using Easy VPN Server on Cisco 1801 (Cisco IOS Software, C180X Software (C180X-ADVIPSERVICESK9-M), Version 12.4(6)T, RELEASE SOFTWARE (fc1), tried with 12.4(4)T1 first) and Cisco VPN Client 4.6 I can establish a tunnel and access the router via telnet and SDM but cannot access anything else on the routers side of the network
part of config:
aaa new-model
!
!
aaa authentication login default local
aaa authentication login sdm_vpn_xauth_ml_1 local
aaa authorization exec default local
aaa authorization network sdm_vpn_group_ml_1 local
!
aaa session-id common
!
resource policy
!
no ip source-route
!
!
ip cef
!
!
ip tcp synwait-time 10
no ip bootp server
ip domain name yourdomain.com
ip name-server 24.x.x.x
ip name-server 24.x.x.x
ip ssh time-out 60
ip ssh authentication-retries 2
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
!
crypto isakmp client configuration group test
key test123
dns 24.222.x.x.x.0.5
pool SDM_POOL_1
acl 101
include-local-lan
netmask 255.255.255.0
!
!
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
!
crypto dynamic-map SDM_DYNMAP_1 1
set transform-set ESP-3DES-SHA
reverse-route
!
!
crypto map SDM_CMAP_1 client authentication list sdm_vpn_xauth_ml_1
crypto map SDM_CMAP_1 isakmp authorization list sdm_vpn_group_ml_1
crypto map SDM_CMAP_1 client configuration address respond
crypto map SDM_CMAP_1 65535 ipsec-isakmp dynamic SDM_DYNMAP_1
!
!
interface FastEthernet0
description $ES_WAN$$FW_OUTSIDE$
ip address 24.222.X.X 255.255.255.248
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip virtual-reassembly
ip route-cache flow
duplex auto
speed auto
crypto map SDM_CMAP_1
!
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-FE 1$$ES_LAN$$FW_INSIDE$
ip address 192.168.1.1 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip virtual-reassembly
no ip route-cache cef
ip route-cache flow
ip tcp adjust-mss 1452
!
ip local pool SDM_POOL_1 192.168.1.170 192.168.1.175
ip route 0.0.0.0 0.0.0.0 24.222.X.X (default gateway for ISP)
!
!
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 5 life 86400 requests 10000
ip nat inside source route-map SDM_RMAP_1 interface FastEthernet0 overload
!
logging trap debugging
access-list 1 remark INSIDE_IF=Vlan1
access-list 1 remark SDM_ACL Category=2
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 100 remark SDM_ACL Category=2
access-list 100 deny ip 192.168.1.0 0.0.0.255 host 192.168.1.170
access-list 100 deny ip 192.168.1.0 0.0.0.255 host 192.168.1.171
access-list 100 deny ip 192.168.1.0 0.0.0.255 host 192.168.1.172
access-list 100 deny ip 192.168.1.0 0.0.0.255 host 192.168.1.173
access-list 100 deny ip 192.168.1.0 0.0.0.255 host 192.168.1.174
access-list 100 deny ip 192.168.1.0 0.0.0.255 host 192.168.1.175
access-list 100 deny ip any host 192.168.1.170
access-list 100 deny ip any host 192.168.1.171
access-list 100 deny ip any host 192.168.1.172
access-list 100 deny ip any host 192.168.1.173
access-list 100 deny ip any host 192.168.1.174
access-list 100 deny ip any host 192.168.1.175
access-list 100 permit ip 192.168.1.0 0.0.0.255 any
access-list 101 remark SDM_ACL Category=4
access-list 101 permit ip 192.168.1.0 0.0.0.255 any
no cdp run
!
!
route-map SDM_RMAP_1 permit 1
match ip address 100
!
!
control-plane
!
!
webvpn context Default_context
ssl authenticate verify all
!
no inservice
!
