Cisco to Sonicwall VPN - Can only establish VPN to one subnet but not multiple.

ForsakenZombi · ‎10-07-2015

So I have established a VPN from CISCO 881 Router to Sonicwall NSA 2600.

The cisco network is 192.168.90.0/24

The sonicwall network has a lan of 192.168.10.0/24 and then a server network of 192.168.20.0/24 then a Sandbox Lan of 192.168.30.0/24 and more but I figure if I can get those 3 working I could figure out the rest myself.

I am a bit of a newb at Cisco so that has been the challenge. If I am not mistaken on the sonicwall I would just need to create a address object group of all the different subnets and choose that as the local network when configuring the VPN.

However on the cisco I have no idea how to configure the access list and routing to account for the multiple subnets in the VPN. Please see below for my config (public IPs have been censored).

Additionally if you see anything that would be causing the sonicwall network not being able to ping or RDP into the Cisco network please let me know (Currently the sonicwall is being configured BEHIND my current network equipment and has a public IP using NAT translation so I believe the issue could be due to that since the public IP address isnt directly configured to the sonicwall but then again thats just a guess so if you see anything that could be causing this please let me know.)

Labrouter#show run
Building configuration...

Current configuration : 2695 bytes
!
! Last configuration change at 09:44:21 SUMMER Wed Oct 7 2015
!
version 15.0
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname Labrouter
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$VVP3$S54zJ7vK9sYUDlDnruCZm.
enable password 7 0034011F564C0A140E
!
aaa new-model
!
!
!
!
!
!
!
aaa session-id common
!
!
!
memory-size iomem 10
clock timezone EST -5
clock summer-time SUMMER recurring
!
!
ip source-route
!
!
ip dhcp excluded-address 192.168.90.1 192.168.90.50
!
ip dhcp pool LAN1
   import all
   network 192.168.90.0 255.255.255.0
   default-router 192.168.90.1
   dns-server 8.8.8.8
   lease 7
!
!
ip cef
no ip domain lookup
ip multicast-routing
no ipv6 cef
!
!
multilink bundle-name authenticated
license udi pid CISCO881-SEC-K9 sn FTX155382K0
!
!
vtp mode transparent
!
!
vlan 10
name LAN
!
ip ssh version 2
!
!
crypto isakmp policy 1
encr aes 256
authentication pre-share
group 5
lifetime 28800
crypto isakmp key XXXXXXXX address 199.227.XXX.XXX
crypto isakmp keepalive 10 periodic
!
!
crypto ipsec transform-set Chris-Home esp-3des esp-sha-hmac
!
crypto map cisco_1_to_sonicwall_1 10 ipsec-isakmp
set peer 199.227.XXX.XXX
set transform-set Chris-Home
match address 102
!
!
!
!
!
interface FastEthernet0
switchport access vlan 10
spanning-tree portfast
!
!
interface FastEthernet1
switchport access vlan 10
spanning-tree portfast
!
!
interface FastEthernet2
switchport access vlan 10
spanning-tree portfast
!
!
interface FastEthernet3
no cdp enable
spanning-tree portfast
!
!
interface FastEthernet4
ip address dhcp client-id FastEthernet4
ip nat outside
ip virtual-reassembly
ip tcp adjust-mss 1460
duplex auto
speed auto
no cdp enable
crypto map cisco_1_to_sonicwall_1
!
!
interface Vlan1
description LAN
ip address dhcp
!
!
interface Vlan10
description LAN
ip address 192.168.90.1 255.255.255.0
ip nat inside
ip virtual-reassembly
!
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
ip nat inside source list NAT interface FastEthernet4 overload
ip route 0.0.0.0 0.0.0.0 dhcp
!
ip access-list extended NAT
deny   ip 192.168.90.0 0.0.0.255 192.168.10.0 0.0.0.255
permit ip 192.168.90.0 0.0.0.255 any
ip access-list extended VPN
permit ip 192.168.10.0 0.0.0.255 192.168.90.0 0.0.0.255
!
access-list 101 permit ip 192.168.90.0 0.0.0.255 any
access-list 102 permit ip 192.168.90.0 0.0.0.255 192.168.10.0 0.0.0.255
!
!
!
!
!
control-plane
!
!
!
line con 0
logging synchronous
no modem enable
line aux 0
line vty 0 4
password 7 0123141D081C071D20
transport preferred ssh
transport input ssh
!
scheduler max-task-time 5000
end

ForsakenZombi · ‎10-07-2015

ok so I added:

access-list 102 permit ip 192.168.90.0 0.0.0.255 192.168.20.0 0.0.0.255

access-list 102 permit ip 192.168.90.0 0.0.0.255 192.168.30.0 0.0.0.255

and then I added:

ip access-list extended NAT

deny ip 192.168.90.0 0.0.0.255 192.168.10.0 0.0.0.255

deny ip 192.168.90.0 0.0.0.255 192.168.20.0 0.0.0.255

deny ip 192.168.90.0 0.0.0.255 192.168.30.0 0.0.0.255

permit ip 192.168.90.0 0.0.0.255 any

And then did some configuring on the sonicwall and boom I got it working

Labrouter#show crypto ipsec sa | include local  ident|remote ident|lifetime
   local  ident (addr/mask/prot/port): (192.168.90.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (192.168.10.0/255.255.255.0/0/0)
        sa timing: remaining key lifetime (k/sec): (4451457/3350)
        sa timing: remaining key lifetime (k/sec): (4451457/3350)
   local  ident (addr/mask/prot/port): (192.168.90.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (192.168.20.0/255.255.255.0/0/0)
        sa timing: remaining key lifetime (k/sec): (4579323/3507)
        sa timing: remaining key lifetime (k/sec): (4579322/3507)
   local  ident (addr/mask/prot/port): (192.168.90.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (192.168.30.0/255.255.255.0/0/0)
        sa timing: remaining key lifetime (k/sec): (4599999/3350)
        sa timing: remaining key lifetime (k/sec): (4599999/3350)

However I still cannot ping nor RDP from the sonicwall network to the cisco network.

I dont know if I need to add something to my cisco router or something to allow traffic from the say .30 network to the .90 network or something. Can anyone help me please?

pjain2 · ‎10-07-2015

so your requirement is that you are trying to RDP from 192.168.90.0 to 192.168.30.0 network (behind sonicwall)

the crypto acl and the nat exmeption is correct on the router; please make sure that you have a return route from 192.168.30.0 network back to the 192.168.90.0 towards the sonicwall FW.

Boris Uskov · ‎10-08-2015

Hello,

and one more suggestion. Try to ping 192.168.90.1 (Cisco's inside interface) from SonicWall network. If the ping is successful, I believe, you should check, if host firewall on PC in .90 network permits the ICMP and RDP traffic from SonicWall network.

ForsakenZombi · ‎10-08-2015

I was able to resolve by adding the following to the config

access-list 102 permit ip 192.168.90.0 0.0.0.255 192.168.10.0 0.0.0.255