cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
352
Views
5
Helpful
5
Replies

please help vpn client and router

usuario0001
Level 1
Level 1

Hi all,

I want to stablish a vpn between my PC (with VPN Client version 4.8.02.0010) and a remote router (Cisco 2811)with IOS software release 12.4(9)T7 and the following configuration

aaa new-model

!

aaa authentication login VPNCLIENT local

aaa authorization network VPNGROUP local

username test password hello

crypto isakmp policy 3

encr 3des

authentication pre-share

group 2

!

crypto isakmp client configuration group 3000client

key cisco123

dns 62.42.230.24

domain cisco.com

pool ippool

!

crypto ipsec transform-set MYSET esp-3des esp-sha-hmac

!

crypto dynamic-map dynmap 10

set transform-set MYSET

!

crypto map clientmap client authentication list lista

crypto map clientmap isakmp authorization list grupo

crypto map clientmap client configuration address respond

crypto map clientmap 10 ipsec-isakmp dynamic dynmap

!

interface FastEthernet0/0

ip address dhcp

ip nat outside

ip virtual-reassembly

load-interval 30

duplex auto

speed auto

crypto map clientmap

!

interface FastEthernet0/0/0

!

interface FastEthernet0/0/1

!

interface FastEthernet0/0/2

!

interface FastEthernet0/0/3

!

interface Vlan1

ip address 192.168.4.1 255.255.255.0

ip nat inside

ip virtual-reassembly

load-interval 30

!

ip local pool ippool 192.168.4.100 192.168.4.200

no ip classless

ip route 0.0.0.0 0.0.0.0 62.43.195.100

!

ip http server

ip http authentication local

no ip http secure-server

ip http timeout-policy idle 600 life 86400 requests 10000

ip nat inside source list 102 interface FastEthernet0/0 overload

access-list 102 permit ip 192.168.4.0 0.0.0.255 any

!

line con 0

line aux 0

line vty 0 4

privilege level 15

transport input telnet

line vty 5 15

privilege level 15

transport input telnet

!

When I connect to the public IP address of the router every thing is all right and status is Connected. But I don't have connectivity to internet and I can only ping 192.168.4.1 but no others IP adress from this range.

I would appreciate any kind of kelp.

Thanks

1 Accepted Solution

Accepted Solutions

You need to make sure that your internal traffic going to the VPN client is NOT being NATT'd.

You need to re-write acl 102 to something like:-

access-list 102 deny ip 192.168.4.0 0.0.0.255 192.168.4.0 0.0.0.255

access-list 102 permit ip 192.168.4.0 0.0.0.255 any

HTH>

View solution in original post

5 Replies 5

Thank you very much. Now it works!

But I'm trying to connect to a PC via remote desktop and I can't. Could you tell me what do I have to add to the router configuration.

Regards

You need to make sure that your internal traffic going to the VPN client is NOT being NATT'd.

You need to re-write acl 102 to something like:-

access-list 102 deny ip 192.168.4.0 0.0.0.255 192.168.4.0 0.0.0.255

access-list 102 permit ip 192.168.4.0 0.0.0.255 any

HTH>

Perfect!!! Now I can connect via remote desktop.

Thanks and regards

np - glad to help.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: