Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

Remote Client Access to Router

I have an 837 (12.4) connected to a DSL provider. The assigned IP address is dynamic. I can access to the router and network behind 837 with the VPN client. While connected with the VPN can not view public hosts (browse the web). From what I can tell, my issue has to do with NAT. My assigned VPN address does not get overloaded with the inside addresses. Any suggestions on how gain internet access while connected with the VPN client. I am not interested in split tunneling.

gwrtr#show running-config

version 12.4

hostname gwrtr

!

boot-start-marker

boot-end-marker

!

logging buffered 12000 debugging

enable secret 5 xxxxxx

!

aaa new-model

!

!

aaa authentication login clientauth local

aaa authorization network groupauthorization local

!

aaa session-id common

clock timezone CST -6

clock summer-time CDT recurring

no ip source-route

no ip dhcp use vrf connected

ip dhcp excluded-address 172.31.255.250 172.31.255.254

!

ip dhcp pool primaryippool

network 172.31.255.240 255.255.255.240

default-router 172.31.255.254

dns-server x.x.x.201 x.x.x.201 x.x.x.1

!

!

ip cef

ip domain name xxxxxx.com

ip name-server x.x.x.201

ip name-server x.x.x.201

!

username xxxxxx password 0 xxxxx

!

!

!

crypto isakmp policy 10

encr 3des

authentication pre-share

group 2

!

crypto isakmp client configuration group xxxxxx

key xxxxxx

dns x.x.x.201 x.x.x.201

pool remoteippool

crypto isakmp profile VPNclient

description VPN Client Profile

match identity group xxxxxx

client authentication list clientauth

isakmp authorization list groupauthorization

client configuration address respond

!

!

crypto ipsec transform-set sha3des esp-3des esp-sha-hmac

!

crypto dynamic-map dynmap 10

set transform-set sha3des

set isakmp-profile VPNclient

!

!

crypto map VPN 10 ipsec-isakmp dynamic dynmap

!

!

!

interface Ethernet0

ip address 172.31.255.254 255.255.255.240

ip access-group eth0in in

ip nat inside

ip virtual-reassembly

ip tcp adjust-mss 1452

no ip mroute-cache

hold-queue 100 out

!

interface ATM0

mtu 1300

no ip address

no ip mroute-cache

atm vc-per-vp 64

no atm ilmi-keepalive

dsl operating-mode auto

hold-queue 224 in

pvc 0/35

pppoe-client dial-pool-number 1

!

!

interface Dialer1

ip address negotiated

ip access-group 111 in

no ip proxy-arp

ip mtu 1492

ip nat outside

ip inspect fwinout out

ip virtual-reassembly

encapsulation ppp

ip tcp adjust-mss 1452

dialer pool 1

dialer remote-name redback

dialer-group 1

ppp authentication pap chap callin

ppp chap hostname xxxxxx

ppp chap password 0 xxxxxx

ppp pap sent-username xxxxxx password 0 xxxxx

ppp ipcp dns request

ppp ipcp wins request

crypto map VPN

!

ip local pool remoteippool 172.31.255.236 172.31.255.239

ip route 0.0.0.0 0.0.0.0 Dialer1

no ip http server

no ip http secure-server

!

ip nat inside source route-map publicpat interface Dialer1 overload

!

!

ip access-list extended eth0in

permit ip 172.31.255.240 0.0.0.15 any

permit ip 172.31.255.232 0.0.0.7 any

permit ip host 0.0.0.0 host 255.255.255.255

deny ip any any log

access-list 102 deny ip 172.31.255.240 0.0.0.15 172.31.255.236 0.0.0.3

access-list 102 deny ip 172.31.255.232 0.0.0.7 172.31.255.240 0.0.0.15

access-list 102 deny ip 172.31.255.236 0.0.0.3 172.31.255.240 0.0.0.15

access-list 102 permit ip 172.31.255.240 0.0.0.15 any

access-list 102 permit ip 172.31.255.236 0.0.0.3 any

access-list 102 permit ip 172.31.255.232 0.0.0.7 any

access-list 111 permit udp any any eq non500-isakmp

access-list 111 permit udp any any eq isakmp

access-list 111 permit esp any any

access-list 111 permit udp any any eq ntp

access-list 111 deny ip any any

access-list 122 deny tcp any any eq telnet

access-list 122 permit ip any any

access-list 172 permit ip 172.31.255.236 0.0.0.3 any

dialer-list 1 protocol ip permit

no cdp run

route-map publicpat permit 10

match ip address 102

!

end

Thanks

1 REPLY

Re: Remote Client Access to Router

119
Views
4
Helpful
1
Replies
CreatePlease to create content