Second Site-to-Site VPN on 881 router

Psalms101Man · ‎12-09-2013

Having issues with a router that I took over management of from another tech who liked to use SDM to make his config files. Here is what I am trying to accomplish:

The VPN parameters are as follows:

Peer IP: 174.XXX.XXX.1

Remote Network: 174.XXX.XXX.16/28

IPSec Phase 1

Hashing: SHA1

Authentication: PSK (I'll relay this over the phone)

Group: DH Group 2

Lifetime: 86,400 seconds

Encryption: AES-256

Mode: Main

IPSec Phase 2

Hashing: SHA1

Encryption: AES-256

Lifetime: 28,800 seconds, 4,608,000 kilobytes

PFS: Group 2

Additional network configuration

Client traffic:

Clients at your site would ideally be NAT'd to your peer IP, but we can work out an alternative if this is not feasible.

SuccessEHS>NAS/file share traffic:

The peer IP (or substitute) will need TCP ports 137, 139, and 445, and UDP ports 137 and 138 forwarded to your file share/NAS IP.

Here is the current config:

!

! Last configuration change at 11:44:57 PCTime Fri Nov 15 2013 by mhcnetadmin

version 15.1

no service pad

service tcp-keepalives-in

service tcp-keepalives-out

service timestamps debug datetime msec localtime show-timezone

service timestamps log datetime msec localtime show-timezone

service password-encryption

service sequence-numbers

!

hostname mhc-mccloud-881w

!

boot-start-marker

boot-end-marker

!

logging buffered 51200

logging console critical

enable secret 4 vT1FrQfvI1nAc7a8EtFNInJZAS.QKGsv5RLzMpaQSUA

!

no aaa new-model

memory-size iomem 10

clock timezone PCTime -8 0

clock summer-time PDT recurring

crypto pki token default removal timeout 0

!

crypto pki trustpoint TP-self-signed-3594840092

enrollment selfsigned

subject-name cn=IOS-Self-Signed-Certificate-3594840092

revocation-check none

rsakeypair TP-self-signed-3594840092

!

crypto pki certificate chain TP-self-signed-3594840092

certificate self-signed 01

{Cert Removed}

quit

no ip source-route

!

ip cef

no ip bootp server

ip domain name yrekacpas.local

ip name-server 192.168.10.10

ip name-server 8.8.8.8

ip port-map user-RWW port tcp 987

ip port-map user-RDP port tcp 3389

no ipv6 cef

!

license udi pid CISCO881W-GN-A-K9 sn FTX163987LN

!

username mhcnetadmin privilege 15 secret 4 vT1FrQfvI1nAc7a8EtFNInJZAS.QKGsv5RLzMpaQSUA

!

ip tcp synwait-time 10

ip ssh time-out 60

ip ssh authentication-retries 2

!

class-map type inspect match-any SDM_BOOTPC

match access-group name SDM_BOOTPC

class-map type inspect match-all sdm-nat-ldap-1

match access-group 104

match protocol ldap

class-map type inspect match-all sdm-nat-smtp-1

match access-group 101

match protocol smtp

class-map type inspect match-any SDM_DHCP_CLIENT_PT

match class-map SDM_BOOTPC

class-map type inspect match-any SDM_SHELL

match access-group name SDM_SHELL

class-map type inspect match-any SDM_SSH

match access-group name SDM_SSH

class-map type inspect match-any SDM_HTTPS

match access-group name SDM_HTTPS

class-map type inspect match-any sdm-mgmt-cls-0

match class-map SDM_SHELL

match class-map SDM_SSH

match class-map SDM_HTTPS

class-map type inspect match-any SDM_AH

match access-group name SDM_AH

class-map type inspect match-any sdm-cls-bootps

match protocol bootps

class-map type inspect match-any ccp-cls-insp-traffic

match protocol dns

match protocol ftp

match protocol h323

match protocol https

match protocol icmp

match protocol imap

match protocol pop3

match protocol shell

match protocol realmedia

match protocol rtsp

match protocol smtp

match protocol sql-net

match protocol streamworks

match protocol tftp

match protocol vdolive

match protocol tcp

match protocol udp

class-map type inspect match-all ccp-insp-traffic

match class-map ccp-cls-insp-traffic

class-map type inspect match-any SDM_ESP

match access-group name SDM_ESP

class-map type inspect match-any SDM_EASY_VPN_SERVER_TRAFFIC

match protocol isakmp

match protocol ipsec-msft

match class-map SDM_AH

match class-map SDM_ESP

class-map type inspect match-all SDM_EASY_VPN_SERVER_PT

match class-map SDM_EASY_VPN_SERVER_TRAFFIC

class-map type inspect match-any ccp-cls-icmp-access

match protocol icmp

match protocol tcp

match protocol udp

class-map type inspect match-all ccp-icmp-access

match class-map ccp-cls-icmp-access

class-map type inspect match-all ccp-invalid-src

match access-group 100

class-map type inspect match-all sdm-nat-user-RDP-1

match access-group 105

match protocol user-RDP

class-map type inspect match-all sdm-mgmt-cls-ccp-permit-6