I need some help on setting up a VPN connection with pre-shared keys between the ASL in the office and my Cisco 806 router at home over a PPPoE connection. The work on the ASL was done and should work fine. But my cisco config does not work and I don't know why.
Maybe someone from the users here could help me.
Here is my running cisco config, that doesn't work:
Code:
!
version 12.2
hostname helios
!
no snmp-server
no service pad
no service timestamps
no service tcp-small-servers
no service udp-small-servers
no logging buffered
no logging console
no logging monitor
no ip source-route
no ip http server
no ip bootp server
!
service timestamps debug uptime
service timestamps log datetime localtime show-timezone
service password-encryption
!
username USERNAME password PASSWORD
enable secret PASSWORD
!
clock timezone CET 1
clock summer-time CEST recurring last Sun Mar 2:00 last Sun Oct 3:00
!
ip name-server 194.246.96.79
ip name-server 194.246.96.49
ip name-server 62.72.64.237
ip name-server 62.72.64.241
!
ip ssh time-out 120
ip ssh authentication-retries 3
!
ip subnet-zero
!
ip dhcp excluded-address 192.168.0.1
ip dhcp excluded-address 192.168.0.2
ip dhcp excluded-address 192.168.0.3
!
!
ip dhcp pool CLIENT1
host 192.168.0.2 255.255.255.240
client-identifier 0100.6008.7cdb.ca
client-name hermes
!
!
ip dhcp pool CLIENT2
host 192.168.0.3 255.255.255.240
client-identifier 0100.104b.8ac0.90
client-name artemis
!
!
ip dhcp pool LAN
import all
network 192.168.0.0 255.255.255.240
default-router 192.168.0.1
dns-server 194.246.96.79
domain-name MYDOMAIN
lease 0 2
!
ip cef
!
ip inspect name firewall cuseeme timeout 3600
ip inspect name firewall ftp timeout 3600
ip inspect name firewall http java-list 1 alert on audit-trail on timeout 3600
ip inspect name firewall rcmd timeout 3600
ip inspect name firewall realaudio timeout 3600
ip inspect name firewall smtp timeout 3600
ip inspect name firewall tftp timeout 30
ip inspect name firewall udp timeout 15
ip inspect name firewall tcp timeout 3600
ip inspect name firewall h323 timeout 3600
!
vpdn enable
!
vpdn-group 1
request-dialin
protocol pppoe
ip mtu adjust
!
!
!
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
crypto isakmp key MY-KEY address 10.0.0.99
!
!
crypto ipsec transform-set vpn-office-set esp-3des esp-md5-hmac
crypto mib ipsec flowmib history tunnel size 200
crypto mib ipsec flowmib history failure size 200
!
crypto map vpn-office 1 ipsec-isakmp
set peer 10.0.0.99
set transform-set vpn-office-set
match address 102
!
!
!
!
!
interface Ethernet0
description Verbindung zum internen LAN
ip address 192.168.0.1 255.255.255.240
ip access-group 101 out
no ip directed-broadcast
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip tcp adjust-mss 1452
no ip mroute-cache
no cdp enable
hold-queue 100 out
crypto map vpn-office
!
!
interface Ethernet1
description Verbindung zum DSL-Anschluss
no ip address
pppoe enable
pppoe-client dial-pool-number 1
no ip directed-broadcast
no cdp enable
!
!
interface Dialer1
description Stellt die DSL-Verbindung her
ip address negotiated
ip access-group 100 in
ip mtu 1492
ip nat outside
ip inspect firewall out
encapsulation ppp
ip tcp adjust-mss 1452
no ip mroute-cache
dialer pool 1
dialer-group 1
no ip directed-broadcast
no cdp enable
ppp authentication chap pap callin
ppp chap hostname USERNAME
ppp chap password PASSWORD
ppp pap sent-username USERNAME password PASSWORD
ppp ipcp dns request
ppp ipcp wins request
crypto map vpn-office
!
!
ip nat inside source route-map outside-vpn interface Dialer1 overload
ip nat inside source static 192.168.0.1 22 interface Dialer1 22
!
!
ip classless
ip route 0.0.0.0 0.0.0.0 Dialer1
ip pim bidir-enable
!
!
access-list 1 remark --------------------------------------------------
access-list 1 remark ------- ACL 1 - gesamten Traffic zulassen --------
access-list 1 remark --------------------------------------------------
access-list 1 permit any
!
access-list 100 remark ------------------------------------------------
access-list 100 remark -------- ACL 100 - eingehender Traffic ---------
access-list 100 remark ------------------------------------------------
access-list 100 permit udp any eq domain any
access-list 100 permit tcp any any established
access-list 100 permit tcp any any eq 22
access-list 100 remark ------------------------------------------------
access-list 100 remark -------------- PING-Einstellungen --------------
access-list 100 remark ------------------------------------------------
access-list 100 permit icmp any any administratively-prohibited
access-list 100 permit icmp any any echo
access-list 100 permit icmp any any echo-reply
access-list 100 permit icmp any any packet-too-big
access-list 100 permit icmp any any time-exceeded
access-list 100 permit icmp any any traceroute
access-list 100 permit icmp any any unreachable
access-list 100 remark ------------------------------------------------
access-list 100 remark ------------ Traffic für VPN / PPTP ------------
access-list 100 remark ------------------------------------------------
access-list 100 permit gre any any
access-list 100 permit esp any any
access-list 100 permit udp any any eq isakmp
access-list 100 permit udp any any eq 1723
access-list 100 permit tcp any any eq 1723
access-list 100 remark ------------------------------------------------
access-list 100 remark ----------------- Anti-spoofing ----------------
access-list 100 remark ------------------------------------------------
access-list 100 deny ip 10.0.0.0 0.255.255.255 any log
access-list 100 deny ip 127.0.0.0 0.255.255.255 any log
access-list 100 deny ip 169.254.0.0 0.0.255.255 any log
access-list 100 deny ip 172.16.0.0 0.15.255.255 any log
access-list 100 deny ip 192.168.0.0 0.0.255.255 any log
access-list 100 deny ip 224.0.0.0 15.255.255.255 any log
access-list 100 deny ip host 0.0.0.0 any log
access-list 100 remark ------------------------------------------------
access-list 100 remark --- Nicht explizit zugelassene Ports sperren ---
access-list 100 remark ------------------------------------------------
access-list 100 deny icmp any any redirect log
access-list 100 deny udp any range 1 65535 any range 1 65535 log
access-list 100 deny tcp any range 1 65535 any range 1 65535 log
access-list 100 deny ip any any log
!
access-list 101 remark ------------------------------------------------
access-list 101 remark -------- ACL 101 - ausgehender Traffic ---------
access-list 101 remark ------------------------------------------------
access-list 101 deny ip 192.168.0.0 0.0.0.255 212.46.110.0 0.0.0.255
access-list 101 permit ip 192.168.0.0 0.0.0.255 any
access-list 101 permit udp any eq domain any
access-list 101 permit tcp any any established
access-list 101 remark ------------------------------------------------
access-list 101 remark -------------- PING-Einstellungen --------------
access-list 101 remark ------------------------------------------------
access-list 101 permit icmp any any administratively-prohibited
access-list 101 permit icmp any any echo
access-list 101 permit icmp any any echo-reply
access-list 101 permit icmp any any packet-too-big
access-list 101 permit icmp any any time-exceeded
access-list 101 permit icmp any any traceroute
access-list 101 permit icmp any any unreachable
access-list 101 remark ------------------------------------------------
access-list 101 remark -------- FTP, E-Mail und Browser Ports ---------
access-list 101 remark ------------------------------------------------
access-list 101 permit tcp any any eq 22
access-list 101 permit tcp any any eq ftp
access-list 101 permit tcp any any eq smtp
access-list 101 permit tcp any any eq pop3
access-list 101 permit tcp any any eq 143
access-list 101 permit tcp any any eq www
access-list 101 permit tcp any any eq 443
access-list 101 remark ------------------------------------------------
access-list 101 remark ------------ Traffic für VPN / PPTP ------------
access-list 101 remark ------------------------------------------------
access-list 101 permit gre any any
access-list 101 permit esp any any
access-list 101 permit udp any any eq isakmp
access-list 101 permit udp any any eq 1723
access-list 101 permit tcp any any eq 1723
access-list 101 remark ------------------------------------------------
access-list 101 remark --- Nicht explizit zugelassene Ports sperren ---
access-list 101 remark ------------------------------------------------
access-list 101 deny icmp any any redirect log
access-list 101 deny udp any range 1 65535 any range 1 65535 log
access-list 101 deny tcp any range 1 65535 any range 1 65535 log
access-list 101 deny ip any any log
!
access-list 102 remark ------------------------------------------------
access-list 102 remark ------ ACL 102 - VPN mit Office NRW-Online -----
access-list 102 remark ------------------------------------------------
access-list 102 permit ip 192.168.0.0 0.0.0.255 212.46.110.0 0.0.0.255
access-list 102 deny ip 192.168.0.0 0.0.0.255 any
!
dialer-list 1 protocol ip permit
route-map outside-vpn permit 10
match ip address 101
!
no cdp run
!
banner motd ^
*********************************************************
* *
* [WARNING] *
* If you are not authorized to access this system exit *
* immediately. *
* *
* Unauthorized access to this system is forbidden by *
* company policies, national, and international laws. *
* Unauthorized users are subject to criminal and civil *
* penalties as well as company initiated disciplinary *
* proceedings. *
* *
* By entry into this system you acknowledge that you *
* are authorized access and the level of privilege you *
* subsequently execute on this system. You further *
* acknowledge that by entry into this system you *
* expect no privacy from monitoring. *
* *
*********************************************************
^
!
line con 0
exec-timeout 120 0
login local
stopbits 1
!
!
line vty 0 4
transport input ssh
access-class 1 in
exec-timeout 120 0
login local
length 0
!
scheduler max-task-time 5000
!
!
ntp clock-period 17179869
ntp server 192.53.103.103
ntp server 192.53.103.104
ntp server 212.46.111.3
ntp server 130.149.17.8
!
end
This thread was automatically locked due to age.
