Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

cisco 1841 ipsec vpn with loopback NAT not passing traffic

Hi i have a cisco 1841 running LAN on FA0/0 and internet on FA0/1. I run a loopback 1 interface to NAT local traffic via a VPN (VPN will only accept incoming traffic from the paticular loopback IP address.)

 

My problem is that 172.27.0.0 traffic routes over the VPN fine but any traffic to 10.125.0.0 traffic seems to fall in a heap. Below is my config file and ip access-list print out.

config:

-=-=-=-=-=-=-

Building configuration...

Current configuration : 6544 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
no service dhcp
!
hostname apollo-router
!
boot-start-marker
boot-end-marker
!
no logging buffered
!
no aaa new-model
ip cef
!
!
!
!
ip inspect name SDM_LOW cuseeme
ip inspect name SDM_LOW dns
ip inspect name SDM_LOW ftp
ip inspect name SDM_LOW h323
ip inspect name SDM_LOW https
ip inspect name SDM_LOW icmp
ip inspect name SDM_LOW imap
ip inspect name SDM_LOW pop3
ip inspect name SDM_LOW netshow
ip inspect name SDM_LOW rcmd
ip inspect name SDM_LOW realaudio
ip inspect name SDM_LOW rtsp
ip inspect name SDM_LOW esmtp
ip inspect name SDM_LOW sqlnet
ip inspect name SDM_LOW streamworks
ip inspect name SDM_LOW tftp
ip inspect name SDM_LOW tcp
ip inspect name SDM_LOW udp
ip inspect name SDM_LOW vdolive
ip inspect name SDM_LOW pptp
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
!
crypto pki trustpoint TP-self-signed-2465355294
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-2465355294
 revocation-check none
 rsakeypair TP-self-signed-2465355294
!
!
crypto pki certificate chain TP-self-signed-2465355294
 certificate self-signed 01
  quit
username admin privilege 15 secret 5
!
!
!
!
crypto isakmp policy 10
 encr 3des
 hash md5
 authentication pre-share
 group 2
crypto isakmp key <password> address 202.12.184.237
!
!
crypto ipsec transform-set SunriseExchangetrans esp-3des esp-md5-hmac
!
crypto ipsec profile sunriseexchangevpn
 set transform-set SunriseExchangetrans
!
!
crypto map sunriseexchange 10 ipsec-isakmp
 set peer 202.12.184.237
 set transform-set SunriseExchangetrans
 match address sunriserule
!
!
!
interface Loopback1
 ip address 172.29.40.10 255.255.255.255
!
interface FastEthernet0/0
 description $FW_INSIDE$
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 no ip route-cache cef
 no ip route-cache
 duplex auto
 speed auto
 hold-queue 100 out
!
interface FastEthernet0/1
 description $ETH-WAN$$FW_OUTSIDE$
 ip address 115.70.183.94 255.255.255.252
 ip access-group services in
 ip verify unicast reverse-path
 ip nat outside
 ip virtual-reassembly
 no ip route-cache cef
 no ip route-cache
 duplex auto
 speed auto
 crypto map sunriseexchange
 hold-queue 224 in
!
ip forward-protocol nd
ip forward-protocol udp netbios-ss
ip route 0.0.0.0 0.0.0.0 115.70.183.93
!
!
ip http server
ip http authentication local
ip http secure-server
ip nat inside source static tcp 192.168.1.2 1723 interface FastEthernet0/1 1723
ip nat inside source route-map SDM_RMAP_2 interface FastEthernet0/1 overload
ip nat inside source route-map sunriserule interface Loopback1 overload
ip nat inside source static tcp 192.168.1.2 25 115.70.183.94 25 extendable
ip nat inside source static tcp 192.168.1.2 80 115.70.183.94 80 extendable
ip nat inside source static tcp 192.168.1.2 443 115.70.183.94 443 extendable
ip nat inside source static tcp 192.168.1.2 636 115.70.183.94 636 extendable
ip nat inside source static tcp 192.168.1.2 987 115.70.183.94 987 extendable
ip nat inside source static tcp 192.168.1.2 3389 115.70.183.94 3389 extendable
!
ip access-list extended SDM-LOW
 permit gre any any
ip access-list extended services
 remark SDM_ACL Category=17
 permit udp host 202.12.184.237 any eq non500-isakmp
 permit udp host 202.12.184.237 any eq isakmp
 permit esp host 202.12.184.237 any
 permit ahp host 202.12.184.237 any
 permit udp any host 115.70.183.94 eq non500-isakmp
 permit udp any host 115.70.183.94 eq isakmp
 permit esp any host 115.70.183.94
 permit ahp any host 115.70.183.94
 permit udp host 202.12.184.237 host 115.70.183.94 eq non500-isakmp
 permit udp host 202.12.184.237 host 115.70.183.94 eq isakmp
 permit esp host 202.12.184.237 host 115.70.183.94
 permit ahp host 202.12.184.237 host 115.70.183.94
 permit tcp any any eq smtp
 permit tcp any any eq www
 permit tcp any any eq 443
 permit tcp any any eq 987
 permit tcp any any eq 3389
 permit tcp any any eq 636
 permit tcp any any eq 1723
 permit gre any any
 deny   ip 192.168.1.0 0.0.0.255 10.125.0.0 0.0.255.255
 deny   ip 192.168.1.0 0.0.0.255 172.27.1.0 0.0.0.255
 permit ip any any
 permit icmp any any echo-reply
ip access-list extended sunriserule
 permit ip host 127.29.40.10 10.125.0.0 0.0.255.255
 remark sunriserule
 remark SDM_ACL Category=6
 permit ip 192.168.1.0 0.0.0.255 172.27.1.0 0.0.0.255
 permit ip host 172.29.40.10 172.27.1.0 0.0.0.255
 permit ip 192.168.1.0 0.0.0.255 10.125.0.0 0.0.255.255
 permit icmp any any echo-reply
!
access-list 1 remark SDM_ACL Category=2
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 2 remark SDM_ACL Category=16
access-list 2 permit 192.168.1.0 0.0.0.255
access-list 3 remark SDM_ACL Category=2
access-list 3 permit 192.168.1.0 0.0.0.255
!
route-map SDM_RMAP_2 permit 20
 match ip address services
!
route-map sunriserule permit 10
 match ip address sunriserule
!
!
!
control-plane
!
bridge 1 protocol ieee
!
!
line con 0
 password
 login
line aux 0
line vty 0 4
 password
 login
line vty 5 15
 password
 login
!
scheduler allocate 20000 1000
end


-=-=-=-=-=-=-

Ip access-list

apollo-router#sh ip access-list
Standard IP access list 1
    10 permit 192.168.1.0, wildcard bits 0.0.0.255
Standard IP access list 2
    10 permit 192.168.1.0, wildcard bits 0.0.0.255
Standard IP access list 3
    10 permit 192.168.1.0, wildcard bits 0.0.0.255
Extended IP access list SDM-LOW
    10 permit gre any any
Extended IP access list services
    10 permit udp host 202.12.184.237 any eq non500-isakmp
    20 permit udp host 202.12.184.237 any eq isakmp (118 matches)
    30 permit esp host 202.12.184.237 any (3 matches)
    40 permit ahp host 202.12.184.237 any
    50 permit udp any host 115.70.183.94 eq non500-isakmp
    60 permit udp any host 115.70.183.94 eq isakmp
    70 permit esp any host 115.70.183.94
    80 permit ahp any host 115.70.183.94
    90 permit udp host 202.12.184.237 host 115.70.183.94 eq non500-isakmp
    100 permit udp host 202.12.184.237 host 115.70.183.94 eq isakmp
    110 permit esp host 202.12.184.237 host 115.70.183.94
    120 permit ahp host 202.12.184.237 host 115.70.183.94
    130 permit tcp any any eq smtp (107 matches)
    140 permit tcp any any eq www (55 matches)
    150 permit tcp any any eq 443 (345 matches)
    160 permit tcp any any eq 987
    170 permit tcp any any eq 3389 (2036 matches)
    180 permit tcp any any eq 636
    190 permit tcp any any eq 1723 (81 matches)
    200 permit gre any any (164 matches)
    210 deny ip 192.168.1.0 0.0.0.255 10.125.0.0 0.0.255.255 (1 match)
    220 deny ip 192.168.1.0 0.0.0.255 172.27.1.0 0.0.0.255 (1 match)
    230 permit ip any any (2231 matches)
    240 permit icmp any any echo-reply
Extended IP access list sunriserule
    10 permit ip host 127.29.40.10 10.125.0.0 0.0.255.255
    20 permit ip 192.168.1.0 0.0.0.255 172.27.1.0 0.0.0.255 (1 match)
    30 permit ip host 172.29.40.10 172.27.1.0 0.0.0.255 (7 matches)
    40 permit ip 192.168.1.0 0.0.0.255 10.125.0.0 0.0.255.255 (1 match)
    50 permit icmp any any echo-reply (360 matches)

 

You can see everything is getting hit except for 10.125.0.0 in the 'sunriserule' access list. Any susgestions would be great, i've been pulling my hair out. I'd upgrade to the new version of the IOS but the 1841 im using only has the built in 128mb ram so it wont run the new IOS. :(

 

Everyone's tags (1)
228
Views
0
Helpful
0
Replies
CreatePlease login to create content