I configured a 1721 router to act an ADSL router that acted as an IOS firewall to only allow in SMTP to a mail-server on the inside. The cuatomer then required it to terminate a VPN client that would allow him to remote-desktop to his server. I wrote the additional configuration to allow a VPN client to connect, but it cannot ping the server. I have tried a few things like removing the previously written access-list 100 on the outside and the ip inspect command from the ethernet interface but I still cannot ping the server. The server has its default gateway set to the router. The configuration is listed below, please have a look and tell me if I am missing something.
hostname router
!
enable secret big-secret
enable password xxxx
username xxxx password xxxx
aaa new-model
!
!
aaa authentication login userlist local
aaa authorization network vpngroup local
aaa session-id common
ip subnet-zero
!
!
!
ip inspect name ethernetin cuseeme timeout 3600
ip inspect name ethernetin ftp timeout 3600
ip inspect name ethernetin h323 timeout 3600
ip inspect name ethernetin http timeout 3600
ip inspect name ethernetin rcmd timeout 3600
ip inspect name ethernetin realaudio timeout 3600
ip inspect name ethernetin smtp timeout 3600
ip inspect name ethernetin sqlnet timeout 3600
ip inspect name ethernetin streamworks timeout 3600
ip inspect name ethernetin tcp timeout 3600
ip inspect name ethernetin tftp timeout 30
ip inspect name ethernetin udp timeout 15
ip inspect name ethernetin vdolive timeout 3600
ip audit notify log
ip audit po max-events 100
!
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp client configuration address-pool local localpool
crypto isakmp xauth timeout 60
!
crypto isakmp client configuration group vpngroup
key 1bellshill2
pool localpool
acl 160
!
!
crypto ipsec transform-set motherwell esp-3des esp-sha-hmac
!
crypto dynamic-map motherwell 1
set transform-set motherwell
!
!
crypto map motherwell client authentication list userlist
crypto map motherwell isakmp authorization list vpngroup
crypto map motherwell client configuration address respond
crypto map motherwell 1 ipsec-isakmp dynamic motherwell
!
!
!
!
interface ATM0
no ip address
no atm ilmi-keepalive
pvc 0/38
encapsulation aal5mux ppp dialer
dialer pool-member 1
!
dsl operating-mode itu-dmt
!
interface FastEthernet0
ip address 192.168.0.222 255.255.255.0
ip nat inside
speed auto
!
interface Dialer0
ip address negotiated
ip nat outside
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication chap callin
ppp chap hostname secret-hostname
ppp chap password secret-password
crypto map motherwell
!
ip local pool localpool 172.16.1.1 172.16.1.100
ip nat translation timeout 180
ip nat inside source route-map nonat interface Dialer0 overload
ip nat inside source static tcp 192.168.0.3 25 aaa.bbb.ccc.ddd 25 extendable
ip classless
ip route 0.0.0.0 0.0.0.0 Dialer0
no ip http server
!
!
access-list 1 permit 192.168.0.0 0.0.0.255
access-list 100 permit tcp any host aaa.bbb.ccc.ddd eq smtp
access-list 100 permit udp any any eq isakmp
access-list 105 deny ip 192.168.0.0 0.0.0.255 172.16.1.0 0.0.0.255
access-list 105 permit ip 192.168.0.0 0.0.0.255 any
access-list 160 permit ip 192.168.0.0 0.0.0.255 172.16.1.0 0.0.0.255
dialer-list 1 protocol ip permit
!
route-map nonat permit 10
match ip address 105
!
Thanks in advance
Steve.
