10-28-2013 05:22 AM
Hello,
I have a cisco router configured with pptp vpn.
I can connect to vpn on the router and establish connections to internal servers in the LAN.
on the other hand, the user connected to the vpn on the cisco router cant access the internet!
can anyone help?
regards,
Majed
10-28-2013 09:24 AM
In Windows VPN properties uncheck use default gateway for remote network
Michael
Please rate all helpful posts
10-29-2013 12:37 AM
Michael,
lets take this a little bit further into details.
this is a sample configuration of the router for the pptp configuration;
--------------------------------------------------------
vpdn enable
!
vpdn-group PPTP
Default PPTP VPDN group
accept-dialin
protocol pptp
virtual-template 1
!
interface Virtual-Template1
ip unnumbered FastEthernet0/1
peer default ip address pool PPTP
no keepalive
ppp authentication pap chap ms-chap
ppp ipcp route default
!
ip local pool PPTP 10.150.150.1 10.150.150.100
--------------------------------------------------------
how we connect;
We connect to the vpn from the mobile phone and we have a mobile application that registers to an internal PBX server for calls.
problem;
When the mobile phone is connected to the vpn, we can register to the PBX and establish calls to internal extensions, but the problem is that the mobile phone connected through vpn stops accessing the internet!
how can i make the mobile phone access the internet while connecting to vpn?
regards,
Majed
10-29-2013 01:25 AM
Can you post your complete config please?
Michael
Please rate all helpful posts
10-29-2013 01:29 AM
Current configuration : 5698 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname AARU-ROUTER
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 warnings
enable secret 5 $1$567Z$319wwITILMp9adol..vqT/
!
no aaa new-model
!
resource policy
!
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
ip subnet-zero
ip cef
!
!
!
!
ip domain name yourdomain.com
ip name-server 212.118.14.82
ip name-server 212.118.0.2
vpdn enable
!
vpdn-group PPTP
Default PPTP VPDN group
accept-dialin
protocol pptp
virtual-template 1
!
!
voice-card 0
!
!
!
!
!
crypto pki trustpoint TP-self-signed-1863442040
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-1863442040
revocation-check none
rsakeypair TP-self-signed-1863442040
!
!
crypto pki certificate chain TP-self-signed-1863442040
certificate self-signed 01
30820252 308201BB A0030201 02020101 300D0609 2A864886 F70D0101 04050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 31383633 34343230 3430301E 170D3039 30323137 30393134
32385A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 38363334
34323034 3030819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100B953 52F5D06A 8E6385D6 675D6492 3788404C 1C108C6F E6395C66 3919AEDB
3CF85596 75FC9183 D9BAF897 7AC06E67 520C7CF9 FDD76343 FD1DFEEA 69DABB20
FC986220 322FDD89 042A0B7E DAE8B6A3 8A397A15 49D1AA2E A1CFB1E3 18D8BA6C
C4670459 984A2162 2EB1C512 DE3F6CCE 7B8944BA 9834A184 ECD0C9A3 DE846778
36C90203 010001A3 7A307830 0F060355 1D130101 FF040530 030101FF 30250603
551D1104 1E301C82 1A414152 552D524F 55544552 2E796F75 72646F6D 61696E2E
636F6D30 1F060355 1D230418 30168014 926DEEA1 A8546AF9 F8440E3C E2550570
98DD59B4 301D0603 551D0E04 16041492 6DEEA1A8 546AF9F8 440E3CE2 55057098
DD59B430 0D06092A 864886F7 0D010104 05000381 8100B0F4 65B7CA25 77AD682C
CCA048DE E0FBA253 7BC6D779 3D625F1C 82F82D70 90672C21 EE0EA385 7068B948
083C28AD 61F3CC39 195CCEFF 673FEC89 4F2C231E A703FD7B DCA35A05 9129223A
C566DD2A 51B102CA 90F830FF 44488A9E E853884F 799F2D82 376BEB51 E39AB380
AFB598B8 3009007F 653F3CC7 0BC101A1 D0F99B37 8225
quit
username cisco privilege 15 secret 5 $1$s2d5$lpnampHiI1XeNzsMgcozF.
username test password 0 *****
username sultan password 0 ******
!
interface FastEthernet0/0
description connected to outside ASA
ip address 212.118.13.57 255.255.255.248
speed 100
full-duplex
!
interface FastEthernet0/1
ip address 212.118.14.106 255.255.255.248
duplex auto
speed auto
!
interface Virtual-Template1
ip unnumbered FastEthernet0/1
peer default ip address pool PPTP
no keepalive
ppp authentication pap chap ms-chap
ppp ipcp route default
!
ip local pool PPTP 10.150.150.1 10.150.150.100
ip classless
ip route 0.0.0.0 0.0.0.0 212.118.14.105
ip route 172.16.16.40 255.255.255.255 212.118.13.58
ip route 172.16.16.41 255.255.255.255 212.118.13.58
!
!
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
access-list 23 permit 212.118.13.56 0.0.0.7
!
!
!
control-plane
!
line con 0
password cisco
login
line aux 0
line vty 0 4
access-class 23 in
privilege level 15
password cisco
login
transport input telnet ssh
line vty 5 15
access-class 23 in
--More-- privilege level 15
login local
transport input telnet ssh
!
end
10-29-2013 01:43 AM
You don't use NAT, the packets from your pool are private IP's and have to be natted.
Michael
Please rate all helpful posts
10-29-2013 01:57 AM
yes michael that what i thought of. but im trying to figure out how can the nat be done.
if i want to make the vpn users to be natted, then i should configure the following;
access-list 111 deny ip 10.150.150.0 0.0.0.255 172.16.0.0 0.0.255.255
access-list 111 permit ip 10.150.150.0 0.0.0.255 any
// to match the vpn user traffic accessing the internet only and deny the vpn users accessint internal network
ip nat inside source list 111 interface fastethernet 0/1 overload
// nat vpn users accessing the internet through interface f0/1
interface virtual-template 1
ip nat inside
interface fastethernet 0/1
ip nat outside
logically will this work, so the vpn users access internal network and at the same time access the internet by natting them on the internet interface f0/1?
regards,
Majed
10-29-2013 01:59 AM
Yes, looks good, try it!
Michael
Please rate all helpful posts
10-29-2013 02:05 AM
sure i will give it a try.
but please can you stay in contact till i get the chance to do so.
and can you send me your email address, or send me an email on "mwmasri@gmail.com" please?
Majed
10-29-2013 02:09 AM
I'm here, will not run away
Michael
Please rate all helpful posts
10-29-2013 02:11 AM
hahahahaaa
ok then will inform you with any update when i do this.
regards,
Majed
12-11-2013 01:15 AM
Michael,
I forgot to provide you with the update . I did the configuration discussed above, and it successfully worked :D
Thanks for the help
Sent from Cisco Technical Support Android App
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide