Ok ,
I have a VPN, NAT configured now I added some ACL and I'm not getting the DHCP to assign IP addresses in the remote client side. I'm sure I'm missing something so tried removing remotein ACL and it works. I would like to implement it with the restrictions in remotein ACL.
Can anyone provide a simple example on how to do it?
Here is my config
R1#sh run
Building configuration...
Current configuration : 5463 bytes
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
logging buffered 51200 warnings
enable secret 5 secret
!
aaa new-model
!
!
aaa authentication login default local
aaa authorization exec default local
!
!
aaa session-id common
!
crypto pki trustpoint TP-self-signed-1597452845
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-1597452845
revocation-check none
rsakeypair TP-self-signed-1597452845
!
!
crypto pki certificate chain TP-self-signed-1597452845
certificate self-signed 01
30820249 308201B2 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 31353937 30353330 3436301E 170D3130 30353038 30333533
32335A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
quit
dot11 syslog
ip source-route
!
!
ip dhcp excluded-address 10.10.10.1 10.10.10.2
!
ip dhcp pool sdm-pool
import all
network 10.10.10.0 255.255.255.248
default-router 10.10.10.1
dns-server 205.214.192.201 205.214.192.201
domain-name 208.67.222.222
netbios-name-server 10.193.12.100
!
!
ip cef
ip domain name yourdomain.com
ip name-server 1.1.1.1
ip name-server 2.2.2.2
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
username admin privilege 15 secret 5 secret
!
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key shared-secret address 200.200.200.1
!
!
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
!
crypto map SDM_CMAP_1 1 ipsec-isakmp
description Tunnel to 200.200.200.1
set peer 200.200.200.1
set transform-set ESP-3DES-SHA
match address 100
!
archive
log config
hidekeys
!
!
!
!
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
description $ETH-WAN$
ip address dhcp client-id FastEthernet4
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
crypto map SDM_CMAP_1
crypto ipsec df-bit clear
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$
ip address 10.10.10.1 255.255.255.248
ip access-group remotein in
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1452
!
ip forward-protocol nd
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
!
ip nat inside source route-map SDM_RMAP_3 interface FastEthernet4 overload
!
ip access-list extended remotein
permit udp any host 10.10.10.1 eq bootps bootpc
permit ip host 10.10.10.2 any
permit ip 10.10.10.0 0.0.0.7 10.193.12.0 0.0.0.255
permit ip 10.10.10.0 0.0.0.7 host 10.10.10.1
permit ip 10.10.10.0 0.0.0.7 host 10.193.15.198
deny ip any any
!
access-list 100 permit ip 10.10.10.0 0.0.0.7 10.193.12.0 0.0.3.255
access-list 101 remark SDM_ACL Category=2
access-list 101 deny ip 10.10.10.0 0.0.0.7 10.193.12.0 0.0.3.255
access-list 101 permit ip 10.10.10.0 0.0.0.7 any
no cdp run
!
!
!
!
route-map SDM_RMAP_1 permit 1
match ip address 101
!
route-map SDM_RMAP_2 permit 1
match ip address 102
!
route-map SDM_RMAP_3 permit 1
match ip address 101
!
!
control-plane
!
banner login ^C
-----------------------------------------------------------------------
Cisco Router and Security Device Manager (SDM) is installed on this device.
This feature requires the one-time use of the username "cisco"
with the password "cisco". The default username and password have a privilege le
vel of 15.
Please change these publicly known initial credentials using SDM or the IOS CLI.
Here are the Cisco IOS commands.
username privilege 15 secret 0
no username cisco
Replace and with the username and password you want to use
.
For more information about SDM please follow the instructions in the QUICK START
GUIDE for your router or go to http://www.cisco.com/go/sdm
-----------------------------------------------------------------------
^C
!
line con 0
no modem enable
line aux 0
line vty 0 4
exec-timeout 0 0
privilege level 15
transport input telnet ssh
!
scheduler max-task-time 5000
end
