12-17-2006 03:24 PM - edited 02-21-2020 02:46 PM
We have the following ACL assigned to WAN port of our Cisco 831:
access-list 111 permit tcp any any established
access-list 111 permit tcp host [*remote private ip snipped*] any eq telnet
access-list 111 permit esp any any
access-list 111 permit ahp any any
access-list 111 permit udp any any eq isakmp
access-list 111 permit udp any any eq 10000
access-list 111 permit gre any any
access-list 111 permit udp any eq isakmp any
access-list 111 permit udp any eq non500-isakmp any
access-list 111 permit udp any eq domain any
access-list 111 permit udp any eq 21068 any
access-list 111 permit tcp any any eq smtp
access-list 111 permit tcp any any eq 3389
access-list 111 permit tcp any any eq 3390
access-list 111 permit tcp any any eq 143
access-list 111 permit tcp any any eq 443
access-list 111 permit tcp any any eq pop3
access-list 111 deny ip any any
Should that allow a host on the LAN to access a remote VPN connection (using Cisco VPN client)? Is anything else needed?
Router is running 12.3(8), already supporting inbound Cisco client connections and one remote LAN-to-LAN VPN.
12-18-2006 06:57 AM
i have a few questions:
Are you sure that this is outbound, and not inbound on the WAN interface?
The thing that needs to be identified, is which flavor of IPSEC you are uing in the client. Standard IPSEC and IPSEC over UDP do not work well unless they have a 1 for NAT translation. IPSEC over TCP usually works if you are doing PAT'ing of some sort. If the VPN device on the other end can support IPSEC of TCP (COncentrator or PIX/ASA running 7.x) then set the client to use IPSEC over TCP.
12-18-2006 11:50 AM
Sorry I was not clear, this is the inbound ACL. The main intent of the post was to make sure nothing in the ACL was blocking a reply from distant end.
Not sure what IPSEC setup the client/destination end is using (I'm coming in at the tailend of this effort, playing mop-up). Hope to identify that on my next call with them.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide