831 Router as VPN Server?

[MattEnderle]

I used the built in web gui(SDM) to set up the config. I'm a newb to VPN but not to networking.

Here is my config file.

---------------------------------------------------

!

version 12.3

no service pad

service tcp-keepalives-in

service tcp-keepalives-out

service timestamps debug datetime msec localtime show-timezone

service timestamps log datetime msec localtime show-timezone

service password-encryption

service sequence-numbers

!

hostname Tizite

!

security authentication failure rate 3 log

security passwords min-length 6

logging buffered 51200 debugging

logging console critical

enable secret 5 **************************

!

username Admin privilege 15 secret 5 *******

username Airricks privilege 3 secret 5 ***********

clock timezone PCTime -5

clock summer-time PCTime date Apr 6 2003 2:00 Oct 26 2003 2:00

aaa new-model

!

!

aaa authentication login default local

aaa authentication login sdm_vpn_xauth_ml_1 local

aaa authorization exec default local

aaa authorization network sdm_vpn_group_ml_1 local

aaa session-id common

ip subnet-zero

no ip source-route

ip tcp synwait-time 10

ip host ME 10.10.10.2

ip host SERVER 10.10.10.2

ip dhcp excluded-address 10.10.10.1

!

ip dhcp pool sdm-pool1

import all

network 10.10.10.0 255.255.255.0

default-router 10.10.10.1

!

!

no ip bootp server

ip cef

ip inspect name DEFAULT100 cuseeme

ip inspect name DEFAULT100 ftp

ip inspect name DEFAULT100 h323

ip inspect name DEFAULT100 netshow

ip inspect name DEFAULT100 rcmd

ip inspect name DEFAULT100 realaudio

ip inspect name DEFAULT100 rtsp

ip inspect name DEFAULT100 smtp

ip inspect name DEFAULT100 sqlnet

ip inspect name DEFAULT100 streamworks

ip inspect name DEFAULT100 tftp

ip inspect name DEFAULT100 tcp

ip inspect name DEFAULT100 udp

ip inspect name DEFAULT100 vdolive

ip inspect name DEFAULT100 icmp

ip audit notify log

ip audit po max-events 100

ip ssh time-out 60

ip ssh authentication-retries 2

no ftp-server write-enable

!

!

!

!

crypto isakmp policy 1

encr 3des

authentication pre-share

group 2

!

crypto isakmp policy 3

encr 3des

group 2

!

crypto isakmp client configuration group Users

pool SDM_POOL_1

!

!

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

!

crypto dynamic-map SDM_DYNMAP_1 1

set transform-set ESP-3DES-SHA

reverse-route

!

!

crypto map SDM_CMAP_1 client authentication list sdm_vpn_xauth_ml_1

crypto map SDM_CMAP_1 isakmp authorization list sdm_vpn_group_ml_1

crypto map SDM_CMAP_1 client configuration address respond

crypto map SDM_CMAP_1 65535 ipsec-isakmp dynamic SDM_DYNMAP_1

!

!

!

!

interface Null0

no ip unreachables

!

interface Ethernet0

description $FW_INSIDE$$ETH-LAN$$INTF-INFO-Ethernet 10/100$

ip address 10.10.10.1 255.255.255.0

ip access-group 100 in

no ip redirects

no ip unreachables

no ip proxy-arp

ip nat inside

ip route-cache flow

no cdp enable

!

interface Ethernet1

description $FW_OUTSIDE$$ETH-WAN$

ip address dhcp client-id Ethernet1

ip access-group 101 in

no ip redirects

no ip unreachables

no ip proxy-arp

ip nat outside

ip inspect DEFAULT100 out

ip route-cache flow

duplex auto

no cdp enable

crypto map SDM_CMAP_1

!

interface FastEthernet1

no ip address

duplex auto

speed auto

!

[MattEnderle]

interface FastEthernet2

no ip address

duplex auto

speed auto

!

interface FastEthernet3

no ip address

duplex auto

speed auto

!

interface FastEthernet4

no ip address

duplex auto

speed auto

!

ip local pool SDM_POOL_1 10.10.10.100 10.10.10.150

ip nat inside source route-map SDM_RMAP_1 interface Ethernet1 overload

ip classless

ip route 192.168.1.0 255.255.255.0 FastEthernet2

ip route 192.168.1.0 255.255.255.0 FastEthernet1

ip http server

ip http access-class 2

ip http authentication local

ip http secure-server

!

logging trap debugging

access-list 1 remark INSIDE_IF=Ethernet0

access-list 1 remark SDM_ACL Category=2

access-list 1 permit 10.10.10.0 0.0.0.255

access-list 2 remark HTTP Access-class list

access-list 2 remark SDM_ACL Category=1

access-list 2 permit 10.10.10.0 0.0.0.255

access-list 2 deny any

access-list 100 remark auto generated by SDM firewall configuration

access-list 100 remark SDM_ACL Category=1

access-list 100 deny ip host 255.255.255.255 any

access-list 100 deny ip 127.0.0.0 0.255.255.255 any

access-list 100 permit ip any any

access-list 101 remark auto generated by SDM firewall configuration

[MattEnderle]

access-list 101 remark SDM_ACL Category=1

access-list 101 permit ip host 10.10.10.100 any

access-list 101 permit ip host 10.10.10.101 any

access-list 101 permit ip host 10.10.10.102 any

access-list 101 permit ip host 10.10.10.103 any

access-list 101 permit ip host 10.10.10.104 any

access-list 101 permit ip host 10.10.10.105 any

access-list 101 permit ip host 10.10.10.106 any

access-list 101 permit ip host 10.10.10.107 any

access-list 101 permit ip host 10.10.10.108 any

access-list 101 permit ip host 10.10.10.109 any

access-list 101 permit ip host 10.10.10.110 any

access-list 101 permit ip host 10.10.10.111 any

access-list 101 permit ip host 10.10.10.112 any

access-list 101 permit ip host 10.10.10.113 any

access-list 101 permit ip host 10.10.10.114 any

access-list 101 permit ip host 10.10.10.115 any

access-list 101 permit ip host 10.10.10.116 any

access-list 101 permit ip host 10.10.10.117 any

access-list 101 permit ip host 10.10.10.118 any

access-list 101 permit ip host 10.10.10.119 any

access-list 101 permit ip host 10.10.10.120 any

access-list 101 permit ip host 10.10.10.121 any

access-list 101 permit ip host 10.10.10.122 any

access-list 101 permit ip host 10.10.10.123 any

access-list 101 permit ip host 10.10.10.124 any

access-list 101 permit ip host 10.10.10.125 any

access-list 101 permit ip host 10.10.10.126 any

access-list 101 permit ip host 10.10.10.127 any

access-list 101 permit ip host 10.10.10.128 any

access-list 101 permit ip host 10.10.10.129 any

access-list 101 permit ip host 10.10.10.130 any

access-list 101 permit ip host 10.10.10.131 any

access-list 101 permit ip host 10.10.10.132 any

access-list 101 permit ip host 10.10.10.133 any

access-list 101 permit ip host 10.10.10.134 any

access-list 101 permit ip host 10.10.10.135 any

access-list 101 permit ip host 10.10.10.136 any

access-list 101 permit ip host 10.10.10.137 any

access-list 101 permit ip host 10.10.10.138 any

access-list 101 permit ip host 10.10.10.139 any

access-list 101 permit ip host 10.10.10.140 any

access-list 101 permit ip host 10.10.10.141 any

access-list 101 permit ip host 10.10.10.142 any

access-list 101 permit ip host 10.10.10.143 any

access-list 101 permit ip host 10.10.10.144 any

access-list 101 permit ip host 10.10.10.145 any

access-list 101 permit ip host 10.10.10.146 any

access-list 101 permit ip host 10.10.10.147 any

access-list 101 permit ip host 10.10.10.148 any

access-list 101 permit ip host 10.10.10.149 any

access-list 101 permit ip host 10.10.10.150 any

access-list 101 permit udp any any eq non500-isakmp

access-list 101 permit udp any any eq isakmp

access-list 101 permit esp any any

access-list 101 permit ahp any any

access-list 101 deny ip 10.10.10.0 0.0.0.255 any

access-list 101 permit udp any eq bootps any eq bootpc

access-list 101 permit icmp any any echo-reply

access-list 101 permit icmp any any time-exceeded

access-list 101 permit icmp any any unreachable

access-list 101 deny ip 10.0.0.0 0.255.255.255 any

access-list 101 deny ip 172.16.0.0 0.15.255.255 any

access-list 101 deny ip 192.168.0.0 0.0.255.255 any

access-list 101 deny ip 127.0.0.0 0.255.255.255 any

access-list 101 deny ip host 255.255.255.255 any

access-list 101 deny ip any any

access-list 102 remark VTY Access-class list

access-list 102 remark SDM_ACL Category=1

access-list 102 permit ip 10.10.10.0 0.0.0.255 any

access-list 102 deny ip any any

access-list 103 remark SDM_ACL Category=2

[MattEnderle]

access-list 103 deny ip any host 10.10.10.100

access-list 103 deny ip any host 10.10.10.101

access-list 103 deny ip any host 10.10.10.102

access-list 103 deny ip any host 10.10.10.103

access-list 103 deny ip any host 10.10.10.104

access-list 103 deny ip any host 10.10.10.105

access-list 103 deny ip any host 10.10.10.106

access-list 103 deny ip any host 10.10.10.107

access-list 103 deny ip any host 10.10.10.108

access-list 103 deny ip any host 10.10.10.109

access-list 103 deny ip any host 10.10.10.110

access-list 103 deny ip any host 10.10.10.111

access-list 103 deny ip any host 10.10.10.112

access-list 103 deny ip any host 10.10.10.113

access-list 103 deny ip any host 10.10.10.114

access-list 103 deny ip any host 10.10.10.115

access-list 103 deny ip any host 10.10.10.116

access-list 103 deny ip any host 10.10.10.117

access-list 103 deny ip any host 10.10.10.118

access-list 103 deny ip any host 10.10.10.119

access-list 103 deny ip any host 10.10.10.120

access-list 103 deny ip any host 10.10.10.121

access-list 103 deny ip any host 10.10.10.122

access-list 103 deny ip any host 10.10.10.123

access-list 103 deny ip any host 10.10.10.124

access-list 103 deny ip any host 10.10.10.125

access-list 103 deny ip any host 10.10.10.126

access-list 103 deny ip any host 10.10.10.127

access-list 103 deny ip any host 10.10.10.128

access-list 103 deny ip any host 10.10.10.129

access-list 103 deny ip any host 10.10.10.130

access-list 103 deny ip any host 10.10.10.131

access-list 103 deny ip any host 10.10.10.132

access-list 103 deny ip any host 10.10.10.133

access-list 103 deny ip any host 10.10.10.134

access-list 103 deny ip any host 10.10.10.135

access-list 103 deny ip any host 10.10.10.136

access-list 103 deny ip any host 10.10.10.137

access-list 103 deny ip any host 10.10.10.138

access-list 103 deny ip any host 10.10.10.139

access-list 103 deny ip any host 10.10.10.140

access-list 103 deny ip any host 10.10.10.141

access-list 103 deny ip any host 10.10.10.142

access-list 103 deny ip any host 10.10.10.143

access-list 103 deny ip any host 10.10.10.144

access-list 103 deny ip any host 10.10.10.145

access-list 103 deny ip any host 10.10.10.146

access-list 103 deny ip any host 10.10.10.147

access-list 103 deny ip any host 10.10.10.148

access-list 103 deny ip any host 10.10.10.149

access-list 103 deny ip any host 10.10.10.150

access-list 103 permit ip 10.10.10.0 0.0.0.255 any

no cdp run

route-map SDM_RMAP_1 permit 1

match ip address 103

!

banner login Authorized access only!

Hackers will be cut at the throat!

!

line con 0

no modem enable

transport output telnet

line aux 0

transport output telnet

line vty 0 4

access-class 102 in

transport input telnet ssh

!

scheduler max-task-time 5000

scheduler interval 500

!

end

[reswaran]

Hi,

Whats the issue? Is this configuration not working?? I find that there is no key configured under the VPN group. I think you need to configure the key.

-Ravikumar

[MattEnderle]

ha.. after my 3 post thread i thought nobody would reply..lol so big appreciation for that.. I went into SDM ..(my gui) and set a VPN encryption key.. it didnt specify how long it had to be or anything.. now i have the cisco vpn client 4.0.4 running on win xp hooked into the LAN side of my router. I might have to try it from an outside source. anyways - it doesnt connect and I cannot find anywhere in the client to save the key??

thanks, matt enderle

[harris-ross]

Hi

I recently bought a cisco 831 Router which is meant to work with Cable modem/broadband, but when I plug it in to my cable modem it does not work. I looked at the WAN interface and it says Ethernet1 line up, but Line Protocol down. Any ideas? I mean it says on the cisco website that the 831 works with cable modem?

Are you using your 831 with cable modem and if so what do I need to do??

If you can suggest anything I will be greatful.

cheers

Tony

[MattEnderle]

Make sure you power cycle your cable modem. leave it off for atleast a FULL 2 minutes. Sometimes the MAC address is married to the modem.

If that doesn't work try spoofing the router WAN port MAC the same of the workstation that it does infact work on.

The MAC spoof command is on ciscos site, I don't know it because I didnt need to use it.

Good luck, Matt Enderle

[MattEnderle]

I still cannot find out what is wrong with my config with this EzVPN.

Thanks