Hi,
With the scenario in the image, the PC with 172.16.50.1 is windows 7, with windows VPN set up, and the above configuration (by Rizwan Rafeek)
When I try to connect to the router through VPN the follow message appears.
On the router the message is
001002: *Jan 31 18:31:57.609: %CRYPTO-4-IKMP_NO_SA: IKE message from 172.16.50.1 has no SA and is not an initialization offer
I have a w2k8 with NPS configuration to accept connect to VPN. And with the user used no logging appears on security logs.
Can I use the windows configuration to connect via VPN?
If so, what is missing to complete the connection?
If not, what can I do?
Thanks,
António
Hi,
I download the version 5.0.07.0290 Cisco System VPN Client 64bit, and install without firewall.
I configure the F0 of router ISR 1802 with IP address 172.16.50.1/24.
I configure the local interface of my laptop with 172.16.50.200/24 and no gateway (and later more with gateway 172.16.50.1).
The configurations of VPN client are
I suppose that the Group Authentication is the user and password in RADIUS in my w2k8.
And after a one minute the results is this message:
What is missing?
Thank you,
António
Hi,
The follow picture illustrates the scenario.
And with this configuration
no service pad
service timestamps debug datetime msec localtime
service timestamps log datetime msec localtime
service password-encryption
service sequence-numbers
!
hostname MyLab-router
!
boot-start-marker
boot-end-marker
!
logging buffered 16384 debugging
!
username admin privilege 15 password 7
username x1x secret 5
clock summer-time WET recurring last Sun Mar 2:00 last Sun Oct 2:00
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
aaa new-model
!
!
aaa authentication login default local
aaa authentication login VPNclient local
aaa authorization exec default local
aaa authorization network LOCALgroups local
aaa session-id common
ip subnet-zero
!
!
ip cef
ip dhcp excluded-address 192.168.30.1
!
ip dhcp pool DHCP-vlan1
network 192.168.30.0 255.255.255.128
domain-name dados-MyLab.pt
dns-server 192.168.30.126
default-router 192.168.30.1
lease 1 0 1
!
!
ip domain name MyLab.pt
ip ips po max-events 100
login block-for 60 attempts 3 within 15
login on-failure
login on-success
no ftp-server write-enable
!
!
!
spanning-tree portfast bpduguard
archive
log config
logging enable
logging size 1000
!
!
!
crypto isakmp policy 10
encr aes
authentication pre-share
group 2
crypto isakmp keepalive 20 3
!
crypto isakmp client configuration group engineering
key engine123
pool MyPool
!
!
crypto ipsec transform-set ClientTransform esp-aes esp-sha-hmac
!
crypto dynamic-map dyn_map 10
set transform-set ClientTransform
reverse-route
!
!
crypto map MyMap client authentication list VPNclient
crypto map MyMap isakmp authorization list LOCALgroups
crypto map MyMap client configuration address respond
crypto map MyMap 1000 ipsec-isakmp dynamic dyn_map
!
!
!
interface ATM0
no ip address
shutdown
no atm ilmi-keepalive
dsl operating-mode auto
!
interface BRI0
no ip address
shutdown
!
interface FastEthernet0
description Internet Connection
ip address 172.16.50.1 255.255.255.0
no ip unreachables
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
no cdp enable
crypto map MyMap
!
interface FastEthernet1
description Dados+Wifi
switchport access vlan 1
no ip address
!
interface FastEthernet2
no ip address
!
interface FastEthernet3
no ip address
!
interface FastEthernet4
no ip address
!
interface FastEthernet5
no ip address
!
interface FastEthernet6
no ip address
!
interface FastEthernet7
no ip address
!
interface FastEthernet8
description Trunk-Rede Interna
switchport mode trunk
no ip address
!
interface Vlan1
description Local LAN
ip address 192.168.30.1 255.255.255.128
ip nat inside
ip virtual-reassembly
!
ip local pool MyPool 192.168.30.129 192.168.30.158
ip classless
!
ip dns server
!
ip http server
no ip http secure-server
ip nat inside source list PAT_ACL interface FastEthernet0 overload
!
ip access-list extended PAT_ACL
deny ip 192.168.30.0 0.0.0.127 192.168.30.128 0.0.0.31
permit ip 192.168.30.0 0.0.0.127 any
ip access-list extended SPLITEremote
permit ip 192.168.30.0 0.0.0.127 192.168.30.128 0.0.0.31
!
!
!
!
!
control-plane
!
banner motd ^C
*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-
| * \
* MyLab / Portugal | *
| ---------------------------------------------- * |
* Router | *
| Cisco 1802 * |
* ---------------------------------------------- | *
| --- UNAUTHORIZED ACCESS DENIED! --- * |
* --- Entradas nao autorizadas sao punidas por lei --- | *
| * |
*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-* *
\ \ |
*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-
^C
!
line con 0
line aux 0
line vty 0 4
exec-timeout 5 0
password 7
line vty 5 15
exec-timeout 5 0
password 7
!
no scheduler allocate
end
The results it’s the same, as before. Outside of router (through the fastEthernet 0) I cannot connect the VPN, with the configuration of Feb 1, 2012 post (but with different user and subnet mask of course).
What’s missing? Can you help me solve this?
Thnaks,
António
