1x1speed
Aug 22, 2010, updated at Sep 06, 2010 (UTC)
view5686
view9
0
Goto Top

Cisco Router VPN Config - Probleme mit Outside Traffic

GermansolvedQuestionNetworks
hallo miteinander,

bin grad am tüfteln ein router mit vpn einzurichten. die vpn funktioniert und ich kann mit einem client der per ipSEC-client eingewählt ist
im netz die server erreichen nur der traffic nach außen, also wenn ich mit dem eingewählten client webseiten aufrufen will bekomme ich
keine rückmeldung.
ein client im netz drin, der über den router geht kann aber z.B. google erreichen.

ich hab mal meine config angefügt. kann es sein, daß für VPN verbindungen noch extra für outside traffic was eingetragen werden muss!?

danke!


Using 6801 out of 245752 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname Router01
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
logging buffered 4096 notifications
enable secret 5 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
!
aaa new-model
!
!
aaa authentication login clientauth local
aaa authorization network groupauthor local 
!
!
aaa session-id common
clock timezone GMT 1
!
dot11 syslog
ip source-route
!
!
ip cef
!
!
ip name-server 192.168.10.10
no ipv6 cef
!
multilink bundle-name authenticated
!
vpdn enable
!
vpdn-group 1
 request-dialin
  protocol pppoe
!
voice-card 0
!
username xxxxxx privilege 15 password 7 xxxxxxxxxxxxxxxxxxxxxxxxxx
archive
 log config
  hidekeys
! 
crypto keyring spokes 
  pre-shared-key address 0.0.0.0 0.0.0.0 key cisco123 
!
crypto isakmp policy 10
 encr 3des
 authentication pre-share
 group 2
!
crypto isakmp client configuration group testgroup
 key cisco321
 dns 194.25.0.54 192.168.10.10
 wins 192.168.10.10
 domain wr
 pool ippool
crypto isakmp profile VPNclient
   description VPN clients profile 
   match identity group testgroup
   client authentication list clientauth
   isakmp authorization list groupauthor
   client configuration address respond
!
!
crypto ipsec transform-set myset esp-3des esp-sha-hmac 
!
crypto dynamic-map dynmap 5
 set transform-set myset 
 set isakmp-profile VPNclient
!
!
crypto map mymap 10 ipsec-isakmp dynamic dynmap 
!
interface Loopback0
 description VPN_ROUTER
 ip address 192.168.5.1 255.255.255.255
!
interface Port-channel1
 no ip address
 hold-queue 150 in
!
interface Port-channel1.1
 encapsulation dot1Q 1 native
!
interface Port-channel1.100
 encapsulation dot1Q 100
 ip address 192.168.10.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
!
interface Port-channel1.120
 description server
 encapsulation dot1Q 120
 ip address 192.168.15.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
!
interface GigabitEthernet0/0
 no ip address
 duplex full
 speed 1000
 channel-group 1
!
interface GigabitEthernet0/1
 no ip address
 duplex full
 speed 1000
 channel-group 1
!
interface FastEthernet0/3/0
 description ADSL Business
 switchport access vlan 800
 pppoe enable group global
!
interface FastEthernet0/3/1
 description ADSL Schulen ans Netz
 switchport access vlan 801
 pppoe enable group global
 pppoe-client dial-pool-number 2
!
interface FastEthernet0/3/2
!
interface FastEthernet0/3/3
!
interface FastEthernet0/2/0
 no ip address
 shutdown
 duplex auto
 speed auto
!
interface Vlan1
 no ip address
!
interface Vlan800
 no ip address
 pppoe enable group global
 pppoe-client dial-pool-number 1
!
interface Vlan801
 no ip address
 pppoe enable group global
 pppoe-client dial-pool-number 2
!
interface Dialer1
 mtu 1492
 ip address xxx.xxx.xxx.xxx 255.255.255.0
 ip dns view-group 1
 ip nat outside
 ip virtual-reassembly
 encapsulation ppp
 no ip mroute-cache
 dialer pool 1
 dialer watch-group 1
 dialer-group 1
 no cdp enable
 ppp authentication pap callin
 ppp chap hostname xxxxxxxxxxxxxx
 ppp pap sent-username xxxxxxxxxxxxxx password xxxxxxxxxxxxxxxx
 ppp ipcp dns request
 ppp ipcp mask request
 ppp ipcp route default
 ppp ipcp address accept
!
interface Dialer2
 mtu 1492
 ip address negotiated
 ip dns view-group 2
 ip nat outside
 ip virtual-reassembly
 encapsulation ppp
 no ip mroute-cache
 dialer pool 2
 dialer watch-group 1
 dialer-group 2
 no cdp enable
 ppp authentication pap callin
 ppp chap hostname xxxxxxxxxxxxxxxxxxxxxxxxxxx
 ppp chap password xxxxxxxxxxxxxxxxxxxxx
 ppp pap sent-username xxxxxxxxxxxxxxxxxxx password xxxxxxxxxxxxxxxxxxxxxxxx
 ppp ipcp dns request
 ppp ipcp mask request
 ppp ipcp route default
 ppp ipcp address accept
 crypto map mymap
!
ip local pool ippool 192.168.80.1 192.168.80.128
no ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Dialer2
no ip http server
no ip http secure-server
!
!
ip dns server
ip nat inside source route-map backup interface Dialer2 overload
ip nat inside source route-map primary interface Dialer1 overload
!
access-list 10 permit 192.168.10.0 0.0.0.255
access-list 10 permit 192.168.80.0 0.0.0.255
dialer-list 1 protocol ip permit
dialer-list 2 protocol ip permit
!
route-map backup permit 10
 match ip address 10
!
route-map primary permit 10
 match ip address 10
!
control-plane
!
ccm-manager fax protocol cisco
!
!
line con 0
 logging synchronous
 login authentication clientauth
 escape-character 27
line aux 0
line vty 0 4
 logging synchronous
 login authentication clientauth
 transport input ssh
!
scheduler allocate 20000 1000
ntp server 192.168.10.10
end
comment-contentCommentShareShare
Share on Facebook Share on Twitter Share on Reddit Share on Linkedin

Content-Key: 149484

Url: https://administrator.de/contentid/149484

Printed on: April 23, 2024 at 11:04 o'clock

9 Comments
Latest comment
Goto Top
Member: Nailara
Nailara Aug 22, 2010 at 21:50:07 (UTC)
Goto Top
Hi,

das sieht so aus als wenn der Router auch die Verbindung ins Internet herstellt und ich glaube mich erinnern zu können, das das, was Du machen willst, nicht geht.

Wenn Du in Deinem Netzwerk einen Proxy hast, dann sollte Surfen gehen. Wenn im Netzwerk - also nicht auf dem Router - ein weiteres NAT-Device steht, dann sollte das auch machbar sein (verschobene Default Gateways und so'n Kram, doch direkt auf dem Gerät den VPN terminieren und gleichzeitig ins Internet gehen, geht glaube ich nicht.

Im Cisco Client ist ein Haken der sagt, dass man das lokale Netzwerk erreichen kann oder eben nicht. Wenn man hier sagt, dass der Zugriff ins lokale Netz möglich ist, dann wird der VPN aufgebaut und man kann z.B. über sein heimisches DSL ins Internet.

Falls es doch geht, dann sorry für die Fehlinformation und ich würde die Konfig dann auch bitte gerne haben wollen face-smile.

CU
Member: Dani
Dani Aug 23, 2010 at 16:12:31 (UTC)
Goto Top
Hi 1x1speed,
versuch mal vom Router über die 192.168.5.1 einen Ping ins Internet zu schicken und kontrolliere danach mal die Counter der IP-Accesslisten. Falls notwenig einfach mal diese auf "Null" setzen und nochmals versuchen.

ich glaube mich erinnern zu können, das das, was Du machen willst, nicht geht.
Ist machbar wenn ich alles richtig verstanden habe.


Grüße,
Dani
Member: Nailara
Nailara Aug 23, 2010 at 16:38:37 (UTC)
Goto Top
Zitat von @Dani:
Ist machbar wenn ich alles richtig verstanden habe.
Das wäre cool, hast Du irgendwo ein Stück Config?
Member: Dani
Dani Aug 23, 2010 at 17:00:31 (UTC)
Goto Top
Na kla... ich habe die Konfiguration oben mal ein bisschen modifiziert:
Using 6801 out of 245752 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname Router01
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
logging buffered 4096 notifications
enable secret 5 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
!
aaa new-model
!
!
aaa authentication login clientauth local
aaa authorization network groupauthor local 
!
!
aaa session-id common
clock timezone GMT 1
!
dot11 syslog
ip source-route
!
!
ip cef
!
!
ip name-server 192.168.10.10
no ipv6 cef
!
multilink bundle-name authenticated
!
vpdn enable
!
vpdn-group 1
 request-dialin
  protocol pppoe
!
voice-card 0
!
username xxxxxx privilege 15 password 7 xxxxxxxxxxxxxxxxxxxxxxxxxx
archive
 log config
  hidekeys
! 
crypto keyring spokes 
  pre-shared-key address 0.0.0.0 0.0.0.0 key cisco123 
!
crypto isakmp policy 10
 encr 3des
 authentication pre-share
 group 2
!
crypto isakmp client configuration group testgroup
 key cisco321
 dns 194.25.0.54 192.168.10.10
 wins 192.168.10.10
 domain wr
 pool ippool
crypto isakmp profile VPNclient
   description VPN clients profile 
   match identity group testgroup
   client authentication list clientauth
   isakmp authorization list groupauthor
   client configuration address respond
!
!
crypto ipsec transform-set myset esp-3des esp-sha-hmac 
!
crypto dynamic-map dynmap 5
 set transform-set myset 
 set isakmp-profile VPNclient
!
!
crypto map mymap 10 ipsec-isakmp dynamic dynmap 
!
interface Loopback0
 description interface for vpn clients
 ip address 192.168.5.1 255.255.255.255
!
interface Port-channel1
 no ip address
 hold-queue 150 in
!
interface Port-channel1.1
 encapsulation dot1Q 1 native
!
interface Port-channel1.100
 encapsulation dot1Q 100
 ip address 192.168.10.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
!
interface Port-channel1.120
 description server
 encapsulation dot1Q 120
 ip address 192.168.15.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
!
interface GigabitEthernet0/0
 no ip address
 duplex full
 speed 1000
 channel-group 1
!
interface GigabitEthernet0/1
 no ip address
 duplex full
 speed 1000
 channel-group 1
!
interface FastEthernet0/3/0
 description ADSL Business
 switchport access vlan 800
 pppoe enable group global
!
interface FastEthernet0/3/1
 description ADSL Schulen ans Netz
 switchport access vlan 801
 pppoe enable group global
 pppoe-client dial-pool-number 2
!
interface FastEthernet0/3/2
!
interface FastEthernet0/3/3
!
interface FastEthernet0/2/0
 no ip address
 shutdown
 duplex auto
 speed auto
!
interface Vlan1
 no ip address
!
interface Vlan800
 no ip address
 pppoe enable group global
 pppoe-client dial-pool-number 1
!
interface Vlan801
 no ip address
 pppoe enable group global
 pppoe-client dial-pool-number 2
!
interface Dialer1
 mtu 1492
 ip address xxx.xxx.xxx.xxx 255.255.255.0
 ip dns view-group 1
 ip nat outside
 ip virtual-reassembly
 encapsulation ppp
 ip policy route-map VPN-Client
 no ip mroute-cache
 dialer pool 1
 dialer watch-group 1
 dialer-group 1
 no cdp enable
 ppp authentication pap callin
 ppp chap hostname xxxxxxxxxxxxxx
 ppp pap sent-username xxxxxxxxxxxxxx password xxxxxxxxxxxxxxxx
 ppp ipcp dns request
 ppp ipcp mask request
 ppp ipcp route default
 ppp ipcp address accept
!
interface Dialer2
 mtu 1492
 ip address negotiated
 ip dns view-group 2
 ip nat outside
 ip virtual-reassembly
 encapsulation ppp
 ip policy route-map VPN-Client
 no ip mroute-cache
 dialer pool 2
 dialer watch-group 1
 dialer-group 2
 no cdp enable
 ppp authentication pap callin
 ppp chap hostname xxxxxxxxxxxxxxxxxxxxxxxxxxx
 ppp chap password xxxxxxxxxxxxxxxxxxxxx
 ppp pap sent-username xxxxxxxxxxxxxxxxxxx password xxxxxxxxxxxxxxxxxxxxxxxx
 ppp ipcp dns request
 ppp ipcp mask request
 ppp ipcp route default
 ppp ipcp address accept
 crypto map mymap
!
ip local pool ippool 192.168.80.1 192.168.80.128
no ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Dialer2
no ip http server
no ip http secure-server
!
!
ip dns server
ip nat inside source route-map backup interface Dialer2 overload
ip nat inside source route-map primary interface Dialer1 overload
!
access-list 10 remark *** LAN ***
access-list 10 permit 192.168.10.0 0.0.0.127

access-list 110 remark *** VPN - Clients ***
access-list 110 permit ip 192.168.80.0 0.0.0.255 any

dialer-list 1 protocol ip permit
dialer-list 2 protocol ip permit
!
route-map backup permit 10
 match ip address 10
!
route-map primary permit 10
 match ip address 10
!
route-map VPN-Client permit 10
 match ip address110
 set interface Loopback0
!
control-plane
!
ccm-manager fax protocol cisco
!
!
line con 0
 logging synchronous
 login authentication clientauth
 escape-character 27
line aux 0
line vty 0 4
 logging synchronous
 login authentication clientauth
 transport input ssh
!
scheduler allocate 20000 1000
ntp server 192.168.10.10
end
Schaust euch mal in Ruhe an...


Grüße,
Dani
Member: Nailara
Nailara Aug 23, 2010 at 17:24:50 (UTC)
Goto Top
Mache ich auf jeden Fall, danke schön face-smile
Member: 1x1speed
1x1speed Aug 23, 2010 at 23:08:50 (UTC)
Goto Top
hi dani,

dank für deine mühe, ich werds mir morgen mal ansehen und checken.

danke beste grüße face-smile
Member: 1x1speed
1x1speed Sep 06, 2010 at 19:20:01 (UTC)
Goto Top
Hallo miteinander,

sorry für meine späte Antwort. Das Problem mit dem WAN Traffic hab ich gelöst. Zumindest klappte es Testweise mit der config siehe unten. Nur gibts nun das nächste Problem. Ich verwende 2 DSL Anschlüsse wobei einer als Fallback dienen soll wenn der primäre ausfällt. Wenn ich nun den ersten abstecke verbindet der zweite wunderbar und ich kann auch den Router von außen über dyndns erreichen. Nur das NAT will nicht. Bei einem

"ping google.de source portchannel1.100"

geht zwar DNS aber der Ping kommt nicht weiter.

Erst wenn ich ein

"clear ip nat translations *"

mache und in der config die zeile

"ip nat inside source route-map a_primary interface Dialer1 overload"

herausnehme geht auch der Ping vom VLAN100 ins Internet wieder. Gleiche Prozedur wenn der Router Dialer 1 wieder umschwenkt.


version 12.4
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
!
hostname Router01
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
logging buffered 50000
no logging console
enable secret 5 1234567890987654321
!
aaa new-model
!
!
aaa authentication login userauthen group radius local
aaa authorization network groupauthor local 
!
!
aaa session-id common
clock timezone CET 1
clock summer-time CEST recurring last Sun Mar 2:00 last Sun Oct 3:00
!
dot11 syslog
no ip source-route
no ip gratuitous-arps
ip options drop
!
!
ip cef
!
!
no ip bootp server
ip domain name domain.local
ip name-server 192.168.15.10
ip name-server 194.25.2.129
ip ddns update method dyndns
 HTTP
  add http://dyndnsuser:paswort@members.dyndns.org/nic/update?system=dyndns&hostname=dyndnshost&myip=<a>
 interval minimum 1 0 0 0
!
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
vpdn enable
!
vpdn-group 1
 request-dialin
  protocol pppoe
!
!
!
voice-card 0
!
!
crypto pki trustpoint TP-self-signed-1846207694
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-1846207694
 revocation-check none
 rsakeypair TP-self-signed-1846207694
!
!
crypto pki certificate chain TP-self-signed-1846207694
 certificate self-signed 01
	......
  	quit
!
!
username admin privilege 15 password 7 1234567890987654321
archive
 log config
  hidekeys
! 
crypto keyring spokes 
  pre-shared-key address 0.0.0.0 0.0.0.0 key schluessel1234567890987654321
!
crypto isakmp policy 10
 encr aes 256
 authentication pre-share
 group 2
!
crypto isakmp client configuration group testgroup
 key schluessel1234567890987654321
 dns 192.168.15.10
 wins 192.168.15.10
 domain domain.local
 pool ippool
 netmask 255.255.255.0
!
!
crypto ipsec transform-set myset esp-aes 256 esp-sha-hmac 
!
crypto dynamic-map dynmap 5
 set transform-set myset 
 reverse-route
!
!
crypto map mymap client authentication list userauthen
crypto map mymap isakmp authorization list groupauthor
crypto map mymap client configuration address respond
crypto map mymap 10 ipsec-isakmp dynamic dynmap 
!
!
!
ip ssh source-interface Loopback0
ip ssh rsa keypair-name SSH
ip ssh version 2
!
!
!
!
interface Loopback0
 description VPN_ROUTER
 ip address 192.168.5.1 255.255.255.255
 ip nat inside
 ip virtual-reassembly
!
interface Port-channel1
 no ip address
 hold-queue 150 in
!
interface Port-channel1.1
 encapsulation dot1Q 1 native
!

interface Port-channel1.100
 description management
 encapsulation dot1Q 100
 ip address 192.168.10.1 255.255.255.0
 ip helper-address 192.168.15.10
 ip nat inside
 ip virtual-reassembly
!
interface Port-channel1.120
 description server
 encapsulation dot1Q 120
 ip address 192.168.15.1 255.255.255.0
 ip helper-address 192.168.15.10
 ip nat inside
 ip virtual-reassembly
!
...
!
interface GigabitEthernet0/0
 no ip address
 duplex full
 speed 1000
 channel-group 1
!
interface GigabitEthernet0/1
 no ip address
 duplex full
 speed 1000
 channel-group 1
!
interface FastEthernet0/3/0
 description ADSL Business
 switchport access vlan 800
!
interface FastEthernet0/3/1
 description ADSL Schulen ans Netz
 switchport access vlan 801
!
interface FastEthernet0/3/2
 shutdown
!
interface FastEthernet0/3/3
 shutdown
!
interface FastEthernet0/2/0
 no ip address
 shutdown
 duplex auto
 speed auto
!
interface Vlan1
 no ip address
!
interface Vlan800
 no ip address
 pppoe enable group 1
 pppoe-client dial-pool-number 1
!
interface Vlan801
 no ip address
 pppoe enable group global
 pppoe-client dial-pool-number 2
!
interface Dialer1
 mtu 1492
 ip address negotiated
 ip nat outside
 ip virtual-reassembly
 encapsulation ppp
 no ip mroute-cache
 shutdown
 dialer pool 1
 dialer-group 1
 no cdp enable
 ppp authentication pap callin
 ppp chap hostname 1234567890987654321@t-online-com.de
 ppp pap sent-username 1234567890987654321@t-online-com.de password 7 1234567890987654321
 ppp ipcp mask request
 ppp ipcp address accept
 crypto map mymap
!
interface Dialer2
 mtu 1492
 ip ddns update hostname dyndnshostname
 ip ddns update dyndns
 ip address negotiated
 ip nat outside
 ip virtual-reassembly
 encapsulation ppp
 no ip mroute-cache
 dialer pool 2
 dialer watch-group 1
 dialer-group 2
 no cdp enable
 ppp authentication pap callin
 ppp chap hostname 1234567890987654321#0001@t-online.de
 ppp chap password 7 1234567890987654321
 ppp pap sent-username 1234567890987654321#0001@t-online.de password 7 1234567890987654321
 ppp ipcp mask request
 ppp ipcp address accept
 crypto map mymap
!
ip local pool ippool 10.10.1.1 10.10.1.254
no ip forward-protocol nd
no ip forward-protocol udp tftp
no ip forward-protocol udp nameserver
no ip forward-protocol udp domain
no ip forward-protocol udp time
no ip forward-protocol udp netbios-ns
no ip forward-protocol udp netbios-dgm
no ip forward-protocol udp tacacs
ip route 0.0.0.0 0.0.0.0 Dialer1 50
ip route 0.0.0.0 0.0.0.0 Dialer2 80
no ip http server
ip http secure-server
!
!
ip nat inside source static tcp 192.168.15.12 22 interface Dialer1 22
ip nat inside source route-map a_primary interface Dialer1 overload
ip nat inside source route-map b_backup interface Dialer2 overload
!
access-list 110 deny   ip 192.168.0.0 0.0.255.255 10.10.1.0 0.0.0.255
access-list 110 permit ip 192.168.0.0 0.0.255.255 any
dialer-list 1 protocol ip permit
dialer-list 2 protocol ip permit
no cdp run
!
!
!
route-map b_backup permit 10
 match ip address 110
!
route-map a_primary permit 10
 match ip address 110
!
!
!
radius-server host 192.168.15.10 auth-port 1812 acct-port 1813 retransmit 1 key 7 1234567890987654321
!
control-plane
!
!
!
ccm-manager fax protocol cisco
!
!
line con 0
 logging synchronous
 login authentication clientauth
 escape-character 27
line aux 0
line vty 0 4
 logging synchronous
 login authentication clientauth
 transport input ssh
line vty 5 40
!
no scheduler allocate
ntp source Loopback0
ntp update-calendar
ntp server 192.53.103.103
end
Member: Dani
Dani Sep 08, 2010 at 16:49:03 (UTC)
Goto Top
Hi,
schau dir die Links mal an:
http://www.systemengineers.de/cisco/config/dsl-as-backup-line
http://www.systemengineers.de/cisco/config/dsl_backup

Leider habe ich keine Zeit es selber auszuprobieren.


Grüße,
Dani
Member: 1x1speed
1x1speed Dec 28, 2010 at 15:28:20 (UTC)
Goto Top
hallo,

mit split tunneling würde es gehen. hab jetzt im netz ein proxy eingerichtet, den die vpn nutzer einstellen müssen. ist eh sicherer.

danke und cheers!!!
GermansolvedQuestionNetworks
Hotly discussed
gleixnerdCheck of ZFW Firewallgleixnerd - 5 CommentsjstrickerWireguard VPN on UDM Pro behind Fritzbox - Handshake did not completejstricker - 3 CommentsAlexWishaHow to set up and configure a Linux GRE tunnelAlexWisha - 3 CommentsDaniEnd of Support dates for Office 2016, 2019 Apps und Productivity ServersDani - 1 Comment