octavian10
MIS
Can someone please help me, I am tired of staring at these 2611 routers config trying to figure out why this vpn will not work. Both of these routers perform PAT for internet aaccess. I think it may have somthing to do with the routing of the internal adress's once the tunel is built. I have tried every static route but nothing workd. If run the crypto isakmp sa cpmmand it shows that the two routers are connected ie..
ohio2611#show crypto isakmp sa
dst src state conn-id slot
65.xx.xx.xx 68.xx.xx.xx QM_IDLE 1 0
Hope someone can help!
ROUTER A
Current configuration : 1409 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname ohio2611
!
boot-start-marker
boot-end-marker
!
memory-size iomem 15
no aaa new-model
ip subnet-zero
ip cef
!
no ip domain lookup
!
ip audit po max-events 100
!
username opandrea privilege 15 secret 5 $1$rDk1$NaRNm32hGP/wegh8fbqcp/
!
crypto isakmp policy 10
encr 3des
authentication pre-share
group 2
crypto isakmp key cisco1234 address 68.xx.xx.xx no-xauth
!
crypto ipsec transform-set transset esp-3des esp-md5-hmac
!
crypto map clientmap 100 ipsec-isakmp
set peer 68.xx.xx.xx
set transform-set transset
match address 100
!
interface Ethernet0/0
ip address 65.xx.xx.xx 255.255.255.128
ip nat outside
half-duplex
crypto map clientmap
!
interface Ethernet0/1
ip address 192.168.1.1 255.255.255.0
ip nat inside
half-duplex
!
ip nat inside source route-map nonat inter
ip http server
no ip http secure-server
ip classless
ip route 0.0.0.0 0.0.0.0 65.xx.xx.xx
!
access-list 100 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 101 deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 101 permit ip 192.168.1.0 0.0.0.255 any
!
route-map nonat permit 10
match ip address 101
!
line con 0
logging synchronous
line aux 0
line vty 0 4
login
end
ROUTER B
Current configuration : 1409 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname florida2611
!
boot-start-marker
boot-end-marker
!
memory-size iomem 15
no aaa new-model
ip subnet-zero
ip cef
!
no ip domain lookup
!
ip audit po max-events 100
!
username opandrea privilege 15 secret 5 $1$rDk1$NaRNm32hGP/wegh8fbqcp/
!
crypto isakmp policy 10
encr 3des
authentication pre-share
group 2
crypto isakmp key cisco1234 address 65.xx.xx.xx no
xauth
!
crypto ipsec transform-set transset esp-3des esp-md5-hmac
!
crypto map clientmap 100 ipsec-isakmp
set peer 65.xx.xx.xx
set transform-set transset
match address 100
!
interface Ethernet0/0
ip address 68.xx.xx.xx255.255.255.0
ip nat outside
half-duplex
crypto map clientmap
!
interface Ethernet0/1
ip address 192.168.2.1 255.255.255.0
ip nat inside
half-duplex
!
ip nat inside source route-map nonat inter
ip http server
no ip http secure-server
ip classless
ip route 0.0.0.0 0.0.0.0 68.xx.xx.xx
!
access-list 100 permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 101 deny ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 101 permit ip 192.168.2.0 0.0.0.255 any
!
route-map nonat permit 10
match ip address 101
!
line con 0
logging synchronous
line aux 0
line vty 0 4
login
!
end
"I hear and I forget. I see and I remember. I do and I understand."
- Confucius (551 BC - 479)
ohio2611#show crypto isakmp sa
dst src state conn-id slot
65.xx.xx.xx 68.xx.xx.xx QM_IDLE 1 0
Hope someone can help!
ROUTER A
Current configuration : 1409 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname ohio2611
!
boot-start-marker
boot-end-marker
!
memory-size iomem 15
no aaa new-model
ip subnet-zero
ip cef
!
no ip domain lookup
!
ip audit po max-events 100
!
username opandrea privilege 15 secret 5 $1$rDk1$NaRNm32hGP/wegh8fbqcp/
!
crypto isakmp policy 10
encr 3des
authentication pre-share
group 2
crypto isakmp key cisco1234 address 68.xx.xx.xx no-xauth
!
crypto ipsec transform-set transset esp-3des esp-md5-hmac
!
crypto map clientmap 100 ipsec-isakmp
set peer 68.xx.xx.xx
set transform-set transset
match address 100
!
interface Ethernet0/0
ip address 65.xx.xx.xx 255.255.255.128
ip nat outside
half-duplex
crypto map clientmap
!
interface Ethernet0/1
ip address 192.168.1.1 255.255.255.0
ip nat inside
half-duplex
!
ip nat inside source route-map nonat inter
ip http server
no ip http secure-server
ip classless
ip route 0.0.0.0 0.0.0.0 65.xx.xx.xx
!
access-list 100 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 101 deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 101 permit ip 192.168.1.0 0.0.0.255 any
!
route-map nonat permit 10
match ip address 101
!
line con 0
logging synchronous
line aux 0
line vty 0 4
login
end
ROUTER B
Current configuration : 1409 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname florida2611
!
boot-start-marker
boot-end-marker
!
memory-size iomem 15
no aaa new-model
ip subnet-zero
ip cef
!
no ip domain lookup
!
ip audit po max-events 100
!
username opandrea privilege 15 secret 5 $1$rDk1$NaRNm32hGP/wegh8fbqcp/
!
crypto isakmp policy 10
encr 3des
authentication pre-share
group 2
crypto isakmp key cisco1234 address 65.xx.xx.xx no
xauth
!
crypto ipsec transform-set transset esp-3des esp-md5-hmac
!
crypto map clientmap 100 ipsec-isakmp
set peer 65.xx.xx.xx
set transform-set transset
match address 100
!
interface Ethernet0/0
ip address 68.xx.xx.xx255.255.255.0
ip nat outside
half-duplex
crypto map clientmap
!
interface Ethernet0/1
ip address 192.168.2.1 255.255.255.0
ip nat inside
half-duplex
!
ip nat inside source route-map nonat inter
ip http server
no ip http secure-server
ip classless
ip route 0.0.0.0 0.0.0.0 68.xx.xx.xx
!
access-list 100 permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 101 deny ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 101 permit ip 192.168.2.0 0.0.0.255 any
!
route-map nonat permit 10
match ip address 101
!
line con 0
logging synchronous
line aux 0
line vty 0 4
login
!
end
"I hear and I forget. I see and I remember. I do and I understand."
- Confucius (551 BC - 479)