Access rules

[bheire1973]

Hi,

Users behind a Cisco 1841 are not able to connect to a network using the Cisco Systems VPN Client. Transport is IPsec over UDP (NAT/PAT). Connection just times out.

Could someone please cofirm which ports should be allowed in the access list? Or do you have an link to a article for this?

Thanks

[Harish Balakrishnan]

Hello

is the VPN server behind a NAT device ? what is the exact isse, the user is not able to connect VPN or VPN can be connected but inside network is not reachable.. also post the configuration file..

regards

Harish

[bheire1973]

Hi Harish,

Some users on the internal network (Behind the cisco router) need to use the cisco vpn to access resources external to our network. So we need VPN passthrough.

This router is behind the ISPs router, which is forwarding all traffic.

Here is the config, this for your help

!

crypto isakmp policy 10

encr 3des

authentication pre-share

group 2

lifetime 3600

!

crypto isakmp client configuration group VPN_CLIENTS

key 1111111111

dns xx.xx.xx.xx

pool VPN_CLIENT_POOL

acl 110

!

!

crypto ipsec transform-set TRANS_3DES_SHA esp-3des esp-sha-hmac

!

crypto dynamic-map EXT_DYNAMIC_MAP 10

set transform-set TRANS_3DES_SHA

!

!

crypto map EXT_MAP client authentication list VPN_CLIENT_LOGIN

crypto map EXT_MAP isakmp authorization list VPN_CLIENT_GROUP

crypto map EXT_MAP client configuration address respond

crypto map EXT_MAP 10 ipsec-isakmp dynamic EXT_DYNAMIC_MAP

!

!

!

!

!

interface FastEthernet0/0

ip address 10.88.48.1 255.255.252.0

ip access-group OUTBOUND_FILTER in

no ip redirects

no ip proxy-arp

ip nat inside

ip virtual-reassembly in

duplex auto

speed auto

!

interface FastEthernet0/1

description To Internet

ip address 192.168.51.250 255.255.255.0

ip access-group INBOUND_FILTER in

no ip redirects

no ip unreachables

no ip proxy-arp

ip nat outside

ip virtual-reassembly in

duplex auto

speed auto

crypto map EXT_MAP

!

interface Serial0/0/0

no ip address

shutdown

clock rate 2000000

!

interface FastEthernet0/1/0

no ip address

shutdown

duplex auto

speed auto

!

ip local pool VPN_CLIENT_POOL 192.168.255.20 192.168.255.50

no ip forward-protocol nd

no ip http server

ip http secure-server

!

!

ip nat inside source list 101 interface FastEthernet0/1 overload

ip nat inside source static tcp 10.88.49.59 21 interface FastEthernet0/1 21

ip route 0.0.0.0 0.0.0.0 192.168.51.100

!

ip access-list standard SNMP-ACL

permit 10.75.139.90

deny   any log

ip access-list standard SSH-ACL

permit Public external IP

!

ip access-list extended INBOUND_FILTER

permit udp any eq domain any

permit tcp any eq domain any

permit tcp any eq www any

permit tcp any eq 563 any

permit udp any eq 563 any

permit tcp any eq 443 any

permit udp any eq 443 any

permit tcp any any eq 1723

permit tcp any eq ftp any

permit gre any any

permit tcp any eq 3389 any

permit tcp any eq ftp-data any

permit tcp any any range 1023 65535

permit icmp any any

permit tcp any eq 1723 any

permit tcp any eq smtp any

permit tcp any eq pop3 any

permit tcp any host Public external IP

permit tcp host Public external IP  host 192.168.51.250 eq 22

permit udp any host 192.168.51.250 eq isakmp

permit udp any host 192.168.51.250 eq non500-isakmp

permit esp any host 192.168.51.250

permit ahp any host 192.168.51.250

ip access-list extended OUTBOUND_FILTER

permit tcp host 10.88.48.33 any eq smtp

deny   tcp 10.88.48.0 0.0.0.255 any eq smtp

permit ip any any

permit icmp any any

!

logging esm config

access-list 101 deny   ip 10.88.0.0 0.0.255.255 192.168.255.0 0.0.0.255

access-list 101 deny   ip 10.88.48.0 0.0.0.255 192.168.255.0 0.0.0.255

access-list 101 permit ip 10.88.0.0 0.0.255.255 any

access-list 110 permit ip 10.88.0.0 0.0.255.255 192.168.255.0 0.0.0.255

access-list 110 permit ip 10.88.48.0 0.0.0.255 192.168.255.0 0.0.0.255

!

!

!

snmp-server community Stanley RO SNMP-ACL

snmp-server ifindex persist

snmp-server enable traps tty

!

!

!

control-plane

!

!

banner login 

*****************************************************************

******************************************************************

!

line con 0

exec-timeout 30 0

logging synchronous

line aux 0

line vty 0 4

exec-timeout 30 0

logging synchronous

transport input ssh

!

scheduler allocate 20000 1000

ntp source FastEthernet0/0

end

[Julio Carvajal]

Hello,

When you say pass-trough you mean the VPN clients will go across this router so the router just need to be open for the right ports, the router itself will not be the VPN client nor VPN headend correct???

Regards,

[bheire1973]

Hi,

yes, that is correct. They will just pass through this router to the internet. So as you say, the router needs to have the correct ports open.

Thank you for your help

[Julio Carvajal · Accepted solution]

Hello,

Okay so basically for a regular IPSec VPN client connection we will need to have open the following ports:

UDP 500

UDP 4500

ESP or AH

interface FastEthernet0/0

ip access-group OUTBOUND_FILTER in

interface FastEthernet0/1

ip access-group INBOUND_FILTER in

Those are the 2 ACL's you have in place.

You will need to allow on each of them the traffic for the VPN endpoint, let's say the internal users will be

10.88.48.0 /24 and the VPN server will be 4.2.2.2

So the configuration need it will be:

ip access-list extended OUTBOUND_FILTER

1 permit udp 10.88.48.0 0.0.0.255 host 4.2.2.2 eq 500

2 permit udp 10.88.48.0 0.0.0.255 host 4.2.2.2 eq 4500

3 permit esp 10.88.48.0 0.0.0.255 host 4.2.2.2

ip access-list extended INBOUND_FILTER

1 permit udp host 4.2.2.2 eq 500 10.88.48.0 0.0.0.255

2 permit udp host 4.2.2.2 eq 4500 10.88.48.0 0.0.0.255

3 permit esp host 4.2.2.2 10.88.48.0 0.0.0.255

Any other question..Sure...Just remember to rate all of the helpful posts

Julio