VPN and NAT on 871

Unanswered Question
Jul 19th, 2007

Hello,

I'm having issues establishing a VPN on a 871 through a NAT.

The 871 goes through an ISP to another router across the internet. It has 4 VLANs configured, and the goal is to VPN one to a network through the internet. Obviously being the internet, the private addresses are all running through a nat on fa 4 (the WAN port on the 871)

In a test setup, I can successfully perform NAT, or the VPN but not both at the same time. The NAT seems to take precedence over the crypto map.

I've tried setting this up with both CLI and SDM, but neither way seems to work. Config below with working VPN but NAT turned off.

hostname Router1

!

resource policy

!

no ip source-route

ip cef

!

no ip domain lookup

!

crypto isakmp policy 1

encr des

authentication pre-share

group 1

!

crypto isakmp key testkey address 172.16.0.3

!

crypto ipsec transform-set VPN1 ah-md5-hmac esp-des

!

crypto map VPN 1 ipsec-isakmp

set peer 172.16.0.3

set transform-set VPN1

set pfs group1

match address 103

!

interface FastEthernet0

switchport mode trunk

!

interface FastEthernet1

!

interface FastEthernet2

!

interface FastEthernet3

!

interface FastEthernet4

description WAN

ip address 172.16.0.254 255.255.255.0

duplex auto

speed auto

crypto map VPN

!

interface Vlan1

description INTERNAL_MGMT

ip address 192.168.1.5 255.255.255.0

!

interface Vlan10

description DATA_AND_VIDEO

ip address 10.31.255.252 255.240.0.0

!

interface Vlan90

description VOIP

ip address 10.32.0.252 255.240.0.0

!

interface Vlan100

description EXT_MGMT

ip address 10.48.0.252 255.240.0.0

!

ip route 0.0.0.0 0.0.0.0 172.16.0.3

!

!

ip http server

ip http authentication local

ip http timeout-policy idle 60 life 86400 requests 10000

!

logging trap debugging

access-list 103 permit ip 10.48.0.0 0.15.255.255 host 203.0.0.1

!

control-plane

!

line con 0

login local

no modem enable

transport output telnet

line aux 0

login local

transport output telnet

line vty 0 4

exec-timeout 0 0

privilege level 15

logging synchronous

login local

!

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
richard-o Thu, 07/19/2007 - 23:21

I finally coaxed SDM into making it work. Of course it worked, after disabling the desired VPN network from being through NAT.

What are my options with these things?

Actions

This Discussion