! ! mgcp profile default ! ! ! ! ! gatekeeper shutdown ! ! telephony-service max-ephones 10 max-conferences 8 gain -6 transfer-system full-consult ! ! ! line con 0 line aux 0 line 2 no activation-character no exec transport preferred none transport input all transport output pad telnet rlogin lapb-ta mop udptn v120 ssh stopbits 1 line vty 0 4 session-timeout 30 transport input ssh line vty 5 15 session-timeout 30 transport input ssh ! scheduler allocate 20000 1000 end
... View more
08-01-2019
02:14 AM
Hi again and thanks in advance I just vent from static firewall to Zone Based Firewall as sugested in another discussion and so far so god and my setup nearly works perfect !! and here is the schematic My issue is that when I connect remotely via VPN I have access to Internet (Outside) But can't connect to my servers ( DMZ) My Server (DMZ) and VPN are on the same IP range, not that I think matters. I'll try to give the VPN connections another IP range later. Key elements in my config ip dhcp excluded-address 192.168.100.1 192.168.100.49 ip dhcp excluded-address 192.168.50.1 192.168.50.49 ip dhcp pool VLAN200 network xx.xx.xx.96 255.255.255.240 default-router xx.xx.xx.97 dns-server 8.8.8.8 4.4.4.4 ip dhcp pool VLAN100 network 192.168.100.0 255.255.255.0 default-router 192.168.100.1 dns-server 192.168.100.1 ip dhcp pool VLAN50 network 192.168.50.0 255.255.255.0 default-router 192.168.50.1 dns-server 192.168.50.1 ————————————————————————————————————————————————————————————— I know the are the same !! / BUT easier to create an overview with fuld naming class-map type inspect match-any CLASS-L4-IPSEC match access-group name IPSEC_TRAFFIC class-map type inspect match-all CLASS_CRYPTO_IPSEC_TRAFFIC_OUT_TO_SELF_PASS match access-group name IPSEC_TRAFFIC class-map type inspect match-any CLASS_CRYPTO_IPSEC_TRAFFIC_SELF_TO_OUT_PASS match access-group name IPSEC_TRAFFIC I know the are the same !! / BUT easier to create an overview with fuld naming class-map type inspect match-any CLASS-L4-IP match protocol icmp match protocol tcp match protocol udp class-map type inspect match-any CLASS_SELF_TO_OUT_INSPECT match protocol icmp match protocol tcp match protocol udp class-map type inspect match-any CLASS_OUT_TO_SELF_INSPECT match protocol icmp match protocol tcp match protocol udp class-map type inspect match-any CLASS-APPLE-REMOTE-DESKTOP match access-group name APPLE-REMOTE-DESKTOP class-map type inspect match-any CLASS-APPLE-AFP match access-group name APPLE-FILE-SHARING class-map type inspect match-any CLASS-INTERNET-TRAFFIC match protocol http match protocol https match protocol dns match protocol icmp class-map type inspect match-any CLASS-FTP match protocol ftp match protocol ftps class-map type inspect match-any CLASS-SSH match protocol ssh class-map type inspect match-any CLASS-IMAP-SMTP match protocol imap match protocol smtp class-map type inspect match-any CLASS-ALLOW_ALL_TRAFFIC_THROUGH match access-group name ALLOW_ALL_TRAFFIC_THROUGH ————————————————————————————————————————————————————————————— policy-map type inspect POLICY-(PRIVATE-->DMZ) class type inspect CLASS-FTP inspect class type inspect CLASS-SSH inspect class type inspect CLASS-APPLE-REMOTE-DESKTOP inspect class type inspect CLASS-APPLE-AFP inspect class type inspect CLASS-INTERNET-TRAFFIC inspect class type inspect CLASS-IMAP-SMTP inspect class type inspect CLASS-L4-IP inspect class class-default drop log policy-map type inspect POLICY-(SELF-->INTERNET) class type inspect CLASS_CRYPTO_IPSEC_TRAFFIC pass class type inspect CLASS_SELF_TO_OUT_INSPECT inspect class class-default drop log policy-map type inspect POLICY-(INTERNET-->SELF) class type inspect CLASS_CRYPTO_IPSEC_TRAFFIC pass class type inspect CLASS_OUT_to_SELF_INSPECT inspect class class-default drop log policy-map type inspect POLICY-(PRIVATE-->INTERNET) class type inspect CLASS-INTERNET-TRAFFIC inspect class type inspect CLASS-FTP inspect class type inspect CLASS-L4-IP inspect class class-default drop log policy-map type inspect POLICY-(INTERNET-->DMZ) class type inspect CLASS-IMAP-SMTP inspect class type inspect CLASS-INTERNET-TRAFFIC inspect class type inspect CLASS-L4-IP inspect class class-default drop log policy-map type inspect POLICY-(DMZ-->INTERNET) class type inspect CLASS-ALLOW_ALL_TRAFFIC_THROUGH inspect class class-default drop log ————————————————————————————————————————————————————————————— zone security PRIVATE-ZONE zone security INTERNET-ZONE zone security DMZ-ZONE ————————————————————————————————————————————————————————————— zone-pair security PRIVATE-TO-DMZ source PRIVATE-ZONE destination DMZ-ZONE service-policy type inspect POLICY-(PRIVATE-->DMZ) zone-pair security PRIVATE-TO-INTERNET source PRIVATE-ZONE destination INTERNET-ZONE service-policy type inspect POLICY-(PRIVATE-->INTERNET) zone-pair security INTERNET-TO-DMZ source INTERNET-ZONE destination DMZ-ZONE service-policy type inspect POLICY-(INTERNET-->DMZ) zone-pair security DMZ-TO-INTERNET source DMZ-ZONE destination INTERNET-ZONE service-policy type inspect POLICY-(DMZ-->INTERNET) zone-pair security SELF-TO-VPN-INTERNET source self destination INTERNET-ZONE service-policy type inspect POLICY-(SELF-->INTERNET) zone-pair security VPN-INTERNET-TO-SELF source INTERNET-ZONE destination self service-policy type inspect POLICY-(INTERNET-->SELF) ————————————————————————————————————————————————————————————— crypto isakmp policy 150 encr aes 256 authentication pre-share group 2 crypto isakmp client configuration group SAS-VPN key XXXXXX dns 208.67.222.222 208.67.220.220 pool REMOTE-VPN-CLIENTS acl 101 crypto isakmp profile SAS-VPN-PROFILE match identity group SAS-VPN client authentication list userauthen isakmp authorization list userauthen client configuration address initiate client configuration address respond virtual-template 1 crypto ipsec transform-set SAS-VPN-1 esp-aes 256 esp-sha-hmac crypto ipsec profile SAS-VPN-VTUNNEL-PROFILE set security-association lifetime kilobytes disable set security-association lifetime seconds 86400 set transform-set SAS-VPN-1 set isakmp-profile SAS-VPN-PROFILE interface GigabitEthernet0/0 description ISP WAN (Wide Area Network) ip address XXX.XXX.XXX.190 255.255.255.252 ip nat outside ip virtual-reassembly in zone-member security INTERNET-ZONE duplex auto speed auto interface GigabitEthernet0/1 description LAN (Local Area Network) ip address pool VLAN100 ip nat inside ip virtual-reassembly in zone-member security PRIVATE-ZONE duplex auto speed auto interface GigabitEthernet0/2 description LAN (Local Area Network) ip address pool VLAN50 ip nat inside ip virtual-reassembly in zone-member security PRIVATE-ZONE duplex auto speed auto interface Vlan200 description HWIC-4ESW_LAN - SERVER PARK ip address XXX.XXX.XXX.97 255.255.255.224 ip nat inside ip virtual-reassembly in zone-member security DMZ-ZONE interface Virtual-Template1 type tunnel description Virtuel VPN Forbindelse ip unnumbered GigabitEthernet0/0 ip nat inside ip virtual-reassembly in zone-member security INTERNET-ZONE tunnel source GigabitEthernet0/0 tunnel mode ipsec ipv4 tunnel protection ipsec profile SAS-VPN-VTUNNEL-PROFILE ————————————————————————————————————————————————————————————— router eigrp 100 network 80.0.0.0 network 87.0.0.0 network 192.168.0.0 router ospf 123 network 80.0.0.0 0.255.255.255 area 0 network 87.0.0.0 0.255.255.255 area 0 network 192.0.0.0 0.255.255.255 area 0 ip local pool REMOTE-VPN-CLIENTS 80.xx.xx.123 80.xx.xx.126 ip forward-protocol nd ip nat inside source list 1 interface GigabitEthernet0/0 overload ip route 0.0.0.0 0.0.0.0 87.63.227.189 ip access-list extended ALLOW_ALL_TRAFFIC_TROUGH permit ip any any ip access-list extended APPLE-FILE-SHARING permit tcp any any eq 427 permit tcp any any eq 548 ip access-list extended APPLE-REMOTE-DESKTOP permit tcp any any eq 22 permit udp any any eq 3283 permit tcp any any eq 5900 permit udp any any eq 5900 permit tcp any any eq 3283 ip access-list extended EIMS-MAILSERVER permit tcp any any eq 587 permit tcp any any eq smtp permit tcp any any eq 143 ip access-list extended EIMS-MAILSERVER-ADMIN permit tcp any any eq 4199 ip access-list extended IPSEC_TRAFFIC permit udp any eq isakmp any permit udp any eq non500-isakmp any permit ahp any any permit esp any any permit udp any any eq non500-isakmp permit udp any any eq isakmp ————————————————————————————————————————————————————————————— access-list 1 permit 192.168.100.0 0.0.0.225 access-list 1 permit 192.168.50.0 0.0.0.255 access-list 123 permit esp any any access-list 123 permit udp any any eq non500-isakmp access-list 123 permit ahp any any access-list 123 permit udp any any eq isakmp
... View more
Labels:
07-21-2019
12:47 PM
Hi - and thanks for taking your time to help ;-) I tried to use your command - crypto isakmp aggressive-mode disable That resulted in not being able to connect via VPN So - no crypto isakmp aggressive-mode disable - and the connection is open again Here is the log - it might share so light for you %CRYPTO-5-IKMP_AG_MODE_DISABLED: Unable to initiate or respond to Aggressive Mode while disabled %SSH-4-SSH2_UNEXPECTED_MSG: Unexpected message type has arrived. Terminating the connection %CRYPTO-5-IKMP_AG_MODE_DISABLED: Unable to initiate or respond to Aggressive Mode while disabled %CRYPTO-5-IKMP_AG_MODE_DISABLED: Unable to initiate or respond to Aggressive Mode while disabled %CRYPTO-5-IKMP_AG_MODE_DISABLED: Unable to initiate or respond to Aggressive Mode while disabled And I still have %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Aggressive mode failed with peer at 77.241.140.161
... View more
07-21-2019
05:18 AM
Hi All and thanks for any clues or solutions. First Issue My VPN setup seems to work ( Connects fine to my Iphone and Ipad) even with some issues in the log !! ?? Should I just ignore those ?? %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Aggressive mode failed with peer at 77.241.128.136 %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access2, changed state to down %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access2, changed state to up %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access2, changed state to down %IP_VFR-7-FEATURE_DISABLE_IN: VFR(in) is manually disabled through CLI; VFR support for features that have internally enabled, will be made available only when VFR is enabled manually on interface Virtual-Access2 Can't figure out how to enable "Aggressive mode" in my setup Can't figure out how to enable "VFR" manually - looks like it is enabled R2911(config-if)#do show ip virtual-reassembly features Virtual-Template1: Virtual Fragment Reassembly (VFR) Current Status is ENABLED [in] Features to use if VFR is Enabled::NAT interface Virtual-Template1 type tunnel ip unnumbered GigabitEthernet0/0 ip nat inside ip virtual-reassembly in tunnel source GigabitEthernet0/0 tunnel mode ipsec ipv4 tunnel protection ipsec profile XXX-VPN-VTUNNEL-PROFILE Second Question Is my VPN setup the optimal way off connecting to my home base ?? Should I keep this setup or go for something smarter ?? Any pro's with Dynamic Map versus Static Maps ?? Here is the key stuff off my setup crypto isakmp policy 150 encr aes 256 authentication pre-share group 2 crypto isakmp client configuration group XXX-VPN key XXXXXX dns 208.67.222.222 208.67.220.220 pool REMOTE-VPN-CLIENTS crypto isakmp profile XXX-VPN-PROFILE match identity group XXX-VPN client authentication list userauthen isakmp authorization list userauthen client configuration address initiate client configuration address respond virtual-template 1 crypto ipsec transform-set XXX-VPN-1 esp-aes 256 esp-sha-hmac crypto ipsec profile XXX-VPN-VTUNNEL-PROFILE set security-association lifetime kilobytes disable set security-association lifetime seconds 86400 set transform-set XXX-VPN-1 set isakmp-profile XXX-VPN-PROFILE interface Virtual-Template1 type tunnel ip unnumbered GigabitEthernet0/0 ip nat inside ip virtual-reassembly in tunnel source GigabitEthernet0/0 tunnel mode ipsec ipv4 tunnel protection ipsec profile XXX-VPN-VTUNNEL-PROFILE ip local pool REMOTE-VPN-CLIENTS 100.100.100.123 100.100.100.126
... View more
Labels:
07-11-2019
04:27 AM
Tanks a lot Seb ;-) It was the IP NAT INSIDE to the VIRTUAL-TEMPLATE 1 TYPE TUNNEL there was missing
... View more
09-06-2019
Hey GeorgI’m a little challenged by the fact that the 2921 Router is a
live production Router.But I’...
08-29-2019
Thanks again George PauwenHere is the complete config..version
15.2hostname R2911boot-start-markerbo...
08-29-2019
Hej and thanks in advance for helping out with any clues to resolve this
issue... I'm a little confu...
08-24-2019
Final and Full working config - regarding ZBFobject-group network
GROUP_DMZ_FILEMAKER description FI...
08-13-2019
Hi guys and thanks again for taking you time to help explain..My goal is
to only allow 5 ports throu...
Created by
lars.arler
in Routing
08-09-2019
08-09-2019
I finally found a solution to my problem ;-) My (DMZ) and (Remote VPN)
are on the same IP range, BUT...
Created by
lars.arler
in Routing
08-08-2019
08-08-2019
Hi again and thanks in advance.I had some good help from Georg Pauwen
before and he found som issues...
Created by
lars.arler
in Routing
08-02-2019
08-02-2019
Thanks for your time GeorgYour solution didn’t solve the issue -But it
boosted the general response ...
Created by
lars.arler
in Routing
08-01-2019
08-01-2019
Hi Paul and thanks for taking your time. PRIVAT --> INTERNET =
WorksPRIVAT --> DMZ = WorksDMZ --> IN...
Created by
lars.arler
in Routing
08-01-2019
08-01-2019
hostname R2911!boot-start-markerboot system flash
c2900-universalk9-mz.SPA.154-3.M.binboot-end-marke...
Created by
lars.arler
in Routing
08-01-2019
08-01-2019
Hi again and thanks in advanceI just vent from static firewall to Zone
Based Firewall as sugested in...
07-21-2019
Hi - and thanks for taking your time to help ;-)I tried to use your
command - crypto isakmp aggressi...
Created by
lars.arler
in Routing
07-21-2019
07-21-2019
Hi All and thanks for any clues or solutions. First Issue My VPN setup
seems to work ( Connects fine...
Created by
lars.arler
in Routing
07-11-2019
07-11-2019
Tanks a lot Seb ;-) It was the IP NAT INSIDE to the VIRTUAL-TEMPLATE 1
TYPE TUNNEL there was missing
Public Statistics
| Date Registered | 03-26-2007 09:10 AM |
| Date Last Visited | 09-04-2019 01:41 AM |
| Total Messages Posted | 18 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 5 | |
| 10 | |
| 5 |
.jpg "Hall of Fame Expert"){kind=icon}
.jpg "VIP Mentor"){kind=icon}
