I have a Cisco 871 at a small office. The router is up and functional. The users want to VPN in and use the internet. I have configured the easyvpn server on the router but I am having some strange connection issues. I am able to VPN in to the router, I can ping all the devices on the local LAN, and the split tunneling is even working, as I can browse the internet while connected. However, I am unable to connect to any device on the local LAN. Specifically, I am trying to RDP to several devices. I have verified RDP is open. What am I doing wrong?
My config below...
Device-Name]#sh run
Building configuration...
Current configuration : 8075 bytes
!
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
!
hostname Device-Name
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
logging buffered 51200 warnings
enable secret [removed]
!
aaa new-model
!
!
aaa authorization network AAVPNGrp local
!
!
aaa session-id common
!
crypto pki trustpoint TP-self-signed-2394069596
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-2394069596
revocation-check none
rsakeypair TP-self-signed-2394069596
!
!
crypto pki certificate chain TP-self-signed-2394069596
certificate self-signed 01
30820249 308201B2 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 32333934 30363935 3936301E 170D3032 30333031 30303135
31375A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D32 33393430
36393539 3630819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100C89B 689259D1 57EFD80F DDDBDA4F E979037F 6AD05301 7B693346 C32BE4FC
580A19A1 442C83B5 1AE96A3D 488C05AB EE662F26 2CA8EDA8 E5E1BB3A CEB57F13
D4E1752F 6298D618 7BB06AE5 5C912693 063736FF 6942726E 726D703F 442C1B07
8C0E1DB1 C58251FD 68C8A62B B8C1BF87 0A412C5F 62F87D74 F9B1EFC7 9A4520E4
0E4D0203 010001A3 71306F30 0F060355 1D130101 FF040530 030101FF 301C0603
551D1104 15301382 1141412D 57414E2E 66657273 746C2E63 6F6D301F 0603551D
23041830 1680149A B3048547 082371A3 2506F824 C55BBC7D 72330E30 1D060355
1D0E0416 04149AB3 04854708 2371A325 06F824C5 5BBC7D72 330E300D 06092A86
4886F70D 01010405 00038181 00A0FF05 5B2A9BCF E971049C 9B556194 618D75BD
7D287430 FF2C7C11 D311C755 0C0A5C50 E56D1F2D B6675245 8057E87F 74BFB1C0
D437FE43 D4D3017F A151B492 720CF5AC BDF944E7 2B0732F9 37EA6A0A F1D4CDCC
97B5E9E1 9536F261 C6528DDE 868C2659 8D923F21 FD070864 76F66D09 21F7648A
6FA5F54B 97156A27 9F616C7F 2D
quit
dot11 syslog
!
dot11 ssid AANet
!
dot11 ssid AANet2
!
no ip source-route
no ip gratuitous-arps
!
!
ip cef
ip inspect audit-trail
ip inspect udp idle-time 1800
ip inspect dns-timeout 7
ip inspect tcp idle-time 14400
ip inspect name autosec_inspect cuseeme timeout 3600
ip inspect name autosec_inspect ftp timeout 3600
ip inspect name autosec_inspect http timeout 3600
ip inspect name autosec_inspect rcmd timeout 3600
ip inspect name autosec_inspect realaudio timeout 3600
ip inspect name autosec_inspect tftp timeout 30
ip inspect name autosec_inspect udp timeout 15
ip inspect name autosec_inspect tcp timeout 3600
no ip bootp server
no ip domain lookup
ip domain name [removed]
!
!
!
!
username [removed]
username [removed]
!
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp client configuration address-pool local AADynPool
!
crypto isakmp client configuration group AAVPNGrp
key [Removed]
dns 192.168.100.2
domain [removed]
pool AADynPool
acl 150
!
!
crypto ipsec transform-set transform-1 esp-3des esp-sha-hmac
!
crypto dynamic-map AADynMap 1
set transform-set transform-1
reverse-route
!
!
crypto map AADynMap isakmp authorization list AAVPNGrp
crypto map AADynMap client configuration address respond
crypto map AADynMap 1 ipsec-isakmp dynamic AADynMap
!
archive
log config
hidekeys
!
!
ip ssh time-out 60
ip ssh authentication-retries 2
ip ssh version 2
!
bridge irb
!
!
interface FastEthernet0
description Link to Internet Network
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
description Linux Box Outside Interface
switchport access vlan 2
!
interface FastEthernet4
description Link to Comcast
ip address dhcp
no ip redirects
no ip unreachables
no ip proxy-arp
ip inspect autosec_inspect out
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
no cdp enable
crypto map AADynMap
!
interface Dot11Radio0
no ip address
!
encryption key 1 size 40bit [Removed] transmit-key
encryption mode wep mandatory
!
ssid AANet2
!
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
station-role root
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$
no ip address
ip tcp adjust-mss 1452
bridge-group 1
!
interface Vlan2
ip address 192.168.200.10 255.255.255.0
!
interface BVI1
ip address 192.168.100.10 255.255.255.0
ip nat inside
ip virtual-reassembly
!
ip local pool AADynPool 10.176.0.60 10.176.0.90
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 FastEthernet4 dhcp
no ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip nat inside source list 100 interface FastEthernet4 overload
ip nat inside source static tcp 192.168.100.2 3389 interface FastEthernet4 3389
ip nat inside source route-map SDM_RMAP_1 interface FastEthernet4 overload
!
ip access-list extended IntSecure
permit udp any eq domain any
permit udp any eq bootps any eq bootpc
permit esp any any
permit tcp [removed] 0.0.255.255 eq 3389 22 ftp 7022 any
permit tcp host [removed] eq 3389 ftp 22 7022 any
permit tcp any eq pop3 any
permit tcp any eq smtp any
permit tcp any eq 1723 any
permit udp any eq 1723 any
permit tcp any eq 1720 any
permit udp any eq 1720 any
permit icmp any any echo-reply
permit udp any eq 47 any
permit tcp any eq 47 any
permit tcp any any established
deny ip any any log
!
access-list 100 deny ip 192.168.100.0 0.0.0.255 10.176.0.0 0.0.0.255
access-list 100 deny ip 10.176.0.0 0.0.0.255 192.168.100.0 0.0.0.255
access-list 100 permit ip 192.168.100.0 0.0.0.255 any
access-list 100 permit ip 192.168.200.0 0.0.0.255 any
access-list 103 deny ip 192.168.100.0 0.0.0.255 10.176.0.0 0.0.0.255
access-list 103 permit ip 192.168.100.0 0.0.0.255 any
access-list 110 permit tcp any any established
access-list 110 permit udp any any eq domain
access-list 110 permit udp any any
access-list 110 permit ip host 255.255.255.255 any
access-list 110 permit ip 127.0.0.0 0.255.255.255 any
access-list 110 permit ip 192.168.100.0 0.0.0.255 any
access-list 110 permit ip 192.168.200.0 0.0.0.255 any
access-list 110 permit ip host 199.200.24.158 any
access-list 110 permit ip [removed] 0.0.255.255 any
access-list 110 permit ip host [removed] any
access-list 110 permit ip host [removed] any
access-list 110 permit ip any host 255.255.255.255
access-list 110 permit tcp any any eq 1720
access-list 110 permit udp any any eq 1720
access-list 110 permit tcp any any eq 1723
access-list 110 permit udp any any eq 1723
access-list 110 permit tcp any any eq 47
access-list 110 permit udp any any eq 47
access-list 110 deny ip any any log
access-list 150 permit ip 192.168.100.0 0.0.0.255 any
access-list 150 permit ip 10.176.0.0 0.0.0.255 any
no cdp run
!
!
!
route-map SDM_RMAP_1 permit 1
match ip address 103
!
!
control-plane
!
bridge 1 protocol ieee
bridge 1 route ip
banner exec ^CC
UNAUTHORIZED ACCESS PROHIBITED
^C
banner login ^CC
UNAUTHORIZED ACCESS PROHIBITED
^C
!
line con 0
exec-timeout 5 0
no modem enable
line aux 0
line vty 0 4
privilege level 15
transport input telnet ssh
!
scheduler max-task-time 5000
end
My config below...
Device-Name]#sh run
Building configuration...
Current configuration : 8075 bytes
!
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
!
hostname Device-Name
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
logging buffered 51200 warnings
enable secret [removed]
!
aaa new-model
!
!
aaa authorization network AAVPNGrp local
!
!
aaa session-id common
!
crypto pki trustpoint TP-self-signed-2394069596
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-2394069596
revocation-check none
rsakeypair TP-self-signed-2394069596
!
!
crypto pki certificate chain TP-self-signed-2394069596
certificate self-signed 01
30820249 308201B2 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 32333934 30363935 3936301E 170D3032 30333031 30303135
31375A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D32 33393430
36393539 3630819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100C89B 689259D1 57EFD80F DDDBDA4F E979037F 6AD05301 7B693346 C32BE4FC
580A19A1 442C83B5 1AE96A3D 488C05AB EE662F26 2CA8EDA8 E5E1BB3A CEB57F13
D4E1752F 6298D618 7BB06AE5 5C912693 063736FF 6942726E 726D703F 442C1B07
8C0E1DB1 C58251FD 68C8A62B B8C1BF87 0A412C5F 62F87D74 F9B1EFC7 9A4520E4
0E4D0203 010001A3 71306F30 0F060355 1D130101 FF040530 030101FF 301C0603
551D1104 15301382 1141412D 57414E2E 66657273 746C2E63 6F6D301F 0603551D
23041830 1680149A B3048547 082371A3 2506F824 C55BBC7D 72330E30 1D060355
1D0E0416 04149AB3 04854708 2371A325 06F824C5 5BBC7D72 330E300D 06092A86
4886F70D 01010405 00038181 00A0FF05 5B2A9BCF E971049C 9B556194 618D75BD
7D287430 FF2C7C11 D311C755 0C0A5C50 E56D1F2D B6675245 8057E87F 74BFB1C0
D437FE43 D4D3017F A151B492 720CF5AC BDF944E7 2B0732F9 37EA6A0A F1D4CDCC
97B5E9E1 9536F261 C6528DDE 868C2659 8D923F21 FD070864 76F66D09 21F7648A
6FA5F54B 97156A27 9F616C7F 2D
quit
dot11 syslog
!
dot11 ssid AANet
!
dot11 ssid AANet2
!
no ip source-route
no ip gratuitous-arps
!
!
ip cef
ip inspect audit-trail
ip inspect udp idle-time 1800
ip inspect dns-timeout 7
ip inspect tcp idle-time 14400
ip inspect name autosec_inspect cuseeme timeout 3600
ip inspect name autosec_inspect ftp timeout 3600
ip inspect name autosec_inspect http timeout 3600
ip inspect name autosec_inspect rcmd timeout 3600
ip inspect name autosec_inspect realaudio timeout 3600
ip inspect name autosec_inspect tftp timeout 30
ip inspect name autosec_inspect udp timeout 15
ip inspect name autosec_inspect tcp timeout 3600
no ip bootp server
no ip domain lookup
ip domain name [removed]
!
!
!
!
username [removed]
username [removed]
!
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp client configuration address-pool local AADynPool
!
crypto isakmp client configuration group AAVPNGrp
key [Removed]
dns 192.168.100.2
domain [removed]
pool AADynPool
acl 150
!
!
crypto ipsec transform-set transform-1 esp-3des esp-sha-hmac
!
crypto dynamic-map AADynMap 1
set transform-set transform-1
reverse-route
!
!
crypto map AADynMap isakmp authorization list AAVPNGrp
crypto map AADynMap client configuration address respond
crypto map AADynMap 1 ipsec-isakmp dynamic AADynMap
!
archive
log config
hidekeys
!
!
ip ssh time-out 60
ip ssh authentication-retries 2
ip ssh version 2
!
bridge irb
!
!
interface FastEthernet0
description Link to Internet Network
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
description Linux Box Outside Interface
switchport access vlan 2
!
interface FastEthernet4
description Link to Comcast
ip address dhcp
no ip redirects
no ip unreachables
no ip proxy-arp
ip inspect autosec_inspect out
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
no cdp enable
crypto map AADynMap
!
interface Dot11Radio0
no ip address
!
encryption key 1 size 40bit [Removed] transmit-key
encryption mode wep mandatory
!
ssid AANet2
!
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
station-role root
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$
no ip address
ip tcp adjust-mss 1452
bridge-group 1
!
interface Vlan2
ip address 192.168.200.10 255.255.255.0
!
interface BVI1
ip address 192.168.100.10 255.255.255.0
ip nat inside
ip virtual-reassembly
!
ip local pool AADynPool 10.176.0.60 10.176.0.90
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 FastEthernet4 dhcp
no ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip nat inside source list 100 interface FastEthernet4 overload
ip nat inside source static tcp 192.168.100.2 3389 interface FastEthernet4 3389
ip nat inside source route-map SDM_RMAP_1 interface FastEthernet4 overload
!
ip access-list extended IntSecure
permit udp any eq domain any
permit udp any eq bootps any eq bootpc
permit esp any any
permit tcp [removed] 0.0.255.255 eq 3389 22 ftp 7022 any
permit tcp host [removed] eq 3389 ftp 22 7022 any
permit tcp any eq pop3 any
permit tcp any eq smtp any
permit tcp any eq 1723 any
permit udp any eq 1723 any
permit tcp any eq 1720 any
permit udp any eq 1720 any
permit icmp any any echo-reply
permit udp any eq 47 any
permit tcp any eq 47 any
permit tcp any any established
deny ip any any log
!
access-list 100 deny ip 192.168.100.0 0.0.0.255 10.176.0.0 0.0.0.255
access-list 100 deny ip 10.176.0.0 0.0.0.255 192.168.100.0 0.0.0.255
access-list 100 permit ip 192.168.100.0 0.0.0.255 any
access-list 100 permit ip 192.168.200.0 0.0.0.255 any
access-list 103 deny ip 192.168.100.0 0.0.0.255 10.176.0.0 0.0.0.255
access-list 103 permit ip 192.168.100.0 0.0.0.255 any
access-list 110 permit tcp any any established
access-list 110 permit udp any any eq domain
access-list 110 permit udp any any
access-list 110 permit ip host 255.255.255.255 any
access-list 110 permit ip 127.0.0.0 0.255.255.255 any
access-list 110 permit ip 192.168.100.0 0.0.0.255 any
access-list 110 permit ip 192.168.200.0 0.0.0.255 any
access-list 110 permit ip host 199.200.24.158 any
access-list 110 permit ip [removed] 0.0.255.255 any
access-list 110 permit ip host [removed] any
access-list 110 permit ip host [removed] any
access-list 110 permit ip any host 255.255.255.255
access-list 110 permit tcp any any eq 1720
access-list 110 permit udp any any eq 1720
access-list 110 permit tcp any any eq 1723
access-list 110 permit udp any any eq 1723
access-list 110 permit tcp any any eq 47
access-list 110 permit udp any any eq 47
access-list 110 deny ip any any log
access-list 150 permit ip 192.168.100.0 0.0.0.255 any
access-list 150 permit ip 10.176.0.0 0.0.0.255 any
no cdp run
!
!
!
route-map SDM_RMAP_1 permit 1
match ip address 103
!
!
control-plane
!
bridge 1 protocol ieee
bridge 1 route ip
banner exec ^CC
UNAUTHORIZED ACCESS PROHIBITED
^C
banner login ^CC
UNAUTHORIZED ACCESS PROHIBITED
^C
!
line con 0
exec-timeout 5 0
no modem enable
line aux 0
line vty 0 4
privilege level 15
transport input telnet ssh
!
scheduler max-task-time 5000
end