Server ip at the ISP is 10.1.20.2. (I can ping this form the office and I get replies.)
host ip at the office is 10.178.164.132 (I cannot ping this ip from the router at the isp)
This is the config for the router at our office:
Building configuration...
Current configuration : 4549 bytes
!
! Last configuration change at 14:36:16 UTC Tue Sep 18 2012 by admin
! NVRAM config last updated at 05:56:44 UTC Tue Sep 18 2012 by admin
! NVRAM config last updated at 05:56:44 UTC Tue Sep 18 2012 by admin
version 15.1
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname Headoffice
!
boot-start-marker
boot-end-marker
!
!
logging buffered 500000
no logging console
!
aaa new-model
!
!
aaa authentication login default local
aaa authorization exec default local
!
!
!
!
!
aaa session-id common
memory-size iomem 10
crypto pki token default removal timeout 0
!
!
ip source-route
!
!
!
!
!
ip cef
ip domain name HQ
no ipv6 cef
!
!
license udi pid CISCO887VA-K9 sn FCZ1616C1TP
!
!
username admin privilege 15 password 7 04785A63071h736305
!
!
!
!
controller VDSL 0
!
!
track 1 ip sla 1 reachability
!
class-map match-any CM_Block_P2P
match protocol edonkey
match protocol fasttrack
match protocol gnutella
match protocol kazaa2
match protocol winmx
!
!
policy-map PM_Block_P2P
class CM_Block_P2P
drop
!
!
!
crypto isakmp policy 10
encr 3des
authentication pre-share
group 2
crypto isakmp key shdjeiijskdff44356 address 0.0.0.0 0.0.0.0
crypto isakmp keepalive 600 10 periodic
!
!
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
mode transport
!
crypto ipsec profile DMVPN
set transform-set ESP-3DES-SHA
!
!
!
!
!
!
interface Loopback0
ip address 172.19.0.11 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
interface Tunnel0
ip address 172.20.0.11 255.255.255.0
no ip redirects
ip mtu 1416
ip nhrp map multicast 75.78.5.194
ip nhrp map 172.20.0.1 75.78.5.194
ip nhrp network-id 1
ip nhrp nhs 172.20.0.1
tunnel source Dialer2
tunnel destination 75.78.5.194
tunnel key 2012
tunnel protection ipsec profile DMVPN
!
interface Ethernet0
no ip address
shutdown
no fair-queue
!
interface ATM0
no ip address
no atm ilmi-keepalive
pvc 8/35
pppoe-client dial-pool-number 2
pppoe-client dial-pool-number 1
!
!
interface FastEthernet0
no ip address
!
interface FastEthernet1
no ip address
!
interface FastEthernet2
no ip address
!
interface FastEthernet3
no ip address
!
interface Vlan1
ip address 10.178.164.132 255.255.255.128
ip nbar protocol-discovery
ip nat inside
ip virtual-reassembly in
!
interface Dialer1
description International
ip address negotiated
ip mtu 1492
ip nat outside
ip virtual-reassembly in
encapsulation ppp
ip tcp adjust-mss 1452
dialer pool 1
no peer neighbor-route
ppp authentication chap callin
ppp chap hostname companyname@someisp-international.co.za
ppp chap password 7 070B35545418130h75
no cdp enable
!
interface Dialer2
description Local Only
ip address negotiated
ip mtu 1492
ip nat outside
ip virtual-reassembly in
encapsulation ppp
ip tcp adjust-mss 1452
dialer pool 2
ppp authentication chap callin
ppp chap hostname companyname@someisp.local
ppp chap password 7 0250035750850G734D
no cdp enable
!
router rip
version 2
network 10.0.0.0
network 172.20.0.0
no auto-summary
!
ip forward-protocol nd
ip http server
no ip http secure-server
!
ip nat inside source route-map NAT-DIALER-1 interface Dialer1 overload
ip nat inside source route-map NAT-DIALER-2 interface Dialer2 overload
ip route 0.0.0.0 0.0.0.0 Dialer1 track 1
ip route 75.78.5.194 255.255.255.255 Dialer2 track 1
ip route 0.0.0.0 0.0.0.0 10.178.164.129 200
ip route 75.78.5.194 255.255.255.255 10.178.164.129 200
ip route 196.25.1.1 255.255.255.255 Dialer2
!
ip sla 1
icmp-echo 196.25.1.1 source-interface Dialer2
threshold 2
timeout 1000
frequency 20
ip sla schedule 1 life forever start-time now
logging dmvpn
access-list 101 deny ip 10.178.164.128 0.0.0.127 10.1.20.0 0.0.0.255
access-list 101 deny ip 10.178.164.128 0.0.0.127 172.20.0.0 0.0.255.255
access-list 101 deny ip 10.178.164.128 0.0.0.127 10.0.0.0 0.0.0.255
access-list 101 permit ip 10.178.164.128 0.0.0.127 any
access-list 102 deny ip 10.178.164.128 0.0.0.127 10.1.20.0 0.0.0.255
access-list 102 deny ip 10.178.164.128 0.0.0.127 172.20.0.0 0.0.255.255
access-list 102 deny ip 10.178.164.128 0.0.0.127 10.0.0.0 0.0.0.255
access-list 102 permit ip 10.178.164.128 0.0.0.127 any
!
!
!
!
route-map NAT-DIALER-1 permit 1
match ip address 101
match interface Dialer1
!
route-map NAT-DIALER-2 permit 1
match ip address 102
match interface Dialer2
!
!
!
!
line con 0
line aux 0
line vty 0 4
transport input all
!
end
Show crypto isakmp sa:
IPv4 Crypto ISAKMP SA
dst src state conn-id status
75.78.5.194 75.144.170.46 QM_IDLE 2012 ACTIVE
IPv6 Crypto ISAKMP SA
show crypto ipsec sa:
interface: Tunnel0
Crypto map tag: Tunnel0-head-0, local addr 41.144.170.46
protected vrf: (none)
local ident (addr/mask/prot/port): (41.144.170.46/255.255.255.255/47/0)
remote ident (addr/mask/prot/port): (41.78.5.194/255.255.255.255/47/0)
current_peer 41.78.5.194 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 1479, #pkts encrypt: 1479, #pkts digest: 1479
#pkts decaps: 1712, #pkts decrypt: 1712, #pkts verify: 1712
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 12, #recv errors 0
local crypto endpt.: 41.144.170.46, remote crypto endpt.: 41.78.5.194
path mtu 1492, ip mtu 1492, ip mtu idb Dialer2
current outbound spi: 0xB6535704(3058915076)
PFS (Y/N): N, DH group: none
inbound esp sas:
spi: 0xD4E9DA60(3572095584)
transform: esp-3des esp-sha-hmac ,
in use settings ={Transport, }
conn id: 67, flow_id: Onboard VPN:67, sibling_flags 80000006, crypto map: Tunnel0-head-0
sa timing: remaining key lifetime (k/sec): (4415569/573)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0xB6535704(3058915076)
transform: esp-3des esp-sha-hmac ,
in use settings ={Transport, }
conn id: 68, flow_id: Onboard VPN:68, sibling_flags 80000006, crypto map: Tunnel0-head-0
sa timing: remaining key lifetime (k/sec): (4415553/573)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
