03-29-2020 01:14 PM
Hi everyone, I generated a Remote Vpn with ISR897va:
- I can connect the external client;
- I can ping from external to router and from router to client connected to the vpn tunnel;
- I cannot ping between internal client and external client;
- Also when I connect the vpn client loses internet connection.
Thank you all
03-29-2020 01:33 PM
03-29-2020 02:34 PM
03-29-2020 02:44 PM
03-30-2020 01:50 PM
03-31-2020 12:28 AM
Hi,
1. Use the following config for NAT:
object-group network vpn_pool
192.168.100.0 255.255.255.0
!
ip access-list extended nat-list
no permit ip object-group local_lan_subnets any
deny ip object-group local_lan_subnets object-group vpn_pool
permit ip object-group local_lan_subnets any
2. Temporarily remove your ZBFW configuration (just remove "zone-member" commands from the interface. Also, your ZBFW policy doesn't really make sense, as within your first class-map you're already inspecting everything, based on the used ACL. Anyways, this is a further discussion, once NAT is fixed. Usually, a simple ZBFW policy would mean that you inspect all TCP, UDP and ICMP from LAN-->WAN, and restrict it the other way around, from WAN-->LAN.
Regards,
Cristian Matei.
03-31-2020 06:42 AM
03-31-2020 06:48 AM
Hi, I have now found the error, it was missing:
permit ip object-group vpn_remote_subnets any
Thanks for everything.
A greeting
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide