Hi all,
I have been tasked with setting up remote offices with a VPN connection with the Cisco 871 router. I have configured the 871 as follows:
– Connect to VPN – Successful
– Allow connections via wireless (disabled for now) – Successful
– Allow the 871 to act as a DHCP server to limit addresses given – Successful
– Each remote 871 is given a different address to avoid conflicts – Successful
– Enable SSH for remote access – This is where I run into my problem.
We use DHCP here in our Corp. office as well in remote offices. Our Corp. office uses 192.9.1.x subnet for all servers, switches, etc., and 192.168.101.x and 192.168.102.x for computers, printers.
My problem is I can SSH to any of my remote 871s while on the 192.9.1.x subnet at anytime, but in order for me to SSH into these same devices while on the 101 or 102 subents, I have to do the following:
SSH to the remote 871 while on the 192.9.1.x subnet, perform an extended ping to the default gateway of one of those 2 subnets (101.1 and 102.1) from the BVI1 interface.
Once that ping is successful, I can than close the SSH connection from the 192.9.1.x subnet and connect to it from one of the other subnets (101.x and 102.x).
Also, until the ping from the BVI1 interface is successful to the default gateway of 101.1 and/or 102.1, I am unable to ping the remote 871 from either of those subnets. Only the 192.9.1.x subnet seems to have 24/7 access to ping and SSH.
Here is my config:
!
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname ROCK0
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 debugging
logging console critical
enable secret (Password)
!
aaa new-model
!
!
aaa group server radius rad_eap
server (Radius Server) auth-port 1812 acct-port 1813
!
aaa authentication login eap_methods group rad_eap
!
aaa session-id common
!
resource policy
!
clock timezone PCTime -6
clock summer-time PCTime date Apr 6 2003 2:00 Oct 26 2003 2:00
no ip source-route
ip cef
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.100.1 192.168.100.99
ip dhcp excluded-address 192.168.100.201 192.168.100.254
!
ip dhcp pool ROCK0
import all
network 192.168.100.0 255.255.255.0
dns-server 192.9.1.1
default-router 192.168.100.1
domain-name (Domain name)
!
!
ip inspect name ROCK cuseeme
ip inspect name ROCK ftp
ip inspect name ROCK h323
ip inspect name ROCK icmp
ip inspect name ROCK netshow
ip inspect name ROCK rcmd
ip inspect name ROCK realaudio
ip inspect name ROCK rtsp
ip inspect name ROCK esmtp
ip inspect name ROCK sqlnet
ip inspect name ROCK streamworks
ip inspect name ROCK tftp
ip inspect name ROCK tcp
ip inspect name ROCK udp
ip inspect name ROCK vdolive
ip tcp synwait-time 10
no ip bootp server
no ip domain lookup
ip domain name (Domain Name)
ip name-server 192.9.1.1
ip ssh time-out 60
ip ssh authentication-retries 2
!
!
crypto pki trustpoint TP-self-signed-(CERT Info)
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-(CERT Info)
revocation-check none
rsakeypair TP-self-signed-(CERT Info)
!
!
crypto pki certificate chain TP-self-signed-(CERT Info)
certificate self-signed 01
(Certificate Info)
quit
username admin privilege 15 secret (Password)
!
!
!
crypto isakmp policy 1
encr aes 256
authentication pre-share
group 5
crypto isakmp key beach address (Firewall Public IP)
crypto isakmp identity hostname
!
!
crypto ipsec transform-set GLDD esp-aes 256 esp-sha-hmac
!
crypto ipsec profile GLDD
set transform-set GLDD
!
!
crypto map VPN_TO_GLDD 1 ipsec-isakmp
description Tunnel to(Firewall Public IP)
set peer (Firewall Public IP)
set transform-set GLDD
match address 106
!
bridge irb
!
!
interface FastEthernet0
no cdp enable
!
interface FastEthernet1
no cdp enable
!
interface FastEthernet2
shutdown
no cdp enable
!
interface FastEthernet3
shutdown
no cdp enable
!
interface FastEthernet4
description $ES_WAN$$FW_OUTSIDE$
ip address (Device Public IP address and mask)
ip access-group 104 in
ip verify unicast reverse-path
no ip redirects
no ip unreachables
no ip proxy-arp
ip inspect ROCK out
ip nat outside
ip virtual-reassembly
ip route-cache flow
duplex auto
speed auto
no cdp enable
crypto map VPN_TO_GLDD
!
interface Dot11Radio0
no ip address
shutdown
!
encryption vlan 1 mode wep mandatory
!
ssid (ssid name)
vlan 1
authentication open eap eap_methods
authentication network-eap eap_methods
!
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
station-role root
no dot11 extension aironet
no cdp enable
!
interface Dot11Radio0.1
encapsulation dot1Q 1 native
no snmp trap link-status
no cdp enable
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$FW_INSIDE$
no ip address
ip tcp adjust-mss 1452
bridge-group 1
!
interface BVI1
description $ES_LAN$$FW_INSIDE$
ip address 192.168.100.1 255.255.255.0
ip access-group 100 in
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1452
!
ip route 0.0.0.0 0.0.0.0 (DSL Provider Default Gateway)
!
no ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 5 life 86400 requests 10000
ip nat inside source route-map SDM_RMAP_1 interface FastEthernet4 overload
!
ip radius source-interface BVI1
logging trap debugging
access-list 1 remark INSIDE_IF=BVI1
access-list 1 remark SDM_ACL Category=2
access-list 1 permit 192.168.100.0 0.0.0.255
access-list 100 remark *****************************************
access-list 100 remark ** IP ACL Applied to BVI1 **
access-list 100 remark ** edited by SPH on 5/30/06 **
access-list 100 remark *****************************************
access-list 100 permit udp any eq bootpc any eq bootps
access-list 100 permit ip 192.168.100.0 0.0.0.255 host 192.168.100.1
access-list 100 permit ip 192.168.100.0 0.0.0.255 192.9.1.0 0.0.0.255
access-list 100 permit ip 192.168.100.0 0.0.0.255 192.168.101.0 0.0.0.255
access-list 100 permit ip 192.168.100.0 0.0.0.255 192.168.102.0 0.0.0.255
access-list 100 deny ip any any
access-list 103 remark *****************************************
access-list 103 remark ** IP ACL Applied to RMAP **
access-list 103 remark ** edited by SPH on 5/18/06 **
access-list 103 remark *****************************************
access-list 103 deny ip 192.168.100.0 0.0.0.255 192.9.1.0 0.0.0.255
access-list 103 deny ip 192.168.100.0 0.0.0.255 192.168.101.0 0.0.0.255
access-list 103 deny ip 192.168.100.0 0.0.0.255 192.168.102.0 0.0.0.255
access-list 103 permit ip 192.168.100.0 0.0.0.255 any
access-list 104 remark *****************************************
access-list 104 remark ** IP ACL Applied to FE4 (WAN) **
access-list 104 remark ** edited by SPH on 5/18/06 **
access-list 104 remark *****************************************
access-list 104 permit udp host (Radius Server) eq 1812 host (Device IP Address)
access-list 104 permit udp host (Radius Server) eq 1813 host (Device IP Address)
access-list 104 permit udp host 192.9.1.1 eq domain any
access-list 104 remark **********IPSec Rule*********************
access-list 104 permit ip 192.9.1.0 0.0.0.255 192.168.100.0 0.0.0.255
access-list 104 permit ip 192.168.101.0 0.0.0.255 192.168.100.0 0.0.0.255
access-list 104 permit ip 192.168.102.0 0.0.0.255 192.168.100.0 0.0.0.255
access-list 104 permit udp host (Firewall Public IP Address) host (Device IP Address) eq non500-isakmp
access-list 104 permit udp host (Firewall Public IP Address) host (Device IP Address) eq isakmp
access-list 104 permit esp host (Firewall Public IP Address) host (Device IP Address)
access-list 104 permit ahp host (Firewall Public IP Address) host (Device IP Address)
access-list 104 deny ip 192.168.100.0 0.0.0.255 any
access-list 104 permit icmp any host (Device IP Address) echo-reply
access-list 104 permit icmp any host (Device IP Address) time-exceeded
access-list 104 permit icmp any host (Device IP Address) unreachable
access-list 104 deny ip 10.0.0.0 0.255.255.255 any
access-list 104 deny ip 172.16.0.0 0.15.255.255 any
access-list 104 deny ip 192.168.0.0 0.0.255.255 any
access-list 104 deny ip 127.0.0.0 0.255.255.255 any
access-list 104 deny ip host 255.255.255.255 any
access-list 104 deny ip host 0.0.0.0 any
access-list 104 deny ip any any log
access-list 106 remark *****************************************
access-list 106 remark ** IP ACL Applied to **
access-list 106 remark ** Crypto Map: VPN_TO_GLDD **
access-list 106 remark ** edited by SPH on 5/18/06 **
access-list 106 remark *****************************************
access-list 106 permit ip 192.168.100.0 0.0.0.255 192.9.1.0 0.0.0.255
access-list 106 permit ip 192.168.100.0 0.0.0.255 192.168.101.0 0.0.0.255
access-list 106 permit ip 192.168.100.0 0.0.0.255 192.168.102.0 0.0.0.255
no cdp run
!
!
route-map SDM_RMAP_1 permit 1
match ip address 103
!
radius-server attribute 32 include-in-access-req format %h
radius-server host (Radius Server) auth-port 1812 acct-port 1813 key 7 (Radius Key)
radius-server vsa send accounting
!
control-plane
!
bridge 1 protocol ieee
bridge 1 route ip
banner login Authorized access only! Disconnect IMMEDIATELY if you are not an authorized user!
!
line con 0
no modem enable
transport output all
speed 115200
line aux 0
transport output all
line vty 0 4
privilege level 15
transport input telnet ssh
transport output all
!
scheduler max-task-time 5000
!
webvpn context Default_context
ssl authenticate verify all
!
no inservice
!
end
ANY help would be greatly appreciated!!
Thanks!