Is it possible to router traffic to a VPN based on VLAN and have all other VLANs go stright to internet over normal route? ... View more

I have an EZVPN client config on my 2821 that I would only like to give access to a few host of my LAN. The remaing hosts should all use the default route. Is this possible with Split-tunneling, everything Ive read so far says it can only be done on a sub-net basis? If not is there another way to achieve this? ... View more

Can someone please help me with my config for Easy VPN Client split tunneling. At the moment when the VPN is up I have NO access to the Internet from any host. Here's what I am attempting to do. I want only certain host to route all there traffic thou the tunnel and the remaining host to use the default route. I created an object-group and access list with the hosts I want to route thou the VPN :- object-group network VNPCLIENTS description HOSTS ALLOWED ACCESS TO THE VPN host 192.168.3.204 host 192.168.3.42 host 192.168.3.44 host 192.168.3.202 host 192.168.3.43 access-list 1 remark Internet access list access-list 1 permit 192.168.3.0 0.0.0.255 access-list 101 remark Hosts allowed access to VPN access-list 101 permit ip object-group VNPCLIENTS any access-list 111 permit udp any any eq 3074 access-list 111 permit tcp any any eq 3074 access-list 111 permit udp any any eq 88 I Then applied the access list to the Virtual interface of the VPN in both directions:- interface Virtual-Template1 type tunnel no ip address ip access-group 101 in ip access-group 101 out tunnel mode ipsec ipv4 Now when I connect to the VPN I have no access from any host to the Internet either thought the tunnel or not. I must be doing something very wrong. Much appreciate any help. Thanks Gordon ... View more

Hi there, I am having an issue where external incoming calls can not hear me although I can hear them. I think it could be a routing issue linked to Bridge group and int BVI1 but im not sure : ( . I tried " h323-gateway voip bind srcaddr 192.168.3.100  " on  the int BVI1 but didn't help. Appreciate if someone with more knowledge could take a look at my config to see if its anything obvious, ie do  I need an incoming dial peer? version 15.1 service timestamps debug datetime msec service timestamps log datetime msec service password-encryption ! hostname CME3.100 ! boot-start-marker boot system flash c2800nm-adventerprisek9-mz.151-4.M3.bin boot-end-marker ! ! logging buffered 51200 warnings enable secret 5 $xxxxxxxxxx ! aaa new-model ! ! aaa authentication login default local aaa authentication login ciscocp_vpn_xauth_ml_1 local aaa authorization exec default local aaa authorization network ciscocp_vpn_group_ml_1 local ! ! ! ! ! aaa session-id common ! clock timezone CET 2 0 ! dot11 syslog ip source-route ! ! ip cef ! no ip dhcp use vrf connected ip dhcp binding cleanup interval 10 ip dhcp excluded-address 192.168.3.1 192.168.3.180 ! ip dhcp pool PHONES network 192.168.3.0 255.255.255.0 default-router 192.168.3.100 option 150 ip 192.168.3.100 dns-server 8.8.8.8 ! ip dhcp pool STATIC host 192.168.3.201 255.255.255.0 client-identifier 01c4.8508.6c95.a3 ip dhcp pool xxxx host 192.168.3.204 255.255.255.0 client-identifier 0100.25ae.2762.f4 ! ! ip dhcp update dns ip name-server 8.8.8.8 no ipv6 cef ! multilink bundle-name authenticated ! ! ! ! ! ! ! voice service voip no ip address trusted authenticate allow-connections h323 to h323 allow-connections h323 to sip allow-connections sip to h323 allow-connections sip to sip supplementary-service h450.12 sip   bind control source-interface BVI1   bind media source-interface BVI1   registrar server ! voice class codec 1 codec preference 1 g711alaw codec preference 2 g711ulaw codec preference 3 g729r8 ! ! voice register global mode cme source-address 192.168.3.100 port 5060 max-dn 8 max-pool 8 authenticate register tftp-path flash: file text create profile sync 0016587035046141 ! voice register dn  1 number 8001 name Gordon label Gordon iPhone5 8001 ! voice register dn  2 number 8002 name Jay label Jay iPhone3 8002 ! voice register pool  1 registration-timer max 720 min 660 id mac 04F7.E4C3.63D1 session-transport tcp type CiscoMobile-iOS number 1 dn 1 username gordon password xxxxxxx ! v ! voice hunt-group 1 parallel list 8001,1001,1002 pilot 0xxxxxxxx ! ! voice hunt-group 2 parallel list 1001,1002,8001 pilot 0xxxxxxxx ! ! voice hunt-group 3 parallel list 8001,1001,1002 pilot +4xxxx ! ! ! ! ! voice-card 0 ! crypto pki token default removal timeout 0 ! crypto pki trustpoint TP-self-signed-4147047992 enrollment selfsigned subject-name cn=IOS-Self-Signed-Certificate-4147047992 revocation-check none rsakeypair TP-self-signed-4147047992 ! ! crypto pki certificate chain TP-self-signed-4147047992 certificate self-signed 02   3082022B 30820194 A0030201 02020102 300D0609 2A864886 F70D0101 05050030   31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274   69666963 6174652D 34313437 30343739 3932301E 170D3133 30393033 30373431   34355A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649   4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D34 31343730   34373939 3230819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281   8100C175 C1C08CB5 1225EB0D 03CC3C69 11FE820D C5BE94F9 2393D9C7 BBAFA729   B419A199 491D022F DD865CAD 2AD60910 CB316ED7 65456A91 94C1E2D2 5EEDDF35   3A95F8A6 B4B5A1E9 7675AE9E CF38102B 3805FE5B 7403F9D2 36692F75 EF23B6E3   0A0514BF 427860A9 CF6B97E8 BBC5D5D5 DFD5ECDF 38B70863 D6F197B5 70806CA5   3A5F0203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603   551D2304 18301680 145B297C 689A98F7 5087FE67 24E6C680 56DF2AD7 80301D06   03551D0E 04160414 5B297C68 9A98F750 87FE6724 E6C68056 DF2AD780 300D0609   2A864886 F70D0101 05050003 818100A1 4A251FE8 C77AF672 7C3C04A7 69D6D20A   779B577D 349C25DB 668AD407 D222D143 27AF85A6 33A9BC4B EBAD93A4 80278EB0   A60284E6 9800C7C8 63E6BAEC E32BCC56 CEE30C84 EDBF04C2 25E33382 D91C3266   3B5880AD 3D2E4F47 56A01242 37C0806F 25F574CA 02F4721E 4FBFE135 D94B8C3B   F0EDAF11 C9792CE7 09814BE8 E62099         quit ! ! license udi pid CISCO2821 sn FCZ114971YA archive log config   hidekeys username gkonheiser privilege 15 secret 5 $1xxxxxxxxxxxxxxxxxxxxxxxx username administrator privilege 15 secret 5 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx username Jay secret 5 xxxxxxxxxxxxxxxxxxxxxxxx1 ! redundancy ! ! no ip ftp passive ip ssh port 2001 rotary 1 10 ip ssh version 2 ! class-map match-all priority match protocol skype ! ! policy-map outbound class priority   priority 2000 ! ! crypto logging session crypto logging ezvpn crypto ctcp port 10000 ! crypto isakmp policy 1 encr aes authentication pre-share group 2 crypto isakmp client configuration address-pool local SDM_POOL_1 ! ! crypto ipsec transform-set ESP-3DES-SHA esp-aes esp-sha-hmac ! crypto ipsec profile Test set transform-set ESP-3DES-SHA ! ! crypto ipsec client ezvpn CISCOCP_EZVPN_CLIENT_1 connect manual group astrill key way2stars mode client peer UK1.ASTRILL.NET virtual-interface 1 username gkonheiser@hijinxx.com password 9729209 xauth userid mode local ! bridge irb ! ! ! ! ! interface GigabitEthernet0/0 description WAN ip address xxxxxxxxxxxxxx ip flow ingress ip nat outside ip virtual-reassembly in duplex full speed 100 crypto ipsec client ezvpn CISCOCP_EZVPN_CLIENT_1 service-policy output outbound ! interface GigabitEthernet0/1 description LAN no ip address ip nat inside ip virtual-reassembly in duplex full speed 100 bridge-group 1 ! interface FastEthernet0/0/0 no ip address ! interface FastEthernet0/0/1 no ip address ! interface FastEthernet0/0/2 no ip address ! interface FastEthernet0/0/3 no ip address ! interface Virtual-Template1 type tunnel no ip address tunnel mode ipsec ipv4 ! interface Vlan1 no ip address bridge-group 1 ! interface BVI1 ip address 192.168.3.100 255.255.255.0 ip nat inside ip virtual-reassembly in crypto ipsec client ezvpn CISCOCP_EZVPN_CLIENT_1 inside h323-gateway voip bind srcaddr 192.168.3.100 ! ip local pool SDM_POOL_1 192.168.3.230 192.168.3.235 ip forward-protocol nd ip http server ip http authentication local ip http secure-server ip http timeout-policy idle 60 life 86400 requests 10000 ! ! ip dns server ip nat inside source list 1 interface GigabitEthernet0/0 overload ip nat inside source static udp 192.168.3.244 25565 interface GigabitEthernet0/0 25565 ip nat inside source static tcp 192.168.3.244 25565 interface GigabitEthernet0/0 25565 ip nat inside source static tcp 192.168.3.43 3389 interface GigabitEthernet0/0 26999 ip nat inside source static tcp 192.168.3.6 14565 interface GigabitEthernet0/0 14565 ip nat inside source static tcp 192.168.3.111 11767 interface GigabitEthernet0/0 11767 ip nat inside source static tcp 192.168.3.3 3389 interface GigabitEthernet0/0 27000 ip nat inside source static tcp 192.168.3.4 26252 interface GigabitEthernet0/0 26252 ip nat inside source static tcp 192.168.3.6 3389 interface GigabitEthernet0/0 23389 ip nat inside source static tcp 192.168.3.204 53 interface GigabitEthernet0/0 53 ip nat inside source static udp 192.168.3.204 53 interface GigabitEthernet0/0 53 ip nat inside source static tcp 192.168.3.204 80 interface GigabitEthernet0/0 80 ip nat inside source static tcp 192.168.3.204 3074 interface GigabitEthernet0/0 3074 ip nat inside source static udp 192.168.3.204 3074 interface GigabitEthernet0/0 3074 ip nat inside source static tcp 192.168.3.202 53 interface GigabitEthernet0/0 54 ip nat inside source static udp 192.168.3.202 53 interface GigabitEthernet0/0 54 ip nat inside source static tcp 192.168.3.202 80 interface GigabitEthernet0/0 81 ip nat inside source static tcp 192.168.3.202 3074 interface GigabitEthernet0/0 3075 ip nat inside source static udp 192.168.3.202 3074 interface GigabitEthernet0/0 3075 ip route 0.0.0.0 0.0.0.0 93.83.171.9 2 ! access-list 1 remark Internet access list access-list 1 permit 192.168.3.0 0.0.0.255 access-list 111 permit udp any any eq 3074 access-list 111 permit tcp any any eq 3074 access-list 111 permit udp any any eq 88 ! ! ! ! ! tftp-server flash:phone/7906-7911/SCCP11.8-3-3S.loads alias SCCP11.8-3-3S.loads tftp-server flash:phone/7906-7911/apps11.8-3-2-27.sbn alias apps11.8-3-2-27.sbn tftp-server flash:phone/7906-7911/cnu11.8-3-2-27.sbn alias cnu11.8-3-2-27.sbn tftp-server flash:phone/7906-7911/cvm11sccp.8-3-2-27.sbn alias cvm11sccp.8-3-2-27.sbn tftp-server flash:phone/7906-7911/dsp11.8-3-2-27.sbn alias dsp11.8-3-2-27.sbn tftp-server flash:phone/7906-7911/jar11sccp.8-3-2-27.sbn alias jar11sccp.8-3-2-27.sbn tftp-server flash:phone/7906-7911/term06.default.loads alias term06.default.loads tftp-server flash:phone/7906-7911/term11.default.loads alias term11.default.loads tftp-server flash:phone/7937/apps37sccp.1-1-1-1.bin alias apps37sccp.1-1-1-1.bin tftp-server flash:flash/apps37sccp.1-2-1-0.bin alias apps37sccp.1-2-1-0.bin tftp-server flash:phone/7921/CP7921G-1.4.5.3.loads alias CP7921G-1.4.5.3.loads tftp-server flash:phone/7921/APPS-1.4.5.3.SBN alias APPS-1.4.5.3.SBN tftp-server flash:phone/7921/GUI-1.4.5.3.SBN alias GUI-1.4.5.3.SBN tftp-server flash:phone/7921/SYS-1.4.5.3.SBN alias SYS-1.4.5.3.SBN tftp-server flash:phone/7921/TNUX-1.4.5.3.SBN alias TNUX-1.4.5.3.SBN tftp-server flash:phone/7921/TNUXR-1.4.5.3.SBN alias TNUXR-1.4.5.3.SBN tftp-server flash:phone/7921/WLAN-1.4.5.3.SBN alias WLAN-1.4.5.3.SBN ! ! ! control-plane ! bridge 1 protocol ieee bridge 1 route ip ! ! mgcp fax t38 ecm ! mgcp profile default ! ! dial-peer voice 44 voip description UK CALLS WITH 0044 destination-pattern 0044.......... session protocol sipv2 session target dns:sipgate.co.uk voice-class codec 1 dtmf-relay rtp-nte ip qos dscp cs5 media clid network-number 17xxxxxx no vad ! dial-peer voice 49 voip description GERMANY CALLS WITH 0049 destination-pattern 0049......... session protocol sipv2 session target dns:sipgate.co.uk voice-class codec 1 dtmf-relay sip-notify rtp-nte ip qos dscp cs5 media clid network-number 17xxxxxxx no vad ! dial-peer voice 43 voip description AT CALLS WITH 0043 destination-pattern 0043.......... session protocol sipv2 session target dns:sipgate.co.uk voice-class codec 1 dtmf-relay rtp-nte ip qos dscp cs5 media clid network-number 179xxxxx no vad ! dial-peer voice 1 voip session target ipv4:192.168.3.100 incoming called-number 0044xxxxxxxxx voice-class codec 1 no vad ! ! sip-ua authentication username 1799999 password 7 xxxxxxxxxxxxxxxxxxxxxx realm sipgate.de authentication username 1799999 password 7 xxxxxxxxxxxxxxxxxxx realm sipgate.co.uk no remote-party-id set pstn-cause 6 sip-status 503 set pstn-cause 18 sip-status 408 set pstn-cause 27 sip-status 502 set pstn-cause 31 sip-status 480 set pstn-cause 44 sip-status 503 set pstn-cause 58 sip-status 503 set pstn-cause 88 sip-status 503 set pstn-cause 95 sip-status 503 set pstn-cause 102 sip-status 504 set pstn-cause 111 sip-status 500 retry invite 4 retry response 3 retry bye 2 retry cancel 2 retry register 10 timers trying 1000 timers connect 100 timers register 250 registrar 1 dns:sipgate.co.uk expires 3600 registrar 2 dns:sipgate.de expires 3600 sip-server dns:sipgate.co.uk:5050 ! ! ! telephony-service em logout 0:0 0:0 0:0 max-ephones 58 max-dn 192 ip source-address 192.168.3.100 port 2000 service phone displayIdleTimeout 00:30 service phone displayOnDuration 1:00 timeouts interdigit 8 timeouts ringing 20 system message Hijinxx cnf-file location flash: cnf-file perphone network-locale GB network-locale 1 GB network-locale 2 GB network-locale 3 GB network-locale 4 GB load 7906 SCCP11.8-3-3S.loads load 7911 SCCP11.8-3-3S.loads load 7921 flash/CP7921G-1.4.5.3.LOADS load 7937 apps37sccp.1-1-1-1.bin time-zone 23 time-format 24 date-format dd-mm-yy max-conferences 8 gain -6 web admin system name gkonheiser secret 5 $1 transfer-system full-consult directory entry 1  directory entry 2  create cnf-files version-stamp Jan 01 2002 00:00:00 ! ! ephone-dn  1  dual-line number 1001 ! ! ephone-dn  2  dual-line number 1002 ! ! ephone-dn  10 number +44845xxxxxxxx Secondary 1796xxx ! ! ephone-dn  11  dual-line number +49524xxxxxxx secondary 1799xxx ! ! ephone  1 no multicast-moh device-security-mode none mac-address 001F.9E8B.A45F max-calls-per-button 4 username "gordon" password type 7921 button  1:10 2:11 3:1 4:2 ! ! ! ephone  2 device-security-mode none mac-address 0022.90FD.5EEE max-calls-per-button 4 type 7921 button  1:10 2:11 3:1 4:2 ! ! ! ! line con 0 password 7 line aux 0 line vty 0 session-timeout 360 exec-timeout 360 0 password 7 logging synchronous transport preferred telnet transport input telnet ssh line vty 1 4 session-timeout 360 exec-timeout 360 0 password 7 logging synchronous transport preferred ssh transport input telnet ssh line vty 5 988 exec-timeout 30 0 logging synchronous transport input telnet ssh ! scheduler allocate 20000 1000 ntp update-calendar ntp server 129.6.15.28 end Hope I havent left anything sensitive in. Thanks ... View more