Easy VPN connects but no traffic

cg1network · ‎12-22-2013

I have setup Easy VPN server on a Cisco 887VA router for an iPad and iPhone to connect.

The VPN connects and the client gets an ip address both sides are sending packets but nothing is being recieved at either end.

Here is the config,

version 15.1

no service pad

service tcp-keepalives-in

service tcp-keepalives-out

service timestamps debug datetime msec localtime show-timezone

service timestamps log datetime msec localtime show-timezone

no service password-encryption

service sequence-numbers

!

hostname VDSL-Router

!

boot-start-marker

boot-end-marker

!

no logging buffered

!

aaa new-model

!

aaa authentication login default local

aaa authentication login ciscocp_vpn_xauth_ml_1 local

aaa authentication login ciscocp_vpn_xauth_ml_2 local

aaa authentication login ciscocp_vpn_xauth_ml_3 local

aaa authorization exec default local

aaa authorization network ciscocp_vpn_group_ml_1 local

aaa authorization network ciscocp_vpn_group_ml_2 local

aaa authorization network ciscocp_vpn_group_ml_3 local

aaa authorization network ciscocp_vpn_group_ml_4 local

!

aaa session-id common

!

memory-size iomem 10

crypto pki token default removal timeout 0

!

ip source-route

!

ip cef

no ip bootp server

ip host ***********************************

ip host **********************************

ip name-server 8.8.8.8

ip name-server 8.8.4.4

ip name-server 208.67.222.222

no ipv6 cef

!

multilink bundle-name authenticated

vpdn enable

!

license udi pid CISCO887VA-M-K9 sn FCZ***********

license boot module c880-data level advipservices

!

username ****** privilege 15 secret **********************

!

controller VDSL 0

operating mode vdsl2

!

ip tcp synwait-time 10

!

class-map type inspect match-all SDM_GRE

match access-group name SDM_GRE

class-map type inspect match-any CCP_PPTP

match class-map SDM_GRE

class-map type inspect match-any SDM_AH

match access-group name SDM_AH

class-map type inspect match-any ccp-skinny-inspect

match protocol skinny

class-map match-any hidata

match access-group name hidata

class-map type inspect match-any ccp-cls-insp-traffic

match protocol dns

match protocol ftp

match protocol https

match protocol icmp

match protocol imap

match protocol pop3

match protocol netshow

match protocol shell

match protocol realmedia

match protocol rtsp

match protocol smtp

match protocol sql-net

match protocol streamworks

match protocol tftp

match protocol vdolive

match protocol tcp

match protocol udp

class-map type inspect match-all ccp-insp-traffic

match class-map ccp-cls-insp-traffic

class-map match-any Hi-data

match access-group name hidata

class-map type inspect match-any SDM_IP

match access-group name SDM_IP

class-map type inspect match-any SDM_ESP

match access-group name SDM_ESP

class-map type inspect match-any SDM_EASY_VPN_SERVER_TRAFFIC

match protocol isakmp

match protocol ipsec-msft

match class-map SDM_AH

match class-map SDM_ESP

class-map type inspect match-all SDM_EASY_VPN_SERVER_PT

match class-map SDM_EASY_VPN_SERVER_TRAFFIC

class-map type inspect match-any ccp-h323nxg-inspect

match protocol h323-nxg

class-map type inspect match-any ccp-cls-icmp-access

match protocol icmp

match protocol tcp

match protocol udp

class-map type inspect match-any ccp-h225ras-inspect

match protocol h225ras

class-map type inspect match-any ccp-h323annexe-inspect

match protocol h323-annexe

class-map type inspect match-any vpn

match protocol isakmp

class-map type inspect match-all ccp-cls-ccp-permit-1

match class-map vpn

class-map type inspect match-any ccp-h323-inspect

match protocol h323

class-map type inspect match-all ccp-icmp-access

match class-map ccp-cls-icmp-access

class-map type inspect match-all ccp-invalid-src

match access-group 100

class-map type inspect match-any ccp-sip-inspect

match protocol sip

class-map type inspect match-all ccp-protocol-http

match protocol http

!

policy-map CCP-QoS-Policy-1

policy-map type inspect ccp-permit-icmpreply

class type inspect ccp-icmp-access

inspect

class class-default

pass

policy-map CCP-QoS-Policy-2

class hidata

bandwidth percent 75

class class-default

fair-queue

random-detect

policy-map CCP-QoS-Policy-3

class Hi-data

priority percent 75

class class-default

fair-queue

policy-map sdm-qos-test-123

policy-map type inspect ccp-inspect

class type inspect ccp-invalid-src

drop log

class type inspect ccp-protocol-http

inspect

class type inspect ccp-insp-traffic

inspect

class type inspect ccp-sip-inspect

inspect

class type inspect ccp-h323-inspect

inspect

class type inspect ccp-h323annexe-inspect

inspect

class type inspect ccp-h225ras-inspect

inspect

class type inspect ccp-h323nxg-inspect

inspect

class type inspect ccp-skinny-inspect

inspect

policy-map type inspect ccp-permit

class type inspect ccp-cls-ccp-permit-1

pass

class class-default

drop

policy-map type inspect ccp-pol-outToIn

class type inspect CCP_PPTP

pass

class class-default

drop log

policy-map type inspect sdm-permit-ip

class type inspect SDM_IP

pass

class class-default

drop log

!

zone security in-zone

zone security out-zone

zone security ezvpn-zone

zone-pair security ccp-zp-self-out source self destination out-zone

service-policy type inspect ccp-permit-icmpreply

zone-pair security ccp-zp-in-out source in-zone destination out-zone

service-policy type inspect ccp-inspect

zone-pair security ccp-zp-out-zone-To-in-zone source out-zone destination in-zone

service-policy type inspect ccp-pol-outToIn

zone-pair security ccp-zp-out-self source out-zone destination self

service-policy type inspect ccp-permit

zone-pair security sdm-zp-in-ezvpn1 source in-zone destination ezvpn-zone