Hello,
i have here a Cisco 1721 in a test environment.
A 172.16.0.0/19 net simulates the Internet and a 192.168.1.0/24 net simulates the Net, the VPN tunnel should go to (intranet).
The 172.16.0.0 net hangs on router's FastEthernet 0, the (VPN)Intranet hangs on Ethernet 0.
The configuration was inspired form the Configuration example
"Configuring Cisco VPN Client 3.x for Windows to IOS Using Local Extended Authentication"
and the ConfigMaker's configuration output.
Authentication and logon works. Client gets an IP from pool. But there is a routing problem
on routers side. Ping from client side - dont work (In VPN client statistics the encrypt packets count up, but no decrypt).
Ping from router dont work too, but decrypt and encrypt packets in VPN client's statistics counts up
(the client has a correct route and returns ICMP packets to router).
The questions is now:
How to route packets between the Tunnel and an Ethernet (Ethernet 0) device ?
router's conf is attached - hope that's not too much ...
thanks && regards
Thomas Schmidt
-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.- snipp .-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.
!
version 12.2
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
!
hostname **moderator edit**
!
enable secret 5 **moderator edit**
!
!
aaa new-model
aaa authentication login userauthen local
aaa authorization network groupauthor local
!
! only for test ...
!
username cisco password 0 **moderator edit**
!
ip subnet-zero
!
ip audit notify log
ip audit po max-events 100
!
crypto isakmp policy 3
encryption 3des
authentication pre-share
group 2
!
crypto isakmp client configuration group 3000client
key cisco123
pool ippool
!
! we dont want to split tunnel
! acl 108
!
crypto ipsec transform-set myset esp-3des esp-sha-hmac
!
crypto dynamic-map dynmap 10
set transform-set myset
!
crypto map clientmap client authentication list userauthen
crypto map clientmap isakmp authorization list groupauthor
crypto map clientmap client configuration address respond
crypto map clientmap 10 ipsec-isakmp dynamic dynmap
!
interface Ethernet0
no shutdown
description connected to VPN
ip address 192.168.1.1 255.255.255.0
full-duplex
ip access-group 101 in
ip access-group 101 out
keepalive 10
no cdp enable
!
interface Ethernet1
no shutdown
ip address 192.168.3.1 255.255.255.0
ip access-group 101 in
ip access-group 101 out
full-duplex
keepalive 10
no cdp enable
!
interface FastEthernet0
no shutdown
description connected to Internet
ip address 172.16.12.20 255.255.224.0
speed auto
keepalive 10
no cdp enable
!
! this access group is also only for test case !!!!
!
no access-list 101
access-list 101 permit ip any any
!
ip local pool ippool 192.168.10.1 192.168.10.10
ip classless
ip route 0.0.0.0 0.0.0.0 172.16.12.20
ip pim bidir-enable
!
line con 0
exec-timeout 0 0
password 7 **moderator edit**
line aux 0
line vty 0 4
!
end
^-^-^-^-^-^-^-^-^-^-^-^-^- snapp ^-^-^-^-^-^-^-^-^-^-^-^-^-^-
