IPSEC pass-through on Cisco 857

Answered Question
Aug 6th, 2008
User Badges:

Hello Folks!!


I have adquired reciently a Cisco 857 router. I want to do a VPN site to site.

I have configured the interface ATM0.1 with "ip unnumbered" to VLAN 1. I haven't configured the router to enable NAT or PAT. The VLAN 1 is configured with one Ip public Address of my ISP. Behind the cisco router, I have a Zywall 5, this device is my VPN gateway. Initially, it works fine with other soho router but it blocked often, for this reason, I decided to change this one for a cisco router.


My problem now is that the router cisco doesn't permit the VPN establishment.


Do I need enable IPSEC pass-through?, How can I do this?


Thanks in advance!!

Correct Answer by Farrukh Haroon about 8 years 10 months ago

If you login via console:


logging console 7


If you login via telnet:


logging monitor 7

terminal monitor


Regards


Farrukh

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Farrukh Haroon Wed, 08/06/2008 - 23:10
User Badges:
  • Red, 2250 points or more

Can you provide more details here:


What device is used on the opposite site to terminate the device, Cisco?


NAT Traversal (NAT-T) is turned ON the IOS by default starting with 12.2(13)T.


http://www.cisco.com/en/US/docs/ios/12_2t/12_2t13/feature/guide/ftipsnat.html


If the other side is ASA/PIX/VPNC you need to turn it on.


Regards


Farrukh

Regards


Farrukh

elias.manchon Wed, 08/06/2008 - 23:48
User Badges:

No, my device in opposite side is Zywall 10. I don't want to use NAT on my cisco router. I'm using routing without NAT. I have two addresses IP provided by my ISP, the first is my address gateway, this address is configured on my cisco router, and the second address is my public address IP, this address is configured in the zywall 5. the gateway of my zywall 5 is the interface ethernet of my cisco router. this configuration works fine and I can navigate with explorer. My problem is when I try to establish a tunnel IPSEC.

elias.manchon Wed, 08/06/2008 - 23:52
User Badges:

Other thing. All examples about IPSEC passthrought tha I can see is with NAT/PAT.


My question:


Do I Need enable NAT/PAT on my router to works IPSEC passthrough?

Farrukh Haroon Wed, 08/06/2008 - 23:59
User Badges:
  • Red, 2250 points or more

Oh you mean IPSEC passthrough and not NAT Traversal. Can you give more details about your IP addressing ? Router Internet interface has what IP? Public Private?


Router LAN interface has local IP? Then howcome the device at the back has a public IP?


Regards, Farrukh

elias.manchon Thu, 08/07/2008 - 00:26
User Badges:

Hi Farruh,


I have the next scenary:


LAN -- Zywall -- Cisco 857 -- INTERNET


The Cisco 857 have the next configuration on its interfaces:


Interface ATM:


interface ATM0

no ip address

no atm ilmi-keepalive

dsl operating-mode auto

hold-queue 224 in

!

interface ATM0.1 point-to-point

bandwidth 2016

ip unnumbered Vlan1

pvc 8/32

encapsulation aal5snap

protocol ip inarp


interface VLAN 1


interface Vlan1

ip address XXX.XXX.XXX.XXX 255.255.255.192

hold-queue 100 out


Zywall 5:

WAN Ip Address:

IP: YYY.YYY.YYY.YYY

netmask: 255.255.255.192

Gateway: XXX.XXX.XXX.XXX


YYY.YYY.YYY.YYY and the IP Address XXX.XXX.XXX.XXX are provided my telecom provider.


Thanks in Advance!!


I haven't ACLs by the moment. I suppose that my router is passing all traffic at behind device (Zywall).


Greetings.

Farrukh Haroon Thu, 08/07/2008 - 00:39
User Badges:
  • Red, 2250 points or more

Ok thanks for the detailed post. Its pretty clear now. You had a cheap SOHO DSL Modem, you removed that and are now using your Cisco router to terminate the DSL link. You are right by default there are no ACLs on Cisco router(s). IF there are no ACLs/PAT then there is no need for ESP passthrough. That is required when you are going to the internet via PAT. All LAN users have local IP and they are overloaded/PATTED to outside (wan) interface. In your case your VPN termination device (Zywall 5) has public IP. There is no NAT/PAT or ACL. In simple words VPN should work :)


Perhaps you have some NAT configuration on your router for LAN user to access the Internet? Can you post that?


You are missing something else....

Is it possible to debug on the ZYwall?

Or see the phase 2 packets.encr/decr...


Regards


Farrukh

elias.manchon Thu, 08/07/2008 - 01:15
User Badges:

Thanks four your.


Farrukh, Upload my Cisco setup.


The Log of my Zywall when I try to establish a tunnel IPSEC handly, is the next:

1 2008-08-07 10:01:47 IKE Packet Retransmit IKE

2 2008-08-07 10:01:47 The cookie pair is : ----

3 2008-08-07 10:01:44 IKE Negotiation is in process --- --- IKE

4 2008-08-07 10:01:44 The cookie pair is : ----

5 2008-08-07 10:01:43 Send:[SA][VID][VID][VID] ----

6 2008-08-07 10:01:43 The cookie pair is : ----

7 2008-08-07 10:01:43 Send Main Mode request to [XXX.XXX.XXX.XXX] --- IKE

8 2008-08-07 10:01:43 Rule [VPN] Sending IKE request ---- IKE

9 2008-08-07 10:01:43 The cookie pair is : ----

10 2008-08-07 10:01:40 IKE Packet Retransmit ---- IKE

11 2008-08-07 10:01:40 The cookie pair is : ----

12 2008-08-07 10:01:24 IKE Packet Retransmit ---- IKE

13 2008-08-07 10:01:24 The cookie pair is : ---- IKE

14 2008-08-07 10:01:21 IKE Packet Retransmit ---- IKE

15 2008-08-07 10:01:21 The cookie pair is : ----


However, If I replace my cisco router by the old router, the tunnel is established. Therefore, the problem not is on the zywall, really?.


Thanks



Attachment: 
Farrukh Haroon Thu, 08/07/2008 - 01:46
User Badges:
  • Red, 2250 points or more

Can you ping the Public IP of the other Zywall 10 from your Zywall 5 (not from the router)?


Is the LAN interface IP of the router set as the default gateway of your ZYwall? Can you double check? Can it ping this default gateway?


Regards =


Farrukh

elias.manchon Thu, 08/07/2008 - 02:03
User Badges:

Hi Farrukh,


The problem is resolved. Simply, rebooting the Zywall the problem is resolved. For this things... I love cisco more every day.


This issue, with cisco don't had happened.


Greetings.


Farrukh Haroon Thu, 08/07/2008 - 02:09
User Badges:
  • Red, 2250 points or more

Most probably it had the ARP entry for the old DSL modem (SOHO) :)


Please rate if helpful


Regards


Farrukh

elias.manchon Thu, 08/07/2008 - 02:18
User Badges:

The last Question.


What is the interface where I must put my ACLs to permit the establishment between the two end points, on my router cisco 857?. Initially I have putted this ACL on the VLAN 1 interface, inbound direction.


Greetings.

Farrukh Haroon Thu, 08/07/2008 - 02:19
User Badges:
  • Red, 2250 points or more

This will cover only the 'outbound' traffic.


For inbound traffic (from the internet), apply it on the ATM sub-interface.


Regards


Farrukh

elias.manchon Thu, 08/07/2008 - 02:40
User Badges:

In spite of "Ip unnumbered" of this interface?


Just, I want to control the traffic from internet only.


I have configured the next ACLs, but it not works, anyone can pass traffic from internet through cisco router.


These are my ACLs:


access-list 101 permit ip host xxx.xxx.xxx.xxx any

access-list 101 permit ip host yyy.yyy.yyy.yyy any

access-list 101 permit ip host zzz.zzz.zzz.zzz any

access-list 101 deny ip any any


I have on ATM subinterface:


ip access-group 101 in


Greetings!!

Farrukh Haroon Thu, 08/07/2008 - 03:43
User Badges:
  • Red, 2250 points or more

If you do 'show access-list' (do you see any hits hitcnt = xx at the end of the ACL line?)


Also change the last line to:

access-list 101 deny ip any any log

and see what you get.


Rgards


Farrukh

elias.manchon Thu, 08/07/2008 - 06:02
User Badges:

Hi Farrukh,


Sorry, but where I see the log of rule "access-list 101 deny ip any any log"?


Thanks again.

Correct Answer
Farrukh Haroon Thu, 08/07/2008 - 06:09
User Badges:
  • Red, 2250 points or more

If you login via console:


logging console 7


If you login via telnet:


logging monitor 7

terminal monitor


Regards


Farrukh

Actions

This Discussion