Hello,
I am trying to get my cisco 871 to connect to my office using IPSEC/GRE VPN. The problem is I’m behind my ISP’s modem which issues dhcp addresses in the 10 network. I have configured the ISP modem to pass my external static IP to the router but I can’t get the VPN to fire… Here’s a stripped down version of the SOHO 871…
!
crypto isakmp policy 1
authentication pre-share
crypto isakmp key [KEY] address [HQ ROUTER]
!
!
crypto ipsec transform-set strong esp-3des esp-md5-hmac
mode transport
!
crypto map vpn 1 ipsec-isakmp
set peer [HQ ROUTER]
set transform-set strong
match address 100
qos pre-classify
!
!
!
interface Tunnel0
ip address 192.168.254.2 255.255.255.252
ip mtu 1440
qos pre-classify
tunnel source FastEthernet4
tunnel destination [HQ ROUTER]
crypto map vpn
!
interface FastEthernet0
no ip address
!
interface FastEthernet1
no ip address
!
interface FastEthernet2
no ip address
!
interface FastEthernet3
no ip address
!
interface FastEthernet4
description $ETH-WAN$
ip address dhcp (gives a 10.x.x.x address)
ip nbar protocol-discovery
ip nat outside
ip virtual-reassembly
service-policy output QoS-Policy
speed 100
full-duplex
auto qos voip trust
no cdp enable
crypto map vpn
!
interface Dot11Radio0
no ip address
shutdown
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
station-role root
no cdp enable
!
interface Vlan1
ip address 192.168.1.1 255.255.255.0
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1200
!
router eigrp 99
network 192.168.1.0
network 192.168.254.0
no auto-summary
!
ip classless
ip route 0.0.0.0 0.0.0.0 dhcp
!
no ip http server
no ip http secure-server
ip nat inside source route-map RMAP1 interface FastEthernet4 overload
!
access-list 2 permit 192.168.253.0 0.0.0.255
access-list 100 remark “Permit GRE”
access-list 100 permit gre host [External STATIC ADDRESS] host [HQ ROUTER]
access-list 101 deny ip 192.168.1.0 0.0.0.255 192.168.0.0 0.0.0.255
access-list 101 deny ip host 192.168.2.1 192.168.0.0 0.0.0.255
access-list 101 deny icmp 192.168.1.0 0.0.0.255 192.168.0.0 0.0.0.255
access-list 101 deny ip 192.168.1.0 0.0.0.255 192.168.253.0 0.0.0.255
access-list 101 permit ip 192.168.1.0 0.0.0.255 any
access-list 110 permit gre host [External STATIC ADDRESS] host [HQ ROUTER]
!
route-map RMAP1 permit 10
match ip address 101
!
!
—————————————-OMITTED———————-
end