Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Y. 'FoAmY' Vandenbossche
05-15-2019
Stats
Member since
02-13-2018
22
Posts
0
Helpful
2
Solutions
Created by
Y. 'FoAmY' Vandenbossche
in Other Security Subjects
in Other Security Subjects
05-09-2019
04:03 AM
05-09-2019
04:03 AM
Hi Philip, Thanks for the advice, I'll definitely research DMVPN for future consideration! Thanks!
... View more
Created by
Y. 'FoAmY' Vandenbossche
in Other Security Subjects
in Other Security Subjects
05-09-2019
04:02 AM
05-09-2019
04:02 AM
Okay, similar to what I was thinking, thanks for the response!
... View more
Created by
Y. 'FoAmY' Vandenbossche
in Other Security Subjects
in Other Security Subjects
05-09-2019
03:25 AM
05-09-2019
03:25 AM
Hi Seb, Thanks for the reply, I figured there'd be a way to do this with a single crypto map... Would you be able to provide a quick / simple example for how to configure "A single crypto map with multiple sequences / peers defined", is it done in a similar way to an ACL with multiple permit / denies? Thanks, Yanni
... View more
Created by
Y. 'FoAmY' Vandenbossche
in Other Security Subjects
in Other Security Subjects
05-09-2019
03:10 AM
05-09-2019
03:10 AM
Hi Guys, So I'm working on a proof concept in PT and learning a lot on the way! I just have a question regarding site-site VPNs, Is it at all possible to have a router at the HQ configured with multiple tunnels to various branches? (see image) I know that the image depicts the branches being connected to the HQ on separate IP interfaces, but obviously in the real-world it would all be happening over a single interface on the HQ site, the internet connection of course. The problem is I know there is a limit of a single crypto map on a single interface... Any ideas? Thanks in advance for any advice! Topology example
... View more
Labels:
Created by
Y. 'FoAmY' Vandenbossche
in Other Security Subjects
in Other Security Subjects
05-08-2019
10:58 AM
05-08-2019
10:58 AM
Oh lord, Thanks! That was exactly it, traffic was getting NAT'ed before getting encrypted... Thanks for the advice!
... View more
Created by
Y. 'FoAmY' Vandenbossche
in Other Security Subjects
in Other Security Subjects
05-08-2019
12:26 AM
05-08-2019
12:26 AM
Hi, Below is a screenshot of the topology, I'm only using private IP addresses on the 'ISP' side of things as this was a topology that I had already used for another test last year, and I couldn't be bothered to change them, and I don't think that would make much difference for just a proof of concept in a PT session... As for the config on the HQ side, it is the same as that of the branch, except for the obvious differences, such as IP addresses, host name, etc... Also, the branch can get a web page from a web server on the HQ side with the configured dynamic NAT, so I know that both sites have inter-connectivity... Thanks,
... View more
Created by
Y. 'FoAmY' Vandenbossche
in Other Security Subjects
in Other Security Subjects
05-07-2019
01:44 PM
05-07-2019
01:44 PM
Okay, I've been going F*****G crazy trying to figure this out... What am I missing?! I'm attempting to get a site-site VPN setup in PT as a test before rolling out in prod, no matter what I do I can't seem to get it working... The branch router is configured as below, but for some reason the VPN tunnel fails. Upon closer inspection, it looks like traffic from 192.168.1.0/24 destined for 192.168.0.0/24 isn't getting encrypted at all and is being sent to 10.0.0.6 unchanged and as 10.0.0.6 is 'The internet' it's no surprise the packets are being killed... Thanks in advance for any help / advice! crypto isakmp policy 1
authentication pre-share
crypto isakmp key cisco123 address 10.0.0.1
crypto ipsec transform-set CRYPTOSET esp-aes esp-sha-hmac
crypto map CRYPTOMAP 1 ipsec-isakmp
set peer 10.0.0.1
set transform-set CRYPTOSET
match address vpnacl
interface GigabitEthernet0/0
ip address 10.0.0.5 255.255.255.252
duplex auto
speed auto
crypto map CRYPTOMAP
interface GigabitEthernet0/1
ip address 192.168.1.254 255.255.255.0
duplex auto
speed auto
ip default-gateway 10.0.0.6
ip route 0.0.0.0 0.0.0.0 10.0.0.6
ip access-list extended vpnacl
permit ip 192.168.1.0 0.0.0.255 192.168.0.0 0.0.0.255
... View more
Labels:
Created by
Y. 'FoAmY' Vandenbossche
in Routing
in Routing
04-26-2019
01:40 PM
04-26-2019
01:40 PM
Indeed this fixes it, I guess I'll come up with another port to use! Thanks for your help everyone!
... View more
Created by
Y. 'FoAmY' Vandenbossche
in Routing
in Routing
04-26-2019
09:24 AM
04-26-2019
09:24 AM
Tried that already, just tried again... No dice :(
... View more
Created by
Y. 'FoAmY' Vandenbossche
in Routing
in Routing
04-26-2019
09:21 AM
04-26-2019
09:21 AM
from the rtr if you telnet to 192.168.10.202 80 source gig0/0.10 - do you get connection? : yes, connects fine... From outside telnet again to your public IP address on port 8880 : no connection, times out :( VDB-R1# sh ip nat trans
tcp xxx.xxx.xxx.xxx:8880 192.168.10.202:80 --- ---
... View more
Created by
Y. 'FoAmY' Vandenbossche
in Routing
in Routing
04-26-2019
08:56 AM
04-26-2019
08:56 AM
Hi Jaderson, Yes, it is. :)
... View more
Created by
Y. 'FoAmY' Vandenbossche
in Routing
in Routing
04-26-2019
08:17 AM
04-26-2019
08:17 AM
Hi guys, I'm having some issues with port forwarding on my 1921 ISR, it was all working fine about a week ago... Then overnight (isr restarted due to power failure) it stopped working... I've gone over my config again, and again... Checked IP addresses, firewalls and tested connecting from the LAN and all works as expected. 'I just can't seem to connect from the outside -> in :( controller VDSL 0/0/0
!
interface GigabitEthernet0/0
no ip address
duplex auto
speed auto
!
interface GigabitEthernet0/0.10
encapsulation dot1Q 10
ip address 192.168.10.254 255.255.255.0
ip nat inside
ip virtual-reassembly in
no cdp enable
!
interface ATM0/0/0
no ip address
shutdown
no atm ilmi-keepalive
!
interface Ethernet0/0/0
mac-address 7050.afb7.c5da
no ip address
ip nat outside
ip virtual-reassembly in
!
interface Ethernet0/0/0.101
encapsulation dot1Q 101
ip dhcp client request classless-static-route
ip dhcp client client-id hex ************************************
ip dhcp client hostname ************@*****|********
ip address dhcp
no ip redirects
no ip proxy-arp
ip nat outside
ip virtual-reassembly in
!
ip route 0.0.0.0 0.0.0.0 dhcp
!
ip nat inside source list 100 interface Ethernet0/0/0.101 overload
access-list 100 permit ip 192.168.10.0 0.0.0.255 any
!
ip nat inside source static tcp 192.168.10.202 80 interface Ethernet0/0/0.101 8880 Thanks in advance for any help!
... View more
Labels:
Created by
Y. 'FoAmY' Vandenbossche
in Routing
in Routing
04-24-2019
05:34 AM
04-24-2019
05:34 AM
Hey Georg, I've tested 'ip route 0.0.0.0 0.0.0.0 dhcp' and that seems to work just fine, however I'm also using 'ip nat inside source static tcp 192.168.10.202 80 interface Ethernet0/0/0.101 8080' This worked fine before I change the static route but now I can't access the web server from the outside :/ Any ideas as to what might be causing this? -Yanni
... View more
Created by
Y. 'FoAmY' Vandenbossche
in Routing
in Routing
04-23-2019
08:59 AM
04-23-2019
08:59 AM
Thanks Georg, I'll give that a try when I get home later! And my ISP is Now TV, just a re-brand of Sky Broadband in the UK.
... View more
Created by
Y. 'FoAmY' Vandenbossche
in Routing
in Routing
04-23-2019
05:35 AM
04-23-2019
05:35 AM
Hi, I managed to get it working using a sample config, from someone who did the same, as inspiration! The config applied, shown below, is working just fine now. But out of curiosity it seems to use the IP address of the next hop for gateway of last resort and default gateway... If I try to remove that and do 'no ip default gateway' and then use the interface for gateway of last resort it doesn't work. The WAN IP is in a /22 subnet and this seems change every week or so, and of course the gateway IP keeps changing after a reboot meaning I have to manually reconfigure my static route. Is there a way to do this automatically? controller VDSL 0/0/0 interface GigabitEthernet0/0 no ip address duplex auto speed auto interface GigabitEthernet0/0.10 encapsulation dot1Q 10 ip address 192.168.10.254 255.255.255.0 ip flow ingress ip flow egress ip nat inside ip virtual-reassembly in no cdp enable interface ATM0/0/0 no ip address shutdown no atm ilmi-keepalive interface Ethernet0/0/0 mac-address 7050.afb7.c5da no ip address ip nat outside ip virtual-reassembly in interface Ethernet0/0/0.101 encapsulation dot1Q 101 ip dhcp client request classless-static-route ip dhcp client client-id hex ************************************ ip dhcp client hostname ******************|******** ip address dhcp no ip redirects no ip proxy-arp ip flow ingress ip flow egress ip nat outside ip virtual-reassembly in ip route 0.0.0.0 0.0.0.0 94.11.162.36 ip nat inside source list 100 interface Ethernet0/0/0.101 overload access-list 100 permit ip 192.168.10.0 0.0.0.255 any
... View more
Events Y. 'FoAmY' Vandenbossche has Participated In
- Latest Contributions by Y. 'FoAmY' Vandenbossche
- Discussions Y. 'FoAmY' Vandenbossche has Participated In
- TKBs Y. 'FoAmY' Vandenbossche has Participated In
- Blogs Y. 'FoAmY' Vandenbossche has Participated In
- Events Y. 'FoAmY' Vandenbossche has Participated In
- Videos Y. 'FoAmY' Vandenbossche has Participated In
You Have No Messages
Public Statistics
| Date Registered | 02-13-2018 10:31 AM |
| Date Last Visited | 05-15-2019 05:20 AM |
| Total Messages Posted | 22 |
.jpg "VIP Advocate"){kind=icon}
