Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About petterstergren
Stats
Member since
11-06-2019
9
Posts
0
Helpful
0
Solutions
Created by
petterstergren
in Routing
in Routing
11-11-2019
03:28 AM
11-11-2019
03:28 AM
Hi, By removing these lines I seem to also lose my EIGRP exchange over the two sites? How am I supposed to exchange the EIGRP information over the tunnel without these lines?
... View more
Created by
petterstergren
in Routing
in Routing
11-08-2019
03:31 PM
11-08-2019
03:31 PM
Hi, Could someone help me to understand where it goes wrong with my ping from Local Net to Public? The IPs are beeing transformed via NAT but it won't come back in so I guess there's an issue with my ACLs. I recently set up IPSec so did a few changes to my ACLs. From what I read it could be that I should use a ```route-map nonat``` but that command doesn't seem to exist in PT !HQ-IntEdge
!
crypto isakmp policy 1
encr aes
authentication pre-share
group 5
!
crypto isakmp key petter address 209.165.202.2
!
!
!
crypto ipsec transform-set HQ-STHLM esp-aes esp-sha-hmac
!
crypto map HQ-STHLM_MAP 10 ipsec-isakmp
set peer 209.165.202.2
set pfs group5
set security-association lifetime seconds 900
set transform-set HQ-STHLM
match address 101
!
!
interface Tunnel0
ip address 172.16.36.33 255.255.255.224
mtu 1476
tunnel source GigabitEthernet0/0
tunnel destination 209.165.202.2
!
interface GigabitEthernet0/0
ip address 209.165.201.2 255.255.255.0
ip access-group INBOUND in
ip nat outside
duplex auto
speed auto
crypto map HQ-STHLM_MAP
!
ip nat inside source list NAT_ACL interface GigabitEthernet0/0 overload
ip nat inside source static 172.16.36.29 209.165.201.3
ip nat inside source static tcp 172.16.36.28 80 209.209.201.2 80
!
ip access-list extended INBOUND
permit ip 172.16.8.0 0.0.3.255 172.16.0.0 0.0.3.255
permit icmp host 209.165.202.2 host 209.165.201.2
permit udp host 209.165.202.2 host 209.165.201.2 eq isakmp
permit esp host 209.165.202.2 host 209.165.201.2
permit ahp host 209.165.202.2 host 209.165.201.2
deny ip any any
access-list 101 permit ip 172.16.0.0 0.0.3.255 172.16.8.0 0.0.3.255
access-list 101 permit ip any any
access-list 101 permit gre 172.16.0.0 0.0.3.255 172.16.8.0 0.0.3.255
ip access-list extended NAT_ACL
deny ip 172.16.0.0 0.0.3.255 172.16.8.0 0.0.3.255
permit ip 172.16.0.0 0.0.3.255 any
!
!STHLM-IntEdge
!
crypto isakmp policy 1
encr aes
authentication pre-share
group 5
!
crypto isakmp key petter address 209.165.201.1
crypto isakmp key petter address 209.165.201.2
!
crypto ipsec transform-set HQ-STHLM esp-aes esp-sha-hmac
!
crypto map HQ-STHLM_MAP 10 ipsec-isakmp
set peer 209.165.201.2
set pfs group5
set security-association lifetime seconds 900
set transform-set HQ-STHLM
match address 102
!
interface Tunnel0
ip address 172.16.36.34 255.255.255.224
mtu 1476
tunnel source GigabitEthernet0/0/0
tunnel destination 209.165.201.2
!
interface GigabitEthernet0/0/0
ip address 209.165.202.2 255.255.255.0
ip access-group INBOUND in
crypto map HQ-STHLM_MAP
!
ip nat inside source list NAT_ACL interface GigabitEthernet0/0/0 overload
!
ip access-list extended INBOUND
permit ip 172.16.0.0 0.0.3.255 172.16.8.0 0.0.3.255
permit icmp host 209.165.201.2 host 209.165.202.2
permit udp host 209.165.201.2 host 209.165.202.2 eq isakmp
permit esp host 209.165.201.2 host 209.165.202.2
permit ahp host 209.165.201.2 host 209.165.202.2
deny ip any any
access-list 102 permit ip 172.16.8.0 0.0.3.255 172.16.0.0 0.0.3.255
access-list 102 permit ip any any
access-list 102 permit gre 172.16.8.0 0.0.3.255 172.16.0.0 0.0.3.255
ip access-list extended NAT_ACL
remark ****** NAT ACL ******
deny ip 172.16.8.0 0.0.3.255 172.16.0.0 0.0.3.255
permit ip 172.16.8.0 0.0.3.255 any
!
... View more
Labels:
Created by
petterstergren
in Routing
in Routing
11-08-2019
08:50 AM
11-08-2019
08:50 AM
Haha your back, Georg you have done it again! Once again thank you, for sorting out yet another problem!
... View more
Created by
petterstergren
in Routing
in Routing
11-08-2019
06:48 AM
11-08-2019
06:48 AM
The Packet tracer file for the project
... View more
Created by
petterstergren
in Routing
in Routing
11-08-2019
06:47 AM
11-08-2019
06:47 AM
Hello, Should I include some sort of default path in EIGRP or something? Im able to ping inside my network, however when trying to ping an IP address outside of my network, one of my core switches is returning a "Destination host unreachable." !
version 15.1
!
hostname Oslo-IntEdge
!
!
license udi pid CISCO2911/K9 sn FTX1524SQCT-
!
spanning-tree mode pvst
!
interface GigabitEthernet0/0
ip address dhcp
ip nat outside
duplex auto
speed auto
!
interface GigabitEthernet0/1
no ip address
ip nat inside
duplex auto
speed auto
!
interface GigabitEthernet0/1.10
encapsulation dot1Q 10
ip address 172.16.2.155 255.255.255.224
ip nat inside
!
interface GigabitEthernet0/1.20
encapsulation dot1Q 20
ip address 172.16.2.122 255.255.255.128
ip nat inside
!
interface GigabitEthernet0/1.30
encapsulation dot1Q 30
ip address 172.16.2.186 255.255.255.224
ip nat inside
!
interface GigabitEthernet0/1.40
encapsulation dot1Q 40
ip address 172.16.1.250 255.255.255.224
ip nat inside
!
interface GigabitEthernet0/1.100
encapsulation dot1Q 100
ip address 172.16.2.194 255.255.255.248
ip nat inside
!
interface GigabitEthernet0/2
description DMZ
ip address 172.16.36.30 255.255.255.224
ip nat inside
duplex auto
speed auto
!
interface Vlan1
no ip address
shutdown
!
router eigrp 10
network 172.16.0.0 0.0.3.255
!
ip nat inside source list 1 interface GigabitEthernet0/0 overload
ip nat inside source static 172.16.36.29 209.165.201.10
ip nat inside source static tcp 172.16.36.28 80 209.209.201.11 80
ip classless
!
ip flow-export version 9
!
!
access-list 1 permit 172.16.0.0 0.0.3.255
!
!
version 16.3.2
!
hostname Core2
!
ip routing
!
vtp domain HQ
vtp mode transparent
!
spanning-tree mode pvst
spanning-tree vlan 1,10,30 priority 0
spanning-tree vlan 20,40,100 priority 4096
!
vlan 10
name MGTM
!
vlan 20
name IT
!
vlan 30
name EMPLOYEE
!
vlan 40
name GUEST
!
vlan 99
name BLACKHOLE
!
vlan 100
name SERVER
!
interface Port-channel1
switchport trunk native vlan 99
switchport trunk allowed vlan 10,20,30,40,100
switchport trunk encapsulation dot1q
switchport mode trunk
spanning-tree link-type point-to-point
!
interface GigabitEthernet1/0/1
switchport trunk native vlan 99
switchport trunk allowed vlan 10,20,30,40,100
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet1/0/2
switchport trunk native vlan 99
switchport trunk allowed vlan 10,20,30,40,100
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet1/0/22
switchport trunk native vlan 99
switchport trunk allowed vlan 10,20,30,40,100
switchport trunk encapsulation dot1q
switchport mode trunk
switchport nonegotiate
!
interface GigabitEthernet1/0/23
switchport trunk native vlan 99
switchport trunk allowed vlan 10,20,30,40,100
switchport trunk encapsulation dot1q
switchport mode trunk
channel-group 1 mode active
spanning-tree link-type point-to-point
!
interface GigabitEthernet1/0/24
switchport trunk native vlan 99
switchport trunk allowed vlan 10,20,30,40,100
switchport trunk encapsulation dot1q
switchport mode trunk
channel-group 1 mode active
spanning-tree link-type point-to-point
!
interface Vlan1
no ip address
shutdown
!
interface Vlan10
mac-address 00e0.f94c.5801
ip address 172.16.2.157 255.255.255.224
standby 1 ip 172.16.2.158
!
interface Vlan20
mac-address 00e0.f94c.5802
ip address 172.16.2.124 255.255.255.128
standby 1 ip 172.16.2.126
!
interface Vlan30
mac-address 00e0.f94c.5803
ip address 172.16.2.188 255.255.255.224
standby 1 ip 172.16.2.190
!
interface Vlan40
mac-address 00e0.f94c.5804
ip address 172.16.1.252 255.255.254.0
standby 1 ip 172.16.1.254
!
interface Vlan100
mac-address 00e0.f94c.5805
ip address 172.16.2.196 255.255.255.248
standby 1 ip 172.16.2.198
!
router eigrp 10
network 172.16.0.0 0.0.3.255
no auto-summary
!
ip default-gateway 172.16.2.122
ip classless
!
ip flow-export version 9
!
!
version 16.3.2
!
hostname Core1
!
no ip cef
ip routing
!
vtp domain HQ
vtp mode transparent
!
spanning-tree mode pvst
spanning-tree vlan 20,40,100 priority 0
spanning-tree vlan 1,10,30 priority 4096
!
vlan 10
name MGMT
!
vlan 20
name IT
!
vlan 30
name EMPLOYEE
!
vlan 40
name GUEST
!
vlan 99
name BLACKHOLE
!
vlan 100
name SERVER
!
interface Port-channel1
switchport trunk native vlan 99
switchport trunk allowed vlan 10,20,30,40,100
switchport trunk encapsulation dot1q
switchport mode trunk
spanning-tree link-type point-to-point
!
interface GigabitEthernet1/0/1
switchport trunk native vlan 99
switchport trunk allowed vlan 10,20,30,40,100
switchport trunk encapsulation dot1q
switchport mode trunk
switchport nonegotiate
!
interface GigabitEthernet1/0/2
switchport trunk native vlan 99
switchport trunk allowed vlan 10,20,30,40,100
switchport trunk encapsulation dot1q
switchport mode trunk
switchport nonegotiate
!
interface GigabitEthernet1/0/20
switchport access vlan 100
switchport mode access
switchport nonegotiate
!
interface GigabitEthernet1/0/23
switchport trunk native vlan 99
switchport trunk allowed vlan 10,20,30,40,100
switchport trunk encapsulation dot1q
switchport mode trunk
channel-group 1 mode active
spanning-tree link-type point-to-point
!
interface GigabitEthernet1/0/24
switchport trunk native vlan 99
switchport trunk allowed vlan 10,20,30,40,100
switchport trunk encapsulation dot1q
switchport mode trunk
channel-group 1 mode active
spanning-tree link-type point-to-point
!
interface Vlan1
no ip address
standby 1 preempt
shutdown
!
interface Vlan10
mac-address 00d0.9736.ec01
ip address 172.16.2.156 255.255.255.224
standby 1 ip 172.16.2.158
standby 1 priority 110
standby 1 preempt
!
interface Vlan20
mac-address 00d0.9736.ec02
ip address 172.16.2.123 255.255.255.128
standby 1 ip 172.16.2.126
standby 1 priority 200
standby 1 preempt
!
interface Vlan30
mac-address 00d0.9736.ec03
ip address 172.16.2.187 255.255.255.224
standby 1 ip 172.16.2.190
standby 1 priority 110
standby 1 preempt
!
interface Vlan40
mac-address 00d0.9736.ec04
ip address 172.16.1.251 255.255.254.0
standby 1 ip 172.16.1.254
standby 1 priority 200
standby 1 preempt
!
interface Vlan100
mac-address 00d0.9736.ec05
ip address 172.16.2.195 255.255.255.248
standby 1 ip 172.16.2.198
standby 1 priority 200
standby 1 preempt
!
router eigrp 10
network 172.16.0.0 0.0.3.255
no auto-summary
!
ip default-gateway 172.16.2.122
ip classless
!
ip flow-export version 9
!
... View more
Labels:
Created by
petterstergren
in Switching
in Switching
11-07-2019
11:56 AM
11-07-2019
11:56 AM
Ohh! That was it, now when thinking back PT crashed. Did probably forget to do a "copy run start". Thanks for the feedback, helpt me get it up and going again!
... View more
Created by
petterstergren
in Switching
in Switching
11-07-2019
09:43 AM
11-07-2019
09:43 AM
Hi, I have configured my L2-switches with vlans and my L3-switch with vlans, ip address, HFSP. In order to set it I tried to run a ping from the Managment(vlan 10) pc to IT's(vlan 20) pc. But ain't getting a response back. I can ping from IT to the HFSP Default gateway for vlan 20 (IT), but this dosn't work for vlan 10. Can't figure out how. !
version 16.3.2
!
hostname Core1
!
ip routing
!
vtp domain HQ
vtp mode transparent
!
spanning-tree mode pvst
spanning-tree vlan 20,40,100 priority 0
spanning-tree vlan 1,10,30 priority 4096
!
vlan 10
name MGMT
!
vlan 20
name IT
!
vlan 30
name EMPLOYEE
!
vlan 40
name GUEST
!
vlan 99
name BLACKHOLE
!
vlan 100
name SERVER
!
interface Port-channel1
switchport trunk native vlan 99
switchport trunk allowed vlan 10,20,30,40,100
switchport trunk encapsulation dot1q
switchport mode trunk
spanning-tree link-type point-to-point
!
interface GigabitEthernet1/0/1
switchport trunk native vlan 99
switchport trunk allowed vlan 10,20,30,40
switchport trunk encapsulation dot1q
switchport mode trunk
switchport nonegotiate
!
interface GigabitEthernet1/0/2
switchport trunk native vlan 99
switchport trunk allowed vlan 10,20,30,40
switchport trunk encapsulation dot1q
switchport mode trunk
switchport nonegotiate
!
interface GigabitEthernet1/0/20
switchport access vlan 100
switchport mode access
switchport nonegotiate
!
interface GigabitEthernet1/0/23
switchport trunk native vlan 99
switchport trunk allowed vlan 10,20,30,40,100
switchport trunk encapsulation dot1q
switchport mode trunk
channel-group 1 mode active
spanning-tree link-type point-to-point
!
interface GigabitEthernet1/0/24
switchport trunk native vlan 99
switchport trunk allowed vlan 10,20,30,40,100
switchport trunk encapsulation dot1q
switchport mode trunk
channel-group 1 mode active
spanning-tree link-type point-to-point
!
interface Vlan1
no ip address
shutdown
!
interface Vlan10
mac-address 00d0.9736.ec01
ip address 172.16.2.156 255.255.255.224
!
interface Vlan20
mac-address 00d0.9736.ec02
ip address 172.16.2.123 255.255.255.128
standby 1 ip 172.16.2.126
standby 1 priority 200
standby 1 preempt
!
interface Vlan30
mac-address 00d0.9736.ec03
ip address 172.16.2.187 255.255.255.224
!
interface Vlan40
mac-address 00d0.9736.ec04
ip address 172.16.1.251 255.255.254.0
!
interface Vlan100
mac-address 00d0.9736.ec05
ip address 172.16.2.195 255.255.255.248
!
ip classless
!
ip flow-export version 9
!
line con 0
!
line aux 0
!
line vty 0 4
login
!
!
end
!
version 16.3.2
!
hostname Core2
!
!
no ip cef
ip routing
!
no ipv6 cef
!
vtp domain HQ
vtp mode transparent
!
spanning-tree mode pvst
spanning-tree vlan 1,10,30 priority 0
spanning-tree vlan 20,40,100 priority 4096
!
vlan 10
name MGTM
!
vlan 20
name IT
!
vlan 30
name EMPLOYEE
!
vlan 40
name GUEST
!
vlan 99
name BLACKHOLE
!
vlan 100
name SERVER
!
interface Port-channel1
switchport trunk native vlan 99
switchport trunk allowed vlan 10,20,30,40,100
switchport trunk encapsulation dot1q
switchport mode trunk
spanning-tree link-type point-to-point
!
interface GigabitEthernet1/0/1
switchport trunk native vlan 99
switchport trunk allowed vlan 10,20,30,40
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet1/0/2
switchport trunk native vlan 99
switchport trunk allowed vlan 10,20,30,40
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet1/0/3
shutdown
!
interface GigabitEthernet1/0/22
switchport mode access
switchport nonegotiate
!
interface GigabitEthernet1/0/23
switchport trunk native vlan 99
switchport trunk allowed vlan 10,20,30,40,100
switchport trunk encapsulation dot1q
switchport mode trunk
channel-group 1 mode active
spanning-tree link-type point-to-point
!
interface GigabitEthernet1/0/24
switchport trunk native vlan 99
switchport trunk allowed vlan 10,20,30,40,100
switchport trunk encapsulation dot1q
switchport mode trunk
channel-group 1 mode active
spanning-tree link-type point-to-point
!
interface Vlan1
no ip address
shutdown
!
interface Vlan10
mac-address 00e0.f94c.5801
ip address 172.16.2.157 255.255.255.224
!
interface Vlan20
mac-address 00e0.f94c.5802
ip address 172.16.2.124 255.255.255.128
standby 1 ip 172.16.2.126
!
interface Vlan30
mac-address 00e0.f94c.5803
ip address 172.16.2.188 255.255.255.224
!
interface Vlan40
mac-address 00e0.f94c.5804
ip address 172.16.1.252 255.255.254.0
!
interface Vlan100
mac-address 00e0.f94c.5805
ip address 172.16.2.196 255.255.255.248
!
ip classless
!
ip flow-export version 9
!
!
line con 0
!
line aux 0
!
line vty 0 4
login
!
!
end
!
version 12.2
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname HQ-ACCESS-SW-1
!
vtp domain HQ
vtp mode transparent
!
!
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan 10
name MGMT
!
vlan 20
name IT
!
vlan 30
name EMPLOYEE
!
vlan 100
name SERVER
!
interface FastEthernet0/1
switchport access vlan 10
switchport mode access
switchport nonegotiate
switchport port-security maximum 3
switchport port-security violation restrict
!
interface FastEthernet0/9
switchport access vlan 10
switchport mode access
switchport nonegotiate
switchport port-security maximum 3
switchport port-security violation restrict
shutdown
!
interface FastEthernet0/10
switchport access vlan 20
switchport mode access
switchport nonegotiate
switchport port-security maximum 3
switchport port-security violation restrict
!
interface GigabitEthernet0/1
switchport trunk native vlan 99
switchport trunk allowed vlan 10,20,30
switchport mode trunk
switchport nonegotiate
!
interface GigabitEthernet0/2
switchport trunk native vlan 99
switchport trunk allowed vlan 10,20,30
switchport mode trunk
switchport nonegotiate
!
interface Vlan1
no ip address
shutdown
!
interface Vlan20
mac-address 0060.5c2e.2301
ip address 172.16.2.1 255.255.255.128
!
line con 0
!
line vty 0 4
login
line vty 5 15
login
!
!
!
!
end
... View more
- Tags:
- router-on-a-stick
Labels:
Created by
petterstergren
in VPN and AnyConnect
in VPN and AnyConnect
11-06-2019
06:44 PM
11-06-2019
06:44 PM
That's intresting. Seams to be limitations on this in PT however I can't use *nat (inside,outside) source static NET_LOCAL NET_LOCAL destination static NET_STHLM NET_STHLM* From CLI network-object mode commands/options: A.B.C.D Mapped IP address Firewall(config-network-object)#nat (inside,outside) static If i add a ip <cr> Firewall(config-network-object)#nat (inside,outside) static 172.16.0.0 ! Firewall#
... View more
Created by
petterstergren
in VPN and AnyConnect
in VPN and AnyConnect
11-06-2019
02:51 PM
11-06-2019
02:51 PM
Hello, I'm trying to set up an IPsec tunnel between HQ and two branch offices. So far I've set up a connection from HQ's (ASA) to Stockholms (EdgeRouter). At least I thought that I had it going but it seems to be failing, I tried to ping from HQ Management to Sthlm MG(1)(1) I'm using packet tracer; a requirement for the course I'm taking so ASDM is no available. The idea is that Sthlm and Cph should be able to enter the inside as well as the DMZ. !HQ
ASA Version 9.6(1)
!
hostname Firewall
names
!
interface GigabitEthernet1/1
nameif inside
security-level 100
ip address 172.16.2.206 255.255.255.252
!
interface GigabitEthernet1/2
nameif outside
security-level 0
ip address 209.165.202.1 255.255.255.128
!
interface GigabitEthernet1/6
nameif DMZWeb
security-level 50
ip address 192.168.2.1 255.255.255.0
!
object network Inside-Subnet
subnet 172.16.0.0 255.255.252.0
description OsloSubnet
object network NET_LOCAL
subnet 172.16.0.0 255.255.252.0
object network NET_STHLM
subnet 172.16.8.0 255.255.252.0
object network Webserver-Outside
host 192.168.2.2
description Webserver Real IP
object network Webserver-Public
host 209.165.202.3
description Webserver Mapped IP
object network dmz_host
host 192.168.2.2
!
route outside 0.0.0.0 0.0.0.0 209.165.202.2 1
route inside 172.16.0.0 255.255.252.0 172.16.2.205 1
route inside 172.16.4.0 255.255.252.0 172.16.2.205 1
route DMZWeb 192.168.2.0 255.255.255.0 192.168.2.2 1
route outside 209.165.202.0 255.255.255.128 192.168.2.2 1
!
access-list OUTSIDE-DMZ extended permit icmp any host 192.168.2.2
access-list OUTSIDE-DMZ extended permit tcp any host 192.168.2.2 eq www
access-list VPN_ACL extended permit ip object NET_LOCAL object NET_STHLM
!
!
access-group OUTSIDE-DMZ in interface outside
object network Inside-Subnet
nat (inside,outside) dynamic interface
object network Webserver-Outside
nat (DMZWeb,outside) static 209.165.202.3
!
!
!
!
class-map inspection_default
match default-inspection-traffic
!
policy-map global_policy
class inspection_default
inspect icmp
!
service-policy global_policy global
!
telnet timeout 5
ssh timeout 5
!
!
!
crypto ipsec ikev1 transform-set VPN_SET esp-3des esp-sha-hmac
!
crypto map VPN_MAP 10 match address VPN_ACL
crypto map VPN_MAP 10 set peer 209.165.202.129
crypto map VPN_MAP 10 set ikev1 transform-set VPN_SET
crypto map VPN_MAP interface outside
crypto ikev1 enable outside
crypto ikev1 policy 10
encr aes
authentication pre-share
group 2
!
tunnel-group 209.165.202.129 type ipsec-l2l
tunnel-group 209.165.202.129 ipsec-attributes
ikev1 pre-shared-key cisco
! !STHLMRouter
!
version 15.1
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname STHLMIntR
!
enable secret 5 $1$mERr$hx5rVt7rPNoS4wqbXKX7m0
!
!
ip dhcp excluded-address 172.16.8.1 172.16.8.10
ip dhcp excluded-address 172.16.10.1 172.16.10.3
ip dhcp excluded-address 172.16.10.65 172.16.10.67
ip dhcp excluded-address 172.16.10.33 172.16.10.35
!
ip dhcp pool DHCP-POOL-STHLM
network 172.16.8.0 255.255.252.0
default-router 172.168.8.1
domain-name IMT2007
!
ip cef
no ipv6 cef
!
license udi pid CISCO2911/K9 sn FTX1524314Q-
license boot module c2900 technology-package securityk9
!
lldp run
!
crypto isakmp policy 10
encr aes
authentication pre-share
group 2
!
crypto isakmp key cisco address 209.165.202.1
!
crypto ipsec transform-set VPN_OSLO_STHLM esp-3des esp-sha-hmac
!
crypto map VPN_MAP 10 ipsec-isakmp
set peer 209.165.202.1
set transform-set VPN_OSLO_STHLM
match address VPN_ACL
!
spanning-tree mode pvst
!
interface GigabitEthernet0/1
no ip address
duplex auto
speed auto
!
interface GigabitEthernet0/1.10
description Managment interface
encapsulation dot1Q 10
ip address 172.16.10.1 255.255.255.224
ip nat inside
!
interface GigabitEthernet0/1.20
description IT Interface
encapsulation dot1Q 20
ip address 172.16.10.33 255.255.255.224
ip nat inside
!
interface GigabitEthernet0/1.30
description Employee interface
encapsulation dot1Q 30
ip address 172.16.10.65 255.255.255.224
ip nat inside
!
interface GigabitEthernet0/1.40
description Guest interface
encapsulation dot1Q 40
ip address 172.16.8.1 255.255.254.0
ip nat inside
!
interface GigabitEthernet0/0/0
ip address 209.165.202.129 255.255.255.252
ip nat outside
crypto map VPN_MAP
!
interface Vlan1
no ip address
shutdown
!
router eigrp 10
network 172.16.8.0 0.0.3.255
!
ip nat pool NAT-POOL-STOCKHOLM 209.165.202.202 209.165.202.254 netmask 255.255.255.192
ip nat inside source list 1 pool NAT-POOL-STOCKHOLM overload
ip classless
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0/0
!
ip flow-export version 9
!
!
access-list 1 permit 172.16.8.0 0.0.3.255
ip access-list extended VPN_ACL
permit ip 172.16.8.0 0.0.3.255 172.16.0.0 0.0.3.255
!
I have included the PT file: password for the equipment is 'cisco' (ASA is just entering still default)
... View more
- Tags:
- Remote Access
- vpn
Labels:
Created by
petterstergren
in Routing
11-11-2019
11-11-2019
Hi,By removing these lines I seem to also lose my EIGRP exchange over
the two sites? How am I suppos...
Created by
petterstergren
in Routing
11-08-2019
11-08-2019
Hi, Could someone help me to understand where it goes wrong with my ping
from Local Net to Public? T...
11-08-2019
Haha your back, Georg you have done it again!Once again thank you, for
sorting out yet another probl...
Created by
petterstergren
in Routing
11-08-2019
11-08-2019
Hello, Should I include some sort of default path in EIGRP or something?
Im able to ping inside my n...
Created by
petterstergren
in Switching
11-07-2019
11-07-2019
Ohh! That was it, now when thinking back PT crashed. Did probably forget
to do a "copy run start". T...
Created by
petterstergren
in Switching
11-07-2019
11-07-2019
Hi, I have configured my L2-switches with vlans and my L3-switch with
vlans, ip address, HFSP.In ord...
Created by
petterstergren
in VPN and AnyConnect
11-06-2019
11-06-2019
That's intresting. Seams to be limitations on this in PT however I can't
use *nat (inside,outside) s...
Created by
petterstergren
in VPN and AnyConnect
11-06-2019
11-06-2019
Hello, I'm trying to set up an IPsec tunnel between HQ and two branch
offices. So far I've set up a ...
Public Statistics
| Date Registered | 11-06-2019 02:33 PM |
| Date Last Visited | 11-13-2019 05:01 AM |
| Total Messages Posted | 9 |
Helpful Votes Given To
.jpg "VIP Mentor"){kind=icon}
.jpg "Hall of Fame Guru"){kind=icon}
