Hoi ! Ik ben vrij nieuw met Cisco en ik heb een probleem met een VPN oplossing.
Situatie is als volgt :
LAN <--->Router<--->Internet<---->Cisco VPN client.
LAN range is 192.68.251.0 (vreemde range inderdaad maar we hebben nog geen toestemming bij de klant om dat te wijzigen)
VPN Client range is 192.68.254.0
Het probleem is dat er wel een vpn connectie gemaakt kan worden en er kan gepingt worden naar alle netwerken. Er staat wel nadrukkelijk in de access-lists dat icmp ook toegelaten moet worden.
Echter alle andere applicaties of verbindingen tussen een vpn client en een host op het lan kunnen niet gemaakt worden. Of het nou om telnet gaat of ftp. Het maakt niet uit.
Ik heb het internet adres en passwd's gemarkeerd om begrijpelijke reden
Kan iemand iets wijs uit onderstaande config ?
Alvast super bedankt !!
Current configuration : 4716 bytes
!
version 12.2
no parser cache
no service pad
service timestamps debug datetime localtime
service timestamps log datetime localtime
service password-encryption
!
hostname bla
!
aaa new-model
!
!
aaa authentication login userauthen local
aaa authorization network groupauthor local
aaa session-id common
enable secret 5 ....
enable password 7 ....
!
username .... password 7 ....
username .... password 7 ....
ip subnet-zero
ip name-server 195.121.1.34
ip name-server 195.121.1.66
!
ip inspect max-incomplete high 1100
ip inspect one-minute high 1100
ip inspect dns-timeout 10
ip inspect name inside tcp
ip inspect name inside udp
ip ssh time-out 120
ip ssh authentication-retries 3
!
crypto isakmp policy 3
authentication pre-share
group 2
!
crypto isakmp client configuration group ......
key ......
pool ippool
!
!
crypto ipsec transform-set myset esp-des esp-sha-hmac
!
crypto dynamic-map dynmap 10
set transform-set myset
!
!
crypto map clientmap client authentication list userauthen
crypto map clientmap isakmp authorization list groupauthor
crypto map clientmap client configuration address respond
crypto map clientmap 10 ipsec-isakmp dynamic dynmap
!
!
!
!
interface Ethernet0
description Connected_to_LAN
ip address 192.68.251.240 255.255.255.0
ip access-group 101 in
ip nat inside
ip inspect inside in
no cdp enable
hold-queue 100 out
!
interface ATM0
no ip address
no atm ilmi-keepalive
pvc 8/48
encapsulation aal5mux ppp dialer
dialer pool-member 1
!
dsl operating-mode auto
hold-queue 224 in
!
interface Dialer0
ip address negotiated
ip access-group 102 in
ip nat outside
encapsulation ppp
dialer pool 1
dialer-group 1
no cdp enable
ppp authentication pap callin
ppp pap sent-username ....@adsl-.... password 7 ....
ppp ipcp address accept
crypto map clientmap
!
ip local pool ippool 192.68.254.10 192.68.254.20
ip nat inside source list 101 interface Dialer0 overload
ip nat inside source route-map nonat interface Dialer0 overload
ip nat inside source static tcp 192.68.251.240 23 inet.inet.inet.inet 23 extendable
ip nat inside source static tcp 192.68.251.10 1352 inet.inet.inet.inet 1352 extendabl
ip nat inside source static tcp 192.68.251.10 110 inet.inet.inet.inet 110 extendable
ip nat inside source static tcp 192.68.251.10 80 inet.inet.inet.inet 80 extendable
ip nat inside source static tcp 192.68.251.10 25 inet.inet.inet.inet 25 extendable
ip nat inside source static tcp 192.68.251.10 25 inet.inet.inet.inet 1025 extendable
ip classless
ip route 0.0.0.0 0.0.0.0 Dialer0
no ip http server
no ip pim bidir-enable
!
!
access-list 1 permit 192.68.1.0 0.0.0.255
access-list 101 remark Incomming Ethernet0 (LAN)
access-list 101 remark Deny Netbios to Internet
access-list 101 deny udp any any range netbios-ns netbios-ss
access-list 101 deny tcp any any range 137 139
access-list 101 permit ip any any
access-list 102 remark Incomming Ethernet1 (Internet)
access-list 102 remark Permit IP range VPN Client
access-list 102 permit ip 192.68.254.0 0.0.0.255 any log
access-list 102 remark Anti Spoofing
access-list 102 deny ip 127.0.0.0 0.255.255.255 any
access-list 102 deny ip 10.0.0.0 0.255.255.255 any
access-list 102 deny ip 172.16.0.0 0.15.255.255 any
access-list 102 deny ip 192.168.0.0 0.0.255.255 any
access-list 102 deny ip 224.0.0.0 15.255.255.255 any
access-list 102 deny ip host 255.255.255.255 any
access-list 102 deny ip host 0.0.0.0 any
access-list 102 remark Permit all incomming ICMP traffic
access-list 102 permit icmp any any
access-list 102 remark Open the port for the Cisco VPN Client
access-list 102 permit udp any host inet.inet.inet.inet eq isakmp log
access-list 102 permit tcp any host inet.inet.inet.inet eq telnet
access-list 102 permit tcp any host inet.inet.inet.inet eq 1352
access-list 102 permit tcp any host inet.inet.inet.inet eq pop3
access-list 102 permit tcp any host inet.inet.inet.inet eq www
access-list 102 permit tcp any host inet.inet.inet.inet eq 1025
access-list 102 deny ip any any
access-list 120 deny ip 192.68.1.0 0.0.0.255 192.68.254.0 0.0.0.255
access-list 120 permit ip 192.68.1.0 0.0.0.255 any
dialer-list 1 protocol ip list 101
no cdp run
route-map nonat permit 10
match ip address 120
!
!
line con 0
stopbits 1
line vty 0 4
exec-timeout 0 0
password 7 082B43460817
length 0
width 90
!
scheduler max-task-time 5000
end
Situatie is als volgt :
LAN <--->Router<--->Internet<---->Cisco VPN client.
LAN range is 192.68.251.0 (vreemde range inderdaad maar we hebben nog geen toestemming bij de klant om dat te wijzigen)
VPN Client range is 192.68.254.0
Het probleem is dat er wel een vpn connectie gemaakt kan worden en er kan gepingt worden naar alle netwerken. Er staat wel nadrukkelijk in de access-lists dat icmp ook toegelaten moet worden.
Echter alle andere applicaties of verbindingen tussen een vpn client en een host op het lan kunnen niet gemaakt worden. Of het nou om telnet gaat of ftp. Het maakt niet uit.
Ik heb het internet adres en passwd's gemarkeerd om begrijpelijke reden
Kan iemand iets wijs uit onderstaande config ?
Alvast super bedankt !!
Current configuration : 4716 bytes
!
version 12.2
no parser cache
no service pad
service timestamps debug datetime localtime
service timestamps log datetime localtime
service password-encryption
!
hostname bla
!
aaa new-model
!
!
aaa authentication login userauthen local
aaa authorization network groupauthor local
aaa session-id common
enable secret 5 ....
enable password 7 ....
!
username .... password 7 ....
username .... password 7 ....
ip subnet-zero
ip name-server 195.121.1.34
ip name-server 195.121.1.66
!
ip inspect max-incomplete high 1100
ip inspect one-minute high 1100
ip inspect dns-timeout 10
ip inspect name inside tcp
ip inspect name inside udp
ip ssh time-out 120
ip ssh authentication-retries 3
!
crypto isakmp policy 3
authentication pre-share
group 2
!
crypto isakmp client configuration group ......
key ......
pool ippool
!
!
crypto ipsec transform-set myset esp-des esp-sha-hmac
!
crypto dynamic-map dynmap 10
set transform-set myset
!
!
crypto map clientmap client authentication list userauthen
crypto map clientmap isakmp authorization list groupauthor
crypto map clientmap client configuration address respond
crypto map clientmap 10 ipsec-isakmp dynamic dynmap
!
!
!
!
interface Ethernet0
description Connected_to_LAN
ip address 192.68.251.240 255.255.255.0
ip access-group 101 in
ip nat inside
ip inspect inside in
no cdp enable
hold-queue 100 out
!
interface ATM0
no ip address
no atm ilmi-keepalive
pvc 8/48
encapsulation aal5mux ppp dialer
dialer pool-member 1
!
dsl operating-mode auto
hold-queue 224 in
!
interface Dialer0
ip address negotiated
ip access-group 102 in
ip nat outside
encapsulation ppp
dialer pool 1
dialer-group 1
no cdp enable
ppp authentication pap callin
ppp pap sent-username ....@adsl-.... password 7 ....
ppp ipcp address accept
crypto map clientmap
!
ip local pool ippool 192.68.254.10 192.68.254.20
ip nat inside source list 101 interface Dialer0 overload
ip nat inside source route-map nonat interface Dialer0 overload
ip nat inside source static tcp 192.68.251.240 23 inet.inet.inet.inet 23 extendable
ip nat inside source static tcp 192.68.251.10 1352 inet.inet.inet.inet 1352 extendabl
ip nat inside source static tcp 192.68.251.10 110 inet.inet.inet.inet 110 extendable
ip nat inside source static tcp 192.68.251.10 80 inet.inet.inet.inet 80 extendable
ip nat inside source static tcp 192.68.251.10 25 inet.inet.inet.inet 25 extendable
ip nat inside source static tcp 192.68.251.10 25 inet.inet.inet.inet 1025 extendable
ip classless
ip route 0.0.0.0 0.0.0.0 Dialer0
no ip http server
no ip pim bidir-enable
!
!
access-list 1 permit 192.68.1.0 0.0.0.255
access-list 101 remark Incomming Ethernet0 (LAN)
access-list 101 remark Deny Netbios to Internet
access-list 101 deny udp any any range netbios-ns netbios-ss
access-list 101 deny tcp any any range 137 139
access-list 101 permit ip any any
access-list 102 remark Incomming Ethernet1 (Internet)
access-list 102 remark Permit IP range VPN Client
access-list 102 permit ip 192.68.254.0 0.0.0.255 any log
access-list 102 remark Anti Spoofing
access-list 102 deny ip 127.0.0.0 0.255.255.255 any
access-list 102 deny ip 10.0.0.0 0.255.255.255 any
access-list 102 deny ip 172.16.0.0 0.15.255.255 any
access-list 102 deny ip 192.168.0.0 0.0.255.255 any
access-list 102 deny ip 224.0.0.0 15.255.255.255 any
access-list 102 deny ip host 255.255.255.255 any
access-list 102 deny ip host 0.0.0.0 any
access-list 102 remark Permit all incomming ICMP traffic
access-list 102 permit icmp any any
access-list 102 remark Open the port for the Cisco VPN Client
access-list 102 permit udp any host inet.inet.inet.inet eq isakmp log
access-list 102 permit tcp any host inet.inet.inet.inet eq telnet
access-list 102 permit tcp any host inet.inet.inet.inet eq 1352
access-list 102 permit tcp any host inet.inet.inet.inet eq pop3
access-list 102 permit tcp any host inet.inet.inet.inet eq www
access-list 102 permit tcp any host inet.inet.inet.inet eq 1025
access-list 102 deny ip any any
access-list 120 deny ip 192.68.1.0 0.0.0.255 192.68.254.0 0.0.0.255
access-list 120 permit ip 192.68.1.0 0.0.0.255 any
dialer-list 1 protocol ip list 101
no cdp run
route-map nonat permit 10
match ip address 120
!
!
line con 0
stopbits 1
line vty 0 4
exec-timeout 0 0
password 7 082B43460817
length 0
width 90
!
scheduler max-task-time 5000
end