871 VPN

Similar Questions

• 871 VPN outside the conection problem

  I have a router Cisco 871, which must be configured to allow outside laptops to connect to the corporate network.

  I used Easy VPN ServerWizard in CCP to create the configuration.

  After the use of VPN test, everything looks OK.

  Unfortunatlly I can not connect hollow VPN using the Microsoft VPN (Error 800) connection or VPN Cisco Client.

  Error 412: the remote peer is not responding.

  Any suggestions?

  Patryk,

  If you want to connect by using the windows VPN client, you can define PPTP on the router and optional MPPE encryption.

  Here's a good link:

  http://www.Cisco.com/en/us/Tech/tk827/tk369/technologies_configuration_example09186a00801e51e2.shtml

  Federico.

• The router 851 and 871 VPN issues still

  Main site

  1 - all connectivity-all thin - Web - database-email Mail - Proxy - ETC.

  2 - VPN Tunnel to the TOP

  Remote sites

  1 - VPN Tunnel to the TOP and tests

  1 cannot ping the main location of the 192.168.0.X (Yes any IP address)

  2 - could not get out to the Internet (GO HOLLOW PROXY SERVER 192.168.0.3 even if I could ping)

  3 could connect to the database but crashes right after the login screen. Can ping the address of 192.168.0.11 to this fine location database but the connection hangs and does not

  * HAND CONFIG

  crypto ISAKMP policy 1

  BA 3des

  md5 hash

  preshared authentication

  Group 2

  !

  crypto ISAKMP policy 3

  BA 3des

  md5 hash

  preshared authentication

  Group 2

  XXX address X.X.X.X isakmp encryption key

  XXX address X.X.X.X isakmp encryption key

  ISAKMP crypto keepalive 5 20

  !

  Crypto ipsec transform-set esp-3des esp-sha-hmac RIGHT

  !

  bssn 10 ipsec-isakmp crypto map

  Description VPN for PARK

  defined peer X.X.X.X

  Set transform-set RIGHT

  match address 100

  bssn 20 ipsec-isakmp crypto map

  VPN for Corneilia description

  defined peer X.X.X.X

  Set transform-set RIGHT

  match address 102

  bssn 30 ipsec-isakmp crypto map

  Description VPN to OAK

  defined peer X.X.X.X

  Set transform-set RIGHT

  match address 103

  bssn 40 ipsec-isakmp crypto map

  Description VPN to Herbert George Wells

  defined peer X.X.X.X

  Set transform-set RIGHT

  match address 104

  interface FastEthernet4

  WAN

  IP address 216.x.x.x 255.255.255.128 secondary

  IP 216.x.x.x 255.255.255.128.

  no ip redirection

  no ip unreachable

  no ip proxy-arp

  NAT outside IP

  IP virtual-reassembly

  route IP cache flow

  automatic duplex

  automatic speed

  card crypto bssn

  !

  interface Vlan1

  Entry door

  IP 216.X.X.X 255.255.255.248 secondary

  IP 192.168.0.11 255.255.255.0

  no ip redirection

  no ip unreachable

  IP nat inside

  IP virtual-reassembly

  route IP cache flow

  IP tcp adjust-mss 1452

  !

  IP classless

  IP route 0.0.0.0 0.0.0.0 216.x.x.x.

  !

  IP nat inside source overload map route interface FastEthernet4 sheep

  !

  recording of debug trap

  access-list 100 permit ip 192.168.0.0 0.0.0.255 192.168.1.0 0.0.0.255

  access-list 101 deny ip 192.168.0.0 0.0.0.255 192.168.1.0 0.0.0.255

  access-list 101 deny ip 192.168.0.0 0.0.0.255 192.168.6.0 0.0.0.255

  access-list 101 deny ip 192.168.0.0 0.0.0.255 192.168.7.0 0.0.0.255

  access-list 101 deny ip 192.168.0.0 0.0.0.255 192.168.5.0 0.0.0.255

  access-list 101 permit ip 192.168.0.0 0.0.0.255 any

  access-list 102 permit ip 192.168.0.0 0.0.0.255 192.168.6.0 0.0.0.255

  access-list 103 allow ip 192.168.0.0 0.0.0.255 192.168.7.0 0.0.0.255

  access-list 104. allow ip 192.168.0.0 0.0.0.255 192.168.5.0 0.0.0.255

  not run cdp

  sheep allowed 10 route map

  corresponds to the IP 101

  * REMOTE SITE

  crypto ISAKMP policy 1

  BA 3des

  md5 hash

  preshared authentication

  Group 2

  XXX address X.X.X.X isakmp encryption key

  ISAKMP crypto keepalive 5 20

  !

  !

  Crypto ipsec transform-set esp-3des esp-sha-hmac RIGHT

  !

  bssn 10 ipsec-isakmp crypto map

  Connect to main BSSN description

  defined peer X.X.X.X

  Set transform-set RIGHT

  match address 100

  interface FastEthernet4

  IP 216.X.X.X 255.255.255.224

  NAT outside IP

  IP virtual-reassembly

  automatic duplex

  automatic speed

  card crypto bssn

  !

  interface Vlan1

  Entry door

  IP 192.168.1.2 255.255.255.0

  IP directed broadcast to the

  IP nat inside

  IP virtual-reassembly

  IP tcp adjust-mss 1452

  !

  IP classless

  IP route 0.0.0.0 0.0.0.0 X.X.X.X

  IP http server

  local IP http authentication

  IP http secure server

  IP http timeout policy slowed down 60 life 86400 request 10000

  IP nat inside source overload map route interface FastEthernet4 sheep

  !

  access-list 100 permit ip 192.168.1.0 0.0.0.255 192.168.0.0 0.0.0.255

  access-list 101 deny ip 192.168.1.0 0.0.0.255 192.168.0.0 0.0.0.255

  access-list 101 permit ip 192.168.1.0 0.0.0.255 any

  not run cdp

  sheep allowed 10 route map

  corresponds to the IP 101

  Thank you

  Laughing out loud

  On the remote router access list 100 should look like:

  access-list 100 permit ip 192.168.1.0 0.0.0.255 any

  On the main router, the 100 access list should look like:

  access-list 100 permit ip any 192.168.1.0 0.0.0.255

  HTH,

  Kind regards

  Kamal

• Authentication PEAP wireless across the VPN tunnel

  We use routers for Cisco 871 VPN connectivity series. I'm testing the 871W for VPN and wireless connectivity. I am able to get the VPN but have problems with authentication using PEAP and authentication through active directory wireless. The problem is that my router is unable, because of the VPN connection, "talk" directly to my authentication server using the LAN ip address. I can get the authentication works if I pass the traffic through the internet, drill a hole in my firewall to complete the authentication process. This isn't my preferred method. What can I do to work around may lists VPN access that prevent my direct connectivity to my server?

  Are you able to ping to the ip address of the radius through the tunnel server?

  Try adding this:

  radius of the IP source-interface BVI1

  * Please rate if helped.

  -Kanishka

• Different networks on different Interfaces

  I suspect that the answer to this question is no, but it is possible to simultaneously run different routes on different interfaces via El Capitan?

  Here's my situation: I have a lot of work from home and rely on an endpoint of Cisco 871 VPN to drive my VoIP as workphone and connect my MBP to of the corporate network through the Thunderbolt Display.  At the same time, I have a NAS and a printer on my LAN, I connect to WiFi, I need to access.  Sure enough I could work this point in Linux, but my attempts on OS X, er, macOS were not successful with lots of horror.  The Cisco assigns a router by default for Ethernet display configuration, which I think is the culprit...

  Those about to give me lectures on corporate network security, I am aware, it defeats the purpose to isolate my end point of my network, but our network of offices is almost entirely jobs I need VNC/RDP to and I have permission assuming that I can make it work.

  Thank you very much

  MB

  Glance at the 'route' command from an Applications-> utilities-> Terminal Services session.

  You will have to Google to find examples of what you want to do.

  NOTE: I'm assuming that you are NOT any VPN software running on your Mac, and Cisco 871 is material external connects to work.  I mention this because usually a VPN on Mac software includes all of the network stack.  External VPN equipment would leave your single network interfaces to specify the different routes for your distinct interfaces.

• Installation easy vpn Cisco 871

  I have a Cisco 871 router sitting behind my adsl router and I have configured to accept vpn connections from clients from outside (partially configured by cli and partly by SDM).

  It works well, in that I can connect my LAN and access my network inside resources, however I can't access the web when connected via vpn.

  Is it perhaps to nat? I hope that someone can see why in my config. Thank you.

  Hi Chris,

  The only reason I understand here, customers lose their ability to achieve internet when connected by VPN is, according to the current configuration, all traffic (including the NetBIOS) runs through the tunnel. So when a package leaves the machine with a source of intellectual property (one of the private ip address of the pool set) of the client and the destination 4.2.2.2 (can be any ip on the internet), there is no translation defined for the ip address of the VPN client on the router.

  Thus, package from the computer of the customer with an address NON-Routable cannot access the internet for obivous reasons.

  To work around the problem, try this.

  access-list 5 by 192.168.1.0 0.0.0.255

  (assuming that 192.168.1.0 is that the VPN client subnet have access)

  Then,

  Crypto home isakmp client configuration group

  key xxxx

  ACL 5< binding="" the="" acl="">

  By creating the acl the binder to the configuration of the client, and 5 am Division of traffic in the tunnel. In other words, only for the 192.168.1.x subnet traffic will pass through the tunnel and rest will take the path of the LOCAL ISP.

  I hope this helps...!

  Concerning

  M.

• ASA VPN server and vpn client router 871

  Hi all

  I have ASA 5510 as simple VPN server and 871 router as simple VPN client. I want to have the user ID and permanent password on 871 and not to re - enter username and password since 871 uses dynamic IP address and every time I have to ' cry ipsec client ezvpn xauth "and type user name and password.

  any suggestions would be much appreciated.

  Thank you

  Alex

  Do "crypto ipsec client ezvpn show ' on 871, does say:

  ...

  Save password: refused

  ...

  ezVPN server dictates the client if it can automatically connect with saved password.

  Set "enable password storage" under the group policy on the ASA.

  Kind regards

  Roman

• VPN between ASA and 871

  Hello

  I'm setting up a VPN router between 871 and ASA 5505 for the first time and having a problem. I have attached my network diagram as well as the configuration of 871 and ASA. Although the VPN tunnel is coming for example sh crypto isakmp his watch QM_IDLE and Exchange ipsec SA is successuful as well, but none of the machine can access each other. Please help as I am in desperate need to operate.

  Thank you all,.

  Jérôme

  Hello

  It seems that you are missing some required configuration. See the link below...

  http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a00805e8c80.shtml

  HTH

  MS

  * Rate of useful messages *.

• Weird behavior of the router 871 on VPN tunnel

  Hi, I have established a tunnel VPN site to site with a cisco 871 to a cisco 2800. This drug is right and work. So, what's the problem? Let's see:

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  !

  map SDM_CMAP_1 6 ipsec-isakmp crypto

  Description Numintel

  defined by peer 213.192.208.242

  86400 seconds, life of security association set

  game of transformation-ESP-3DES-SHA

  match address 100

  !

  Archives

  The config log

  hidekeys

  !

  !

  !

  !

  !

  interface FastEthernet0

  !

  interface FastEthernet1

  !

  interface FastEthernet2

  !

  interface FastEthernet3

  !

  interface FastEthernet4

  IP 196.12.229.218 255.255.255.252

  NAT outside IP

  IP virtual-reassembly

  automatic duplex

  automatic speed

  map SDM_CMAP_1 crypto

  !

  interface Vlan1

  IP 192.169.15.100 255.255.255.0

  no ip redirection

  no ip proxy-arp

  IP nat inside

  IP virtual-reassembly

  !

  IP forward-Protocol ND

  IP route 0.0.0.0 0.0.0.0 196.12.229.217

  !

  !

  no ip address of the http server

  no ip http secure server

  the IP nat inside source 1 list the interface FastEthernet4 overload

  !

  access-list 1 local observation

  access-list 1 permit 192.169.15.0 0.0.0.255

  access-list 100 permit ip 192.169.15.0 0.0.0.255 192.168.3.0 0.0.0.255

  access-list 100 permit ip 192.169.15.0 0.0.0.255 192.168.4.0 0.0.0.255

  The thing is that when I apply list local access, lo leave the 192.169.15.0 guests have access to the internet, I can't reach the other end of the tunnel. (Say ping at 192.168.3.35). When I disable local access list: access-list 1 permit ip 192.169.15.0 0.0.0.255, the tunnel works. I can access the other end of the tunnel of any of the hosts to 192.169.15.0, but I don't have access to the internet. Can someone explain what is happening and how to fix? Thank you.

  Hello

  You have to do traffic IPsec NAT of derivation. Traffic IPsec must be denied in the access list. Use extended access list example:

  access-list 120 deny ip 192.169.15.0 0.0.0.255 192.168.3.0 0.0.0.255

  access-list 120 deny ip 192.169.15.0 0.0.0.255 192.168.4.0 0.0.0.255

  access-list 120 allow ip 192.169.15.0 0.0.0.255 any

  IP nat inside source interface FastEthernet4 list 120 overload

  HTH

  Sangaré

  Pls rate helpul messages

• Multiple VPN connections using 871 router

  Hello

  I have the cisco router 871 at the site of the retail that connects to the corporate site. I also want to connect a device to the sharing network partner, but it needs to connect to their virtual private network.  Is it possible to configure the 2 VPN connection to 2 different company sites in this scenario?

  Thanks for your help.

  Umesh.

  Hello

  You can configure multiple VPN tunnels on the router (whether on the same interface or different interfaces).

  You can then perform the traffic from a tunnel in another tunnel, if you must do the same.

  Federico.

• VPN site to Site on both ends using Cisco 871

  I would like to configure VPN Site to Site using the Cisco 871 templates at both ends, but a hard time to set it up. Can someone tell me how to do or if you know of a link that may help me set up as soon as possible?

  I can learn it, but it's time that banned me in the implementation. The other end is already configured to provide Internet access to all users.

  Tom,

  ########################################################################################

  Router 1 VPN config:

  Internal = 10.0.0.0/24
  Public = 196.1.161.65

  access-list 101 permit ip 10.0.0.0 0.0.0.255 10.193.12.0 0.0.3.255

  access-list 102 deny ip 10.0.0.0 0.0.0.255 10.193.12.0 0.0.3.255
  access-list 102 permit ip 10.0.0.0 0.0.0.255 any

  IP nat inside source list 102 in interface (check the name of the external interface) overload

  crypto ISAKMP policy 10
  3des encryption
  sha hash
  Group 2

  ISAKMP crypto key cisco123 address 196.1.161.66

  Crypto ipsec transform-set esp-3des esp-sha-hmac RIGHT

  MYmap 10 ipsec-isakmp crypto map
  defined by peer 196.1.161.66
  Set transform-set RIGHT
  match address 101

  interface (check the name of the interface inside)
  IP nat inside

  interface (check the name of the external interface)
  NAT outside IP
  crypto mymap map

  ########################################################################################

  Router 2 VPN config:

  Internal = 10.193.12.0/22
  Public = 196.1.161.66

  access-list 101 permit ip 10.193.12.0 0.0.3.255 10.0.0.0 0.0.0.255

  access-list 102 deny ip 10.193.12.0 0.0.3.255 10.0.0.0 0.0.0.255
  access-list 102 permit ip 10.193.12.0 0.0.3.255 all

  IP nat inside source list 102 in the fast4 interface overload

  crypto ISAKMP policy 10
  3des encryption
  sha hash
  Group 2

  ISAKMP crypto key cisco123 address 196.1.161.65

  Crypto ipsec transform-set esp-3des esp-sha-hmac RIGHT

  MYmap 10 ipsec-isakmp crypto map
  defined by peer 196.1.161.65
  Set transform-set RIGHT
  match address 101

  interface vlan1
  IP nat inside

  fast4 interface
  NAT outside IP
  crypto mymap map

  ########################################################################################

  The above is an example of configuration.
  It is always recommended to change the pre shared key to something else.

  Federico.

• VPN site to Site ASA 5510 and 871 w / dynamic IP

  What is the best method of creating a VPN site-to site between an ASA 5510 and a router 871 where the 5510 has a static IP address and has 871, a dynamic IP address?

  My ASA is running ASA software version 7.0 (5) and I can't find how to create a tunnel for a dynamic IP address via the ASDM. I have currently a tunnel between these two arrangements in place, but it was done by specifying the remote IP address, even if it is dynamic.

  Any suggestions or pointers would be * very * appreciated.

  -Adam

  This can help but it does not show ASDM.

  http://Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a00807ea936.shtml

• VPN site to Site with NAT and Port forwarding on a 871

  Hello

  Could someone please look at the config 871 router attached and tell me where I'm wrong!

  VPNs all work, work, BUT anyone trying to connect to a port that is sent through the VPN port forwarding fails.

  In the config attached Port 3389 (RDP) is sent to an internal server, if you connect to the external interface Internet connection is made and it works well, but if someone tries to connect to the IP address internal to that same server through VPN, it does not.

  We've added commands to stop working on the lines VPN NAT, but these do not seem to work.

  What Miss me?

  Thank you in advance and I will adjudicate all useful responses.

  It is a common problem. Yes you added controls to prevent NAT to work above the tunnel, but your static nat port to port 3389 takes precedence over the generic nat command, and there not all orders top to prevent it is nat would be above the tunnel.

  I wrote an example configuration for this some time, see here for more details:

  http://www.Cisco.com/en/us/Tech/tk583/TK372/technologies_configuration_example09186a0080094634.shtml

  If all goes well, he explains everything. Note that it is for a general order static host, not a static port that you have, but the concept is exactly the same. Just add a statement roadmap on the end of your static command of the port, and this route map - will reference an ACL that denies are used when going up above the tunnel.

• Router Cisco 871 as a VPN server

  Hello!

  I have a Cisco 871 router which I want to implement a VPN (PPTP) server at home, so that I could connect to it from outside (from an Internet café, for example).

  All I need is to be able to use my IP of the home across the world just by connecting to the VPN through PPTP. The router would be the only thing connected to the internet in my house and it is not all of the devices connected to the router. Remote access to my IP is all I need.

  The problem is that I have no idea how to do that.

  So I would really appreciate if someone could help me with this,

  Thank you!

  Read the below URL

  http://www.Cisco.com/en/us/products/ps5855/products_configuration_example09186a0080ab7073.shtml

  HTH >

• Pass Cisco 871 and VPN to the SBS 2008 Server

  to precede the questions below, I'm responsible for COMPUTING internal with several years of site / offsite support. I also have very limited knowledge of the inner workings of a Cisco device. That said, I've beaten my head against a wall, trying to configure my router Cisco 871 to allow access to our internal server of SBS 2008 VPN hosting services. I think I, and properly configured the SBS 2008 Server.

  I use advanced IP services, version 12.4 (4) T7

  Here is the \windows\system32\conifg\system running

  Building configuration...

  Current configuration: 9414 bytes
  !
  version 12.4
  no service button
  tcp KeepAlive-component snap-in service
  a tcp-KeepAlive-quick service
  horodateurs service debug datetime localtime show-timezone msec
  Log service timestamps datetime localtime show-timezone msec
  encryption password service
  sequence numbers service
  !
  hostname yourname
  !
  boot-start-marker
  boot-end-marker
  !
  Security of authentication failure rate 3 log
  Passwords security min-length 6
  logging buffered debugging 51200
  recording console critical
  enable secret 5 *.

  !
  No aaa new-model
  !
  resources policy
  !
  PCTime-5 timezone clock
  PCTime of summer time clock day April 6, 2003 02:00 October 26, 2003 02:00
  IP subnet zero
  no ip source route
  IP cef
  !
  !
  !
  !
  synwait-time of tcp IP 10
  no ip bootp Server
  "yourdomain.com" of the IP domain name
  name of the IP-server 65.24.0.168
  name of the IP-server 65.24.0.196
  property intellectual ssh time 60
  property intellectual ssh authentication-2 retries
  inspect the IP name DEFAULT100 appfw DEFAULT100
  inspect the IP name DEFAULT100 cuseeme
  inspect the IP name DEFAULT100 ftp
  inspect the IP h323 DEFAULT100 name
  inspect the IP icmp DEFAULT100 name
  inspect the IP name DEFAULT100 netshow
  inspect the IP rcmd DEFAULT100 name
  inspect the IP name DEFAULT100 realaudio
  inspect the name DEFAULT100 rtsp IP
  inspect the IP name DEFAULT100 sqlnet
  inspect the name DEFAULT100 streamworks IP
  inspect the name DEFAULT100 tftp IP
  inspect the IP udp DEFAULT100 name
  inspect the name DEFAULT100 vdolive IP
  inspect the name DEFAULT100 http urlfilter IP
  inspect the IP router-traffic tcp name DEFAULT100
  inspect the IP name DEFAULT100 https
  inspect the IP dns DEFAULT100 name
  urlfilter IP interface-source FastEthernet4
  property intellectual urlfilter allow mode on
  urlfilter exclusive-area IP Deny. Facebook.com
  refuse the urlfilter exclusive-domain IP. spicetv.com
  refuse the urlfilter exclusive-domain IP. AddictingGames.com
  urlfilter exclusive-area IP Deny. Disney.com
  urlfilter exclusive-area IP Deny. Fest
  refuse the urlfilter exclusive-domain IP. freeonlinegames.com
  refuse the urlfilter exclusive-domain IP. hallpass.com
  urlfilter exclusive-area IP Deny. CollegeHumor.com
  refuse the urlfilter exclusive-domain IP. benmaller.com
  refuse the urlfilter exclusive-domain IP. gamegecko.com
  refuse the urlfilter exclusive-domain IP. ArmorGames.com
  urlfilter exclusive-area IP Deny. MySpace.com
  refuse the urlfilter exclusive-domain IP. Webkinz.com
  refuse the urlfilter exclusive-domain IP. playnow3dgames.com
  refuse the urlfilter exclusive-domain IP. ringtonemecca.com
  refuse the urlfilter exclusive-domain IP. smashingames.com
  urlfilter exclusive-area IP Deny. Playboy.com
  refuse the urlfilter exclusive-domain IP. pokemoncrater.com
  refuse the urlfilter exclusive-domain IP. freshnewgames.com
  refuse the urlfilter exclusive-domain IP. Toontown.com
  urlfilter exclusive-area IP Deny .online-Funny - Games.com
  urlfilter exclusive-area IP Deny. ClubPenguin.com
  refuse the urlfilter exclusive-domain IP. hollywoodtuna.com
  refuse the urlfilter exclusive-domain IP. andkon.com
  urlfilter exclusive-area IP Deny. rivals.com
  refuse the urlfilter exclusive-domain IP. moregamers.com
  !
  policy-name appfw DEFAULT100
  http request
  port-bad use p2p action reset alarm
  port-abuse im action reset alarm
  Yahoo im application
  default action reset service
  service-chat action reset
  Server deny name scs.msg.yahoo.com
  Server deny name scsa.msg.yahoo.com
  Server deny name scsb.msg.yahoo.com
  Server deny name scsc.msg.yahoo.com
  Server deny name scsd.msg.yahoo.com
  Server deny name messenger.yahoo.com
  Server deny name cs16.msg.dcn.yahoo.com
  Server deny name cs19.msg.dcn.yahoo.com
  Server deny name cs42.msg.dcn.yahoo.com
  Server deny name cs53.msg.dcn.yahoo.com
  Server deny name cs54.msg.dcn.yahoo.com
  Server deny name ads1.vip.scd.yahoo.com
  Server deny name radio1.launch.vip.dal.yahoo.com
  Server deny name in1.msg.vip.re2.yahoo.com
  Server deny name data1.my.vip.sc5.yahoo.com
  Server deny name address1.pim.vip.mud.yahoo.com
  Server deny name edit.messenger.yahoo.com
  Server deny name http.pager.yahoo.com
  Server deny name privacy.yahoo.com
  Server deny name csa.yahoo.com
  Server deny name csb.yahoo.com
  Server deny name csc.yahoo.com
  audit stop trail
  aol im application
  default action reset service
  service-chat action reset
  Server deny name login.oscar.aol.com
  Server deny name toc.oscar.aol.com
  Server deny name oam - d09a.blue.aol.com
  audit stop trail
  !
  !
  Crypto pki trustpoint TP-self-signed-1955428496
  enrollment selfsigned
  name of the object cn = IOS - Self - signed - certificate - 1955428496
  revocation checking no
  rsakeypair TP-self-signed-1955428496
  !
  !
  TP-self-signed-1955428496 crypto pki certificate chain
  certificate self-signed 01
  308201B 8 A0030201 02020101 3082024F 300 D 0609 2A 864886 F70D0101 04050030
  2 060355 04031326 494F532D 53656 C 66 2 AND 536967 6E65642D 43657274 31312F30
  69666963 31393535 34323834 6174652D 3936301E 170 3032 30333031 30303035
  33315A 17 0D 323030 31303130 30303030 305A 3031 06035504 03132649 312F302D
  4F532D53 5369676E 656C662D 43 65727469 66696361 74652 31 39353534 65642D
  32383439 3630819F 300 D 0609 2A 864886 01050003, 818, 0030, 81890281 F70D0101
  8100CB6B E980F044 5FFD1DAE CBD35DE8 E3BE2592 DF0B2882 2F522195 4583FA03
  40F4DAC6 CEAD479F A92607D4 1 B 033714 51C3A84D EA837959 F5FC6508 4D71F8E6
  5B124BB3 31F0499F B0E871DB AF354991 7D45F180 5D8EE435 77C8455D 2E46DE46
  67791F49 44407497 DD911CB7 593E121A 0892DF33 3234CF19 B2AE0FFD 36A640DC
  2 010001 HAS 3 990203 AND 77307530 1 130101 FF040530 030101FF 30220603 0F060355 D
  1104 1B 301982 17796F75 726E616D 652E796F 7572646F 6D61696E 2E636F6D 551D
  301F0603 C 551 2304 18301680 145566 4581F9CD 7 5F1A49FB 49AC9EC4 678908FF
  2A301D06 04160414 5566 745 81F9CD5F 1A49FB49 AC9EC467 8908FF2A 03551D0E
  300 D 0609 2A 864886 818100B 3 04050003 903F5FF8 A2199E9E EA8CDA5D F70D0101
  60B2E125 AA3E511A C312CC4F 0130563F 28D3C813 99022966 664D52FA AB1AA0EE
  9A5C4823 6B19EAB1 7ACDA55F 6CEC4F83 5292 HAS 867 BFC65DAD A2391400 DA12860B
  5A 523033 E6128892 B9BE68E9 73BF159A 28D47EA7 76E19CC9 59576CF0 AF3DDFD1
  3CCF96FF EB5EB4C9 08366F8F FEC944CA 248AC7
  quit smoking
  secret of username admin privilege 15 5 *.

  !
  !
  Policy-map sdmappfwp2p_DEFAULT100
  !
  !
  !
  !
  !
  !
  interface FastEthernet0
  !
  interface FastEthernet1
  !
  interface FastEthernet2
  !
  interface FastEthernet3
  !
  interface FastEthernet4
  Description $$$ FW_OUTSIDE$ $ES_WAN$ ETH - WAN
  address IP dhcp client id FastEthernet4
  IP access-group 101 in
  no ip redirection
  no ip unreachable
  no ip proxy-arp
  NAT outside IP
  inspect the DEFAULT100 over IP
  IP virtual-reassembly
  route IP cache flow
  automatic duplex
  automatic speed
  sdmappfwp2p_DEFAULT100 of service-policy input
  out of service-policy sdmappfwp2p_DEFAULT100
  !
  interface Vlan1
  Description $ETH - SW - LAUNCH$ $INTF - INFO - HWIC-$4ESW $ES_LAN$ $FW_INSIDE$
  the IP 192.168.0.1 255.255.255.0
  IP access-group 100 to
  no ip redirection
  no ip unreachable
  no ip proxy-arp
  IP nat inside
  IP virtual-reassembly
  route IP cache flow
  IP tcp adjust-mss 1452
  !
  IP classless
  !
  !
  IP http server
  local IP http authentication
  IP http secure server
  IP http timeout policy slowed down 60 life 86400 request 10000
  the IP nat inside source 1 list the interface FastEthernet4 overload
  IP nat inside source static tcp 192.168.0.100 1723 1723 interface FastEthernet4
  IP nat inside source static tcp 192.168.0.100 25 25 FastEthernet4 interface
  IP nat inside source static tcp interface 192.168.0.100 80 80 FastEthernet4
  IP nat inside source static tcp 192.168.0.100 interface FastEthernet4 443 443
  IP nat inside source static tcp 192.168.0.100 interface FastEthernet4 987 987
  !
  recording of debug trap
  Note access-list 1 INSIDE_IF = Vlan1
  Remark SDM_ACL category of access list 1 = 2
  access-list 1 permit 192.168.0.0 0.0.0.255
  access-list 100 remark self-generated by the configuration of the firewall Cisco SDM Express
  Access-list 100 = 1 SDM_ACL category note
  access-list 100 deny ip 255.255.255.255 host everything
  access-list 100 deny ip 127.0.0.0 0.255.255.255 everything
  access ip-list 100 permit a whole
  access list 101 remark self-generated by the configuration of the firewall Cisco SDM Express
  Note access-list 101 = 1 SDM_ACL category
  access-list 101 permit tcp any any eq 1723
  access-list 101 permit tcp any any eq 987
  access-list 101 permit tcp any any eq 443
  access-list 101 permit tcp any any eq www
  access-list 101 permit tcp any any eq smtp
  access-list 101 permit udp host 65.24.0.169 eq field all
  access-list 101 permit udp host 65.24.0.168 eq field all
  access-list 101 permit udp host 24.29.1.219 eq field all
  access-list 101 permit udp host 24.29.1.218 eq field all
  access-list 101 permit udp any eq bootps any eq bootpc
  access-list 101 deny ip 192.168.0.0 0.0.0.255 any
  access-list 101 permit icmp any any echo response
  access-list 101 permit icmp any one time exceed
  access-list 101 permit everything all unreachable icmp
  access-list 101 deny ip 10.0.0.0 0.255.255.255 everything
  access-list 101 deny ip 172.16.0.0 0.15.255.255 all
  access-list 101 deny ip 192.168.0.0 0.0.255.255 everything
  access-list 101 deny ip 127.0.0.0 0.255.255.255 everything
  access-list 101 deny ip 255.255.255.255 host everything
  access-list 101 deny ip any one
  not run cdp
  !
  !
  control plan
  !
  connection of the banner ^ CCCCCAuthorized access only!
  Unplug IMMEDIATELY if you are not an authorized user. ^ C
  !
  Line con 0
  local connection
  no activation of the modem
  telnet output transport
  line to 0
  local connection
  telnet output transport
  line vty 0 4
  privilege level 15
  local connection
  transport input telnet ssh
  !
  max-task-time 5000 Planner
  Scheduler allocate 4000 1000
  Scheduler interval 500
  end

  All that top has been configured with the SDM interface. I hope someone here can take a look at this and see what my question is, and why I can't connect through the router.

  All thanks in advance to help me with this.

  Jason

  Based on your description, I am assuming that you are trying the traffic PPTP passthrough via the router 871, and the PPTP Protocol ends on your SBS 2008 Server.

  If this is the correct assumption, PPTP uses 2 protocols: TCP/1723 and GRE. Your configuration only allow TCP/1723, but not the GRE protocol.

  On 101 ACL, you must add "allow accord any any" before the declarations of refusal:

  101 extended IP access list

  1 allow any one

  I guess that the PPTP control connection works fine? Are you able to telnet to the router outside the ip address of the interface on port 1723?