I have a Cisco 877-M with IOS 12.4(11)XJ3, Advanced IP Services and
28MB flash. I have set up the router as an Easy VPN Server. The client
is Cisco VPN Client 4.9.0.1 (0030). The router has a static IP facing the
Internet and a PAT subnet. Cisco VPN client can connect from the
Internet but cannot ping or access any services in the PAT network
(10.1.1.0/24). I have read dozens of examples from Cisco, this site
and many other places. I have tried “old style” crypto maps and newer
VTI/Loopback configurations. The VPN client shows a secured route to
10.1.1.0. Packets to 10.1.1.0 are clearly going through the tunnel but
are not returning. The VPN client indicates that transparent tunneling
is inactive.
I use the same VPN client to access other external VPNs with no
problem. I have tried a different VPN client with the same results.
The obfuscated config is attached. Any help gratefully received.
—
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname router-0-1-1-10
!
boot-start-marker
boot-end-marker
!
security authentication failure rate 3 log
security passwords min-length 6
logging buffered 65535
enable secret 5 xxx
!
aaa new-model
!
!
aaa authentication login default local
aaa authentication login sdm_vpn_xauth_ml_1 local
aaa authorization exec default local
aaa authorization network sdm_vpn_group_ml_1 local
!
!
aaa session-id common
clock timezone Sydney 10
clock summer-time Sydney date Mar 30 2003 3:00 Oct 26 2003 2:00
no ip source-route
ip cef
!
!
no ip dhcp use vrf connected
ip dhcp excluded-address 10.1.1.1 10.1.1.32
!
ip dhcp pool vlan5
network 10.1.1.0 255.255.255.0
default-router 10.1.1.1
dns-server 1.2.3.4 2.3.4.5
domain-name xxx
lease 30
!
!
ip tcp synwait-time 10
no ip bootp server
ip domain name galexia.com
ip name-server 1.2.3.4
ip name-server 2.3.4.5
ip ssh time-out 60
ip ssh authentication-retries 2
ip inspect log drop-pkt
ip inspect tcp finwait-time 10
ip inspect tcp synwait-time 60
ip inspect name SDM_LOW cuseeme
ip inspect name SDM_LOW dns
ip inspect name SDM_LOW ftp
ip inspect name SDM_LOW h323
ip inspect name SDM_LOW https
ip inspect name SDM_LOW icmp
ip inspect name SDM_LOW imap
ip inspect name SDM_LOW pop3
ip inspect name SDM_LOW netshow
ip inspect name SDM_LOW rcmd
ip inspect name SDM_LOW realaudio
ip inspect name SDM_LOW rtsp
ip inspect name SDM_LOW esmtp
ip inspect name SDM_LOW sqlnet
ip inspect name SDM_LOW streamworks
ip inspect name SDM_LOW tftp
ip inspect name SDM_LOW tcp router-traffic
ip inspect name SDM_LOW udp
ip inspect name SDM_LOW vdolive
!
multilink bundle-name authenticated
!
crypto pki trustpoint TP-self-signed-518333447
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-518333447
revocation-check none
rsakeypair TP-self-signed-518333447
!
!
crypto pki certificate chain TP-self-signed-518333447
certificate self-signed 01
…
quit
!
!
username admin privilege 15 view SDM_Administrator password 7 xxx
!
!
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
!
crypto isakmp policy 2
encr aes 256
authentication pre-share
group 2
crypto isakmp keepalive 60 10
crypto isakmp nat keepalive 20
!
crypto isakmp client configuration group staff
key 6 xxx
pool SDM_POOL_1
acl 100
crypto isakmp profile sdm-ike-profile-1
match identity group staff
client authentication list sdm_vpn_xauth_ml_1
isakmp authorization list sdm_vpn_group_ml_1
client configuration address initiate
client configuration address respond
virtual-template 1
!
!
crypto ipsec transform-set ESP-AES256-SHA esp-aes 256 esp-sha-
hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
!
crypto ipsec profile SDM_Profile1
set security-association idle-time 86400
set transform-set ESP-AES256-SHA
set isakmp-profile sdm-ike-profile-1
!
interface Loopback0
description Loop0 to provide unnumbered addressing to
VPN$FW_INSIDE$
ip address 10.1.2.1 255.255.255.0
ip access-group 115 in
!
interface Null0
no ip unreachables
!
interface ATM0
description — ADSL —
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip route-cache flow
no atm ilmi-keepalive
pvc 8/35
tx-ring-limit 3
encapsulation aal5snap
protocol ppp dialer
dialer pool-member 1
!
dsl operating-mode auto
!
interface FastEthernet0
switchport access vlan 5
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface Virtual-Template1 type tunnel
ip unnumbered Loopback0
ip access-group 115 in
ip virtual-reassembly
tunnel mode ipsec ipv4
tunnel protection ipsec profile SDM_Profile1
!
! NAT network
interface Vlan5
description Internal NAT LAN$FW_INSIDE$
ip address 10.1.1.1 255.255.255.0
ip access-group 115 in
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip virtual-reassembly
ip route-cache flow
!
! Obfuscated static Internet address 3.4.5.6
interface Dialer0
description — ADSL —$FW_OUTSIDE$
ip address negotiated
ip access-group 115 in
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip inspect SDM_LOW out
ip virtual-reassembly
encapsulation ppp
no ip route-cache cef
no ip route-cache
no ip mroute-cache
dialer pool 1
dialer-group 1
ppp chap hostname xxx
ppp chap password 7 xxx
!
ip local pool SDM_POOL_1 10.1.3.1 10.1.3.254
ip route 0.0.0.0 0.0.0.0 Dialer0
!
ip flow-top-talkers
top 25
sort-by bytes
!
no ip http server
ip http secure-server
ip nat inside source route-map nonat interface Dialer0 overload
!
logging 10.1.1.4
access-list 20 permit 10.1.1.0 0.0.0.255
access-list 20 deny any log
! Set VPN route to 10.1.1.0 (crypto isakmp client configuration group
staff)
access-list 100 permit ip 10.1.1.0 0.0.0.255 any
! Block VPN traffic from being NATted
access-list 102 deny ip 10.1.1.0 0.0.0.255 10.1.3.0 0.0.0.255
access-list 102 permit ip 10.1.1.0 0.0.0.255 any
! For testing purposes let everything through
access-list 115 permit ip any any
no cdp run
!
route-map nonat permit 10
match ip address 102
!
control-plane
!
line con 0
no modem enable
terminal-type vt100
length 25
stopbits 1
line aux 0
line vty 0 4
access-class 20 in
transport input ssh
!
scheduler max-task-time 5000
scheduler allocate 4000 1000
scheduler interval 500
sntp server 1.2.3.4
end