I'm having no luck establishing a VPn between my two 827s. I think it may be due to access-list definations. I had VPN up once, then tried to narrow it down for security. Anyone out there willing to help?
Router A is at 192.168.0.1 Router B is at 192.168.1.1
Here are the configs:
Router A #sh run
ena
Password:
Router A #sh run
Building configuration...
Current configuration : 2730 bytes
!
version 12.2
no parser cache
no service pad
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname Router A
!
logging buffered 4096 debugging
enable secret xxxxxx.
!
username xxxxxxxx
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
ip subnet-zero
no ip source-route
no ip domain-lookup
no ip dhcp conflict logging
ip dhcp excluded-address 192.168.0.1 192.168.0.10
!
vpdn enable
!
vpdn-group 2
! Default PPTP VPDN group
accept-dialin
protocol pptp
virtual-template 2
!
vpdn-group pppoe
request-dialin
protocol pppoe
!
!
crypto isakmp policy 10
hash md5
authentication pre-share
group 2
crypto isakmp key xxxxxx b router
!
!
crypto ipsec transform-set strong-des esp-des esp-md5-hmac
!
crypto map mymap 10 ipsec-isakmp
set peer xxxxx B router
set transform-set strong-des
match address 120
!
!
!
!
interface Tunnel0
no ip address
!
interface Ethernet0
ip address 192.168.0.1 255.255.255.0
ip mtu 1492
ip nat inside
no ip route-cache
ip tcp adjust-mss 1452
no ip mroute-cache
hold-queue 32 in
hold-queue 100 out
!
interface Virtual-Template1
no ip address
!
interface Virtual-Template2
ip unnumbered Dialer1
ip helper-address 192.168.0.255
peer default ip address pool vpnpool
ppp authentication ms-chap
!
interface ATM0
no ip address
no ip route-cache
no ip mroute-cache
atm ilmi-keepalive
pvc 0/16
pppoe-client dial-pool-number 1
!
pvc 8/35
broadcast
pppoe-client dial-pool-number 1
!
bundle-enable
dsl operating-mode auto
hold-queue 224 in
!
interface Dialer1
mtu 1492
ip address xxxxxx A router
ip nat outside
encapsulation ppp
no ip route-cache
ip tcp adjust-mss 1452
no ip mroute-cache
dialer pool 1
dialer idle-timeout 0
dialer hold-queue 1
no cdp enable
ppp authentication chap callin
ppp chap hostname xxxxxxxx
ppp chap password xxxxx
ppp pap sent-username xxxxxxxx
ppp ipcp dns request
crypto map mymap
!
ip local pool vpnpool 192.168.30.20 192.168.30.100
ip nat inside source route-map nonat interface Dialer1 overload
ip classless
ip route 0.0.0.0 0.0.0.0 Dialer1
ip http server
ip pim bidir-enable
!
!
access-list 1 permit 192.168.0.0 0.0.0.255
access-list 120 permit ip 192.168.0.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 120 permit tcp 192.168.0.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 130 permit ip 192.168.0.0 0.0.0.255 any
access-list 130 deny ip host 192.168.0.0 192.168.1.0 0.0.0.255
!
route-map nonat permit 10
match ip address 130
!
!
line con 0
stopbits 1
line vty 0 4
password xxxxx
login
!
scheduler max-task-time 5000
end
The next router "B"
router b #sh run
Building configuration...
Current configuration : 3313 bytes
!
version 12.2
no parser cache
no service pad
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname router b
!
logging buffered 4096 debugging
enable secret XXXXXXXXXXXXXXXxxx
!
username xxxxxx
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
ip subnet-zero
no ip source-route
no ip domain-lookup
no ip dhcp conflict logging
ip dhcp excluded-address 192.168.1.1 192.168.1.10
ip dhcp excluded-address 192.168.1.200 192.168.1.250
!
ip dhcp pool 1
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1
dns-server 205.152.26.252 205.152.37.254
netbios-name-server 192.168.1.1
netbios-node-type h-node
!
ip dhcp pool 2
default-router 192.168.1.1
dns-server 205.152.26.252 205.152.37.254
netbios-name-server 192.168.1.1
netbios-node-type h-node
!
vpdn enable
!
vpdn-group 2
! Default PPTP VPDN group
accept-dialin
protocol pptp
virtual-template 2
!
vpdn-group pppoe
request-dialin
protocol pppoe
!
!
crypto isakmp policy 10
hash md5
authentication pre-share
group 2
crypto isakmp key wt address xxxx a router
!
!
crypto ipsec transform-set strong-des esp-des esp-md5-hmac
!
crypto map mymap 10 ipsec-isakmp
set peer xxxxxx A router
set transform-set strong-des
match address 120
!
!
!
!
interface Ethernet0
ip address 192.168.1.1 255.255.255.0
ip mtu 1492
ip nat inside
no ip route-cache
ip tcp adjust-mss 1452
no ip mroute-cache
hold-queue 32 in
hold-queue 100 out
!
interface Virtual-Template1
no ip address
!
interface Virtual-Template2
ip unnumbered Dialer1
ip helper-address 192.168.0.255
peer default ip address pool vpnpool
ppp authentication ms-chap
!
interface ATM0
no ip address
no ip route-cache
no ip mroute-cache
atm ilmi-keepalive
pvc 0/16
oam-pvc 0
pppoe-client dial-pool-number 1
!
pvc 8/35
broadcast
oam-pvc 0
pppoe-client dial-pool-number 1
!
bundle-enable
dsl operating-mode auto
hold-queue 224 in
!
interface Dialer1
mtu 1492
ip address ip#xxxxxxx b router
ip nat outside
encapsulation ppp
no ip route-cache
ip tcp adjust-mss 1452
no ip mroute-cache
dialer pool 1
dialer idle-timeout 0
dialer hold-queue 1
no cdp enable
ppp authentication chap callin
ppp chap hostname xxxxxxxxxxxxxxx
ppp chap password xxxxxxxxxxxxxxx
ppp pap sent-username xxxxxxxxxxxxxxxxxx
ppp ipcp dns request
crypto map mymap
!
interface Dialer12
no ip address
!
ip local pool vpnpool 192.168.100.20 192.168.100.100
ip nat inside source route-map nonat interface Dialer1 overload
ip classless
ip route 0.0.0.0 0.0.0.0 Dialer1
ip http server
ip pim bidir-enable
!
!
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 120 permit ip 192.168.1.0 0.0.0.255 192.168.0.0 0.0.0.255
access-list 120 permit tcp 192.168.1.0 0.0.0.255 192.168.0.0 0.0.0.255
access-list 130 deny ip host 192.168.1.0 192.168.0.0 0.0.0.255
access-list 130 permit ip 192.168.1.0 0.0.0.255 any
access-list 130 permit ip host ip "b" host ip# "a"
access-list 130 permit ahp host ip# "b" host ip# "a"
!
route-map nonat permit 10
match ip address 130
!
!
line con 0
stopbits 1
line vty 0 4
exec-timeout 120 0
password xxxxxxxxxxxxxxxx
login
length 0
!
scheduler max-task-time 5000
end
