05-19-2009 01:19 AM
Hi all,
I want to stablish a vpn between my PC (with VPN Client version 4.8.02.0010) and a remote router (Cisco 2811)with IOS software release 12.4(9)T7 and the following configuration
aaa new-model
!
aaa authentication login VPNCLIENT local
aaa authorization network VPNGROUP local
username test password hello
crypto isakmp policy 3
encr 3des
authentication pre-share
group 2
!
crypto isakmp client configuration group 3000client
key cisco123
dns 62.42.230.24
domain cisco.com
pool ippool
!
crypto ipsec transform-set MYSET esp-3des esp-sha-hmac
!
crypto dynamic-map dynmap 10
set transform-set MYSET
!
crypto map clientmap client authentication list lista
crypto map clientmap isakmp authorization list grupo
crypto map clientmap client configuration address respond
crypto map clientmap 10 ipsec-isakmp dynamic dynmap
!
interface FastEthernet0/0
ip address dhcp
ip nat outside
ip virtual-reassembly
load-interval 30
duplex auto
speed auto
crypto map clientmap
!
interface FastEthernet0/0/0
!
interface FastEthernet0/0/1
!
interface FastEthernet0/0/2
!
interface FastEthernet0/0/3
!
interface Vlan1
ip address 192.168.4.1 255.255.255.0
ip nat inside
ip virtual-reassembly
load-interval 30
!
ip local pool ippool 192.168.4.100 192.168.4.200
no ip classless
ip route 0.0.0.0 0.0.0.0 62.43.195.100
!
ip http server
ip http authentication local
no ip http secure-server
ip http timeout-policy idle 600 life 86400 requests 10000
ip nat inside source list 102 interface FastEthernet0/0 overload
access-list 102 permit ip 192.168.4.0 0.0.0.255 any
!
line con 0
line aux 0
line vty 0 4
privilege level 15
transport input telnet
line vty 5 15
privilege level 15
transport input telnet
!
When I connect to the public IP address of the router every thing is all right and status is Connected. But I don't have connectivity to internet and I can only ping 192.168.4.1 but no others IP adress from this range.
I would appreciate any kind of kelp.
Thanks
Solved! Go to Solution.
05-19-2009 07:05 AM
You need to make sure that your internal traffic going to the VPN client is NOT being NATT'd.
You need to re-write acl 102 to something like:-
access-list 102 deny ip 192.168.4.0 0.0.0.255 192.168.4.0 0.0.0.255
access-list 102 permit ip 192.168.4.0 0.0.0.255 any
HTH>
05-19-2009 02:31 AM
See the below config example tp guide you to your solution:-
HTH>
05-19-2009 06:59 AM
Thank you very much. Now it works!
But I'm trying to connect to a PC via remote desktop and I can't. Could you tell me what do I have to add to the router configuration.
Regards
05-19-2009 07:05 AM
You need to make sure that your internal traffic going to the VPN client is NOT being NATT'd.
You need to re-write acl 102 to something like:-
access-list 102 deny ip 192.168.4.0 0.0.0.255 192.168.4.0 0.0.0.255
access-list 102 permit ip 192.168.4.0 0.0.0.255 any
HTH>
05-19-2009 07:27 AM
Perfect!!! Now I can connect via remote desktop.
Thanks and regards
05-19-2009 07:28 AM
np - glad to help.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide