EIGRP on VPN

I've set up VPN between a hub and two rays. The tunnels are in place and I can ping the public interface and the interface of tunnel from the Hub to the spokes. EIGRP works internal to each spoke and hub. However, I can't EIGRP across the VPN. I removed the statement of the network from the public interface and replace it with the Ip address of the Tunnel. I can't move because Nobody knows how to get anywhere. The Centre will have another connection directly to the internet for all www traffic. I have not tried that I have to get through the VPN routing.

You must configure the ACCORD over the VPN tunnels. This will allow talking EIGRP routers. Dynamic routing protocols do not work over VPN with GRE tunnels.

Tags: Cisco Security

Similar Questions

A Site at IOS IPSEC VPN and EIGRP

Hello

I have a connection of remote site to base via a VPN IPSEC router. I don't want to run EIGRP accoss VPN. Howerver I want adverstise the rest of the network from the router of core of the subnet to the remote site.

The remote VPN subnet is managed as a route connected on the router base?

Configuriguring a statement of network to the remote site on the router base will cause EIGRP announce the road?

You are right.

RRI (reverse Route Injection) is the correct way to announce remote routes as static routes on the HUB, and all what you need to do is redistribute static in EIGRP, so she is redistributed in your EIGRP.

Here is an example configuration:

http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a00809d07de.shtml

(It's about OSPF and IPSec VPN dynamics, however, the concept is the same for ipsec site-to-site and redistribution in EIGRP)

Hope that helps.

IP address of the IPSec VPN client did not get distributed via EIGRP

We use an ASA for VPN remote access. He is running EIGRP redistribute static routes. When a client Anyconnect SSL connects, the SAA creates a static route for this client, and it gets redistributed via EIGRP. When an IPSec VPN client connects, the SAA creates a static route for this customer, but he isn't redisributed via EIGRP and so the client can not achieve anything. Why he would distribute a static created by an IPSec client?

Thank you

Have you set up IPP on dynamic Cryptography?

EIGRP via IPSec site to site VPN

having trouble getting to work through an IOS EIGRP (2ea. 2811 s) connection of the site to site VPN IPSec peer. IPSec VPN works with route directions static tunnel. By using the IPSec policy basis and VTI interface:

crypto ISAKMP policy 1

preshared authentication

Group 2

ISAKMP crypto key "" address 192.168.x.66

!

Crypto ipsec transform-set esp-3des esp-sha-hmac vpn

Crypto ipsec df - game

!

static-crypt 6 map ipsec-isakmp crypto

the value of 192.168.x.66 peer

Set transform-set vpn

match address 101

!

tunnel1 interface

IP address 1xx.33.20.226 255.255.255.252

no ip redirection

IP 1400 MTU

IP tcp adjust-mss 1360

QoS before filing

source of tunnel FastEthernet 0/0

destination 192.168.x.66 tunnel

crypto static crypto map

!

interface FastEthernet 0/0

Add an IP...

crypto static crypto map

!

Router eigrp 10

passive-interface default

no passive-interface FastEthernet 0/1

no passive-interface Tunnel1

network...

network...

No Auto-resume

!

IP route 0.0.0.0 0.0.0.0 Tunnel1

IP route 0.0.0.0 0.0.0.0 146.33.20.225<-- peer's="" default-gateway="" is="" vpn="" peer="" router="" on="" other="" side="" of="" satelite="">

must be something simple, but I can't.

Thank you, kevin

Unfamiliar with the VTI, but I think you are missing:

ipv4 ipsec tunnel mode

Profile of tunnel ipsec protection

Also don't think that you need crypto card in the tunnel because it is already on fa0/0. What looks like the access-list 101? Take a look at this doc:

http://www.ciscosystems.com/en/us/docs/iOS/12_3t/12_3t14/feature/guide/gtIPSctm.html

two links to remote sites (an eigrp, vpn)

I have an eigrp existing link to the remote site, now I'm going to set up a tunnel using ASA vpn to ASA. Website allows full access to site B, Site B allows access to site a. If my link down EIGRP, can take the VPN link?

How to start the VPN connection?

Paul

I am attaching a schema for you please take a look. That's what I would have done it. Don't know if it reflects what your management. Keep things simple and not very complicated. If a site has multiple internet connection uses one. First step get up the network and stable using a connection once your sites are converted burn in during a few weeks before you do add vpn double gre tunnels

I can't really say what would be best in your case, as I don't know your business is or how things effect users. Everything so I can give a suggestion that you may have to change as a result of your needs and objectives

Thank you

NH

Announcement of network user VPN via eigrp route

I can't have the VPN client user network advertising via eigrp, here is what I have so far. 10.55.1.0 is not announced.

Router eigrp xx

No Auto-resume

no default - information in

no default-information

by default 10000 100 255 1 1500 metric

Network 10.55.0.0 255.255.255.0

Network 10.55.1.0 255.255.255.0

passive-interface default

no interface passive inside

redistribute static

I already have about 30 static routes and they have redistributed successfully, the only way I can think to announce that the VPN, it is inside the neighbor is using a card of route-attached to the static method redistribute. The ACL roadmap would then 30 networks of the static routes in and the VPN. I really don't want to do that. Because every time someone adds a new static route, they would also have to be added to the ACL for the road map. Any ideas appriciated.

Hi Matthew,

Please, add the following command under your dynamic crypto map:

test of dynamic-map of crypto-map 10

the value reverse-road

HTH.

Portu.

Static route of VPN in EIGRP redistribution (FD is Inaccessible)

Hi all

I redistribute the site to site VPN static route in EIGRP, but what I noticed on the 6509 when I sh ip eigrp 200 topol, the static route to the ASA "FD is inaccessible."

6509 output:

Topology EIGRP-IPv4 for AS(200)/ID(10.33.95.34 table)

Code: P - passive, A - Active, U - update, Q - Query, R - reply,.

r response status, s - AIS status

P 199.x.x.240/28, successors 1, FD 53760, tag is 36539

through reallocation (53760/0)

P 10.64.129.0/24, successors 1, FD is 28416

Via 10.210.98.200 (28416/28160), Vlan98

P 10.1.2.0/24, 0 successors, FD is Inaccessible

Via 10.210.98.200 (28416/28160), Vlan98

P 10.210.98.0/24, successors 1, FD is 2816

Via connected, Vlan98

ASA5510 output:

Topology EIGRP-IPv4 for AS(200)/ID(10.64.129.253 table)

Code: P - passive, A - Active, U - update, Q - Query, R - reply,.

r response status, s - AIS status

P 10.1.2.0 255.255.255.0 successors 1, FD is 28160

Via Rstatic (28160/0)

P 10.64.129.0 255.255.255.0 successors 1, FD is 28160

Via connected, Ethernet0/0

P 199.x.x.240 255.255.255.240, successors 1, FD 79360, tag is 36539

Via 10.210.98.254 (79360/53760), Ethernet0/1

P 10.210.98.0 255.255.255.0 successors 1, FD is 28160

Via connected, Ethernet0/1

The ASA config:

200SW_EIGRP list standard access allowed 10.1.2.0 255.255.255.0

permissible static in eigrp route map 10

200SW_EIGR match ip address

Router eigrp 200

redistribute static static in eigrp route map

external route 10.1.2.0 255.255.255.0 x.x.x.

Thank you

Thomas,

When the flight director is not accessible in the EIGRP topology table, the router does not use this EIGRP route in its routing table.

Probably, the road is overridden by any other routing protocol that has the lowest administrative distance.

Could you please share the routing table?

Thank you.

DMVPN BGP and EIGRP

I am in the initial phase of research DMVPN. We currently have an MPLS network running BGP. Each site has Internet at home as well as a VPN site-to-site is built on the router and talks to an ASA when the SPLM fails.

I want to implement DMVPN to do away with the site to site VPN and ASA. I'm going to run EIGRP on routers to connect DMVPN. Are there any good whitepapers on BGP as the main path and by EIGRP on the DMVPN as a backup? Or no focus on a general config?

Thank you

It's really the main issue.

With your configuration DMVPN roads will be internal EIGRP of an advertisement of 90, so your default DC prefer DMVPN on MPLS, which is exactly what you don't want.

There are several ways around this as summarizing through DMPVN, redistribution connected on the sites of the branch in EIGRP so roads DMVPN are external as well and then changing measures etc.

The other alternative I have ever done so it's for your information is really Cisco have what is called a solution IWAN where DMVPN is performed everywhere that is, even through the MPLS network.

That would solve your problem of external routes internal EIGRP but IWAN vs is much more than just that, even if you do not need necessarily to implement the entire solution at a time.

I just thought that it should be mentioned, and if you want more information on this I can direct you to the design guide.

Jon

Redistribution of Routes between OSPF and EIGRP

We have a network of test with the topology below. We have two networks connected to a L3 switch. Both networks have an ASA firewall with a tunnel from site to site between them. They also have a connection in conjunction with each other. We want to implement a scenerio where the concert connection is the main route but if that route fails, then it switches to the routethat is above the tunnel from site to site. We have eigrp running on two basic switches so that the roads on the concert connection function properly. However Networking cannot be learned on the second road that goes over the vpn tunnel. We have running ospf on the asa and we are redistrubuting routes in eigrp. Which apparently correct? Look like the SAA they learn on ospf routes correctly however when we go to basic switches and show ip eigrp topology we do not see the routes possible successor. Any ideas on how to make this work?

Hello

The initial Setup looks that you have summarized automatic enabled on core switches, also to the asa eigrp process your redistribution measures doesn't look right about the delay/load/reliability-whats the reasoning behind this? Could you try the following:

Switch main 1 & 2

Router eigrp 100

No Auto-resume

ASA 1 & 2

Router eigrp 100

Redistribute ospf 1 100000 1 255 1 1500 metric

Could you also post the out-of - show ip eigrp topology all-links

RES

Paul

Please do not forget to note all messages that have been useful.

Thank you.

routing of traffic between vpn tunnels

Hello

I have a scenario like that.

There are two branch office vpn tunnels to the headquarters. I want to load balance the traffic on this two links using EIGRP.

in this way, another branch offic is also connected to the head office. now, I want to ensure the communication between two branch of the office through seat over these vpn tunnels.

Concerning

skrao

Hello

Here is a great link that describes a similar setup to yours:

http://www.Cisco.com/en/us/Tech/tk583/TK372/technologies_configuration_example09186a008009438e.shtml

Good reading and after return if there is anything that you are not clear.

PLS, don't forget to rate messages.

Paresh

Branch 5505, 1 circuit ISP, Dual - peer VPN Configuration for Data Center & Track Options

Hi all

I have a data center with two lines of ISP redundancy and two ASA 5520 for redundancy VPN to my branches. Each of my branches has 1 ASA 5505 with a base license and 1 ISP circuit. Currently all my VPN tunnels are built for data center main circuit ISP only, so if one goes down, I'm toast. I need to fix this. Problem is, I don't know how I can control failover on 5505 with 1 single line branch. Please see my picture for an example of how he looks at it right now.

So the problem is that the data center LAN my branch has to go to is identical regardless of which circuit of data center is in the. And I know the ASA rules say only 1 VPN tunnel can be active at a time if flow are the same. So in this case, I know you usually do:

card crypto outside_map 1 set 12.x.xxx.20 50.xxx.xx.190 counterpart

and then configure route followed to control when cut down the primary counterpart and turn back up by peers. But where I have only 1 ISP on the side of the branch, I'll only have 1 default route: route outside 0.0.0.0 0.0.0.0 3.3.3.2 1, will be used that the active end counterpart is the primary or the secondary data center. Also, since I did not have a second track, I can't configure followed on the main road with an SLA that defines the trigger conditions, because there is nothing to ensure the follow-up of the routing.

How is - a would handle a situation like this? Are there other features that can be taken off the roads? I really need to be able to define "num-package 5 ' in ALS so my sites are not beat all day, but once again, without something to follow, I can't really set up a meaningful SLAS. Any help is appreciated.

Thanks for the additional explanation. It helps to clarify your environment. EIGRP running on the Remote would be a nice option, but I'm not sure that it is supported on the SAA. I ran EIGRP to remote peers using IOS routers (using the two ACCORD with IPsec and VTI tunnels tunnels) and it was very effective. But on the SAA, I believe that we must seek an alternative.

It seems to me that using reverse road Injection as part of your VPN site-to-site should work. With IPP the ASA inserts a static route to remote resources when the VPN tunnel is negotiated and traffic can flow. If you redistribute the static in EIGRP EIGRP then must learn the ways of any ASA a currently active tunnel. And who should provide the dynamic rollover you need.

HTH

Rick

Remote access VPN VPN Ping from ASA clients

I would like to know if it is normal to not being able to traceroute or ping for VPN clients connected from the ASA command line? The VPN client and the connection works well at the moment. I can't ping / connect to the VPN and vice versa internal hosts. I can't ping however the ASA VPN client IP address himself well. I'm so split tunnel but that seems to work correctly based on the determination of route I ran.

Can I have an IKEv1 and IKEv2 for VPN IPSEC configuration? I try to keep the IKEv1 VPN for the legacy Cisco VPN client while I began to roll on the AnyConnect IKEv2 client. Just end up creating a new configuration of VPN for the AnyConnect VPN (easier)?

What is the purpose of the injection of the route the other way around? It seems to be against intuitive. I was hoping it say for VPN DHCP pool 32 come to me so I would not add static routes on my heart to point to the ASA for these ranges. This ASA is reserved for the VPN firewall not this traffic is not normally head to it. Right now I have just the static route for the 24 I use in the DHCP pool on carrots. I have of course the possibility to redistribute the beach many other ways with EIGRP / OSPF / RIP it seems to me that RRI was a nice way to do, but it doesn't seem to be.

It probably all comes from me probably do not understand exactly how bits to pass through the firewall to the actual machine of the VPN client. You see only not an interface layer 3 for part of the ASA in the tunnel, according to me, is part of what confuses me.

Basically, I followed this guide and added split tunnel and aaa via RADIUS which seem to work well. I can't emphasize enough that for all intent and purposes, it seems that the VPN works as it should now. Wait for this time I broke it a few hours while I was playing with various other orders lol.

Thank you

Tim

Reference:
ASA 5505 (base right now, license #labgear) 9.2 (4) running

It is normal to not be able to ping remote VPN clients to the ASA's. To be able to do outside the ASA IP address must be included in the field of encryption, which is not normally.

Yes, you can use IKEv1 and IKEv2 at the same time. However if you change consider using SSL. It is best taken in charge and less painful.

If you choose to ignore this advice, then I would create a new IKEv2 VPN rather than modify the existing and then migrate users through him.

The reverse route injection does exactly what you describe. They appear as static routes on the SAA, you will then need to redistribute in any routing protocol you like. I wouldn't normally use for traffic of users, but for the traffic of a site when managing more complex failover scenarios.

I recommend to stick to the single 24 static road in your kernel.

Tunnel VPN site to Site with 2 routers Cisco 1921

Hi all

So OK, I'm stumped. I create much s2s vpn tunnels before, but this one I just can't go there. It's just a tunnel VPN Site to Site simple using pre-shared keys. I would appreciate it if someone could take a look at our configs for both routers running and provide a comment. This is the configuration for both routers running. Thank you!

Router 1

=======

Current configuration: 4009 bytes

!

! Last configuration change at 19:01:31 UTC Wednesday, February 22, 2012 by asiuser

!

version 15.0

horodateurs service debug datetime msec

Log service timestamps datetime msec

no password encryption service

!

SJWHS-RTRSJ host name

!

boot-start-marker

boot-end-marker

!

!

No aaa new-model

!

!

!

!

No ipv6 cef

IP source-route

IP cef

!

!

DHCP excluded-address 192.168.200.1 IP 192.168.200.110

DHCP excluded-address IP 192.168.200.200 192.168.200.255

!

IP dhcp POOL SJWHS pool

network 192.168.200.0 255.255.255.0

default router 192.168.200.1

10.10.2.1 DNS server 10.10.2.2

!

!

no ip domain search

IP-name 10.10.2.1 Server

IP-name 10.10.2.2 Server

!

Authenticated MultiLink bundle-name Panel

!

!

Crypto pki trustpoint TP-self-signed-236038042

enrollment selfsigned

name of the object cn = IOS - Self - signed - certificate - 236038042

revocation checking no

rsakeypair TP-self-signed-236038042

!

!

TP-self-signed-236038042 crypto pki certificate chain

certificate self-signed 01

30820241 308201AA A0030201 02020101 300 D 0609 2A 864886 F70D0101 04050030

8B1E638A EC

quit smoking

license udi pid xxxxxxxxxx sn CISCO1921/K9

!

!

!

redundancy

!

!

!

!

crypto ISAKMP policy 10

md5 hash

preshared authentication

ISAKMP crypto key presharedkey address 112.221.44.18

!

!

Crypto ipsec transform-set esp-3des esp-md5-hmac IPSecTransformSet1

!

map CryptoMap1 10 ipsec-isakmp crypto

defined by peer 112.221.44.18

game of transformation-IPSecTransformSet1

match address 100

!

!

!

!

!

interface GigabitEthernet0/0

192.168.200.1 IP address 255.255.255.0

automatic duplex

automatic speed

!

!

interface GigabitEthernet0/1

Description wireless bridge

IP 172.17.1.2 255.255.255.0

automatic duplex

automatic speed

!

!

interface FastEthernet0/0/0

Verizon DSL description for failover of VPN

IP 171.108.63.159 255.255.255.0

automatic duplex

automatic speed

card crypto CryptoMap1

!

!

!

Router eigrp 88

network 172.17.1.0 0.0.0.255

network 192.168.200.0

redistribute static

passive-interface GigabitEthernet0/0

passive-interface FastEthernet0/0/0

!

IP forward-Protocol ND

!

no ip address of the http server

local IP http authentication

IP http secure server

!

IP route 0.0.0.0 0.0.0.0 172.17.1.1

IP route 112.221.44.18 255.255.255.255 171.108.63.1

!

access-list 100 permit ip 192.168.200.0 0.0.0.255 10.10.0.0 0.0.255.255

!

!

!

!

!

!

control plan

!

!

!

Line con 0

Synchronous recording

local connection

line to 0

line vty 0 4

exec-timeout 30 0

Synchronous recording

local connection

transport input telnet ssh

!

Scheduler allocate 20000 1000

end

=======

Router 2

=======

Current configuration: 3719 bytes

!

! Last configuration change at 18:52:54 UTC Wednesday, February 22, 2012 by asiuser

!

version 15.0

horodateurs service debug datetime msec

Log service timestamps datetime msec

no password encryption service

!

SJWHS-RTRHQ host name

!

boot-start-marker

boot-end-marker

!

logging buffered 1000000

!

No aaa new-model

!

!

!

!

No ipv6 cef

IP source-route

IP cef

!

!

!

!

no ip domain search

!

Authenticated MultiLink bundle-name Panel

!

!

Crypto pki trustpoint TP-self-signed-3490164941

enrollment selfsigned

name of the object cn = IOS - Self - signed - certificate - 3490164941

revocation checking no

rsakeypair TP-self-signed-3490164941

!

!

TP-self-signed-3490164941 crypto pki certificate chain

certificate self-signed 01

30820243 308201AC A0030201 02020101 300 D 0609 2A 864886 F70D0101 04050030

2 060355 04031326 494F532D 53656 C 66 2 AND 536967 6E65642D 43657274 31312F30

EA1455E2 F061AA

quit smoking

license udi pid xxxxxxxxxx sn CISCO1921/K9

!

!

!

redundancy

!

!

!

!

crypto ISAKMP policy 10

md5 hash

preshared authentication

ISAKMP crypto key presharedkey address 171.108.63.159

!

86400 seconds, duration of life crypto ipsec security association

!

Crypto ipsec transform-set esp-3des esp-md5-hmac IPSecTransformSet1

!

map CryptoMap1 10 ipsec-isakmp crypto

defined by peer 171.108.63.159

game of transformation-IPSecTransformSet1

match address 100

!

!

!

!

!

interface GigabitEthernet0/0

no ip address

automatic duplex

automatic speed

!

!

interface GigabitEthernet0/0.1

encapsulation dot1Q 1 native

IP 10.10.1.6 255.255.0.0

!

interface GigabitEthernet0/1

IP 172.17.1.1 255.255.255.0

automatic duplex

automatic speed

!

!

interface FastEthernet0/0/0

IP 112.221.44.18 255.255.255.248

automatic duplex

automatic speed

card crypto CryptoMap1

!

!

!

Router eigrp 88

Network 10.10.0.0 0.0.255.255

network 172.17.1.0 0.0.0.255

redistribute static

passive-interface GigabitEthernet0/0

passive-interface GigabitEthernet0/0.1

!

IP forward-Protocol ND

!

no ip address of the http server

local IP http authentication

IP http secure server

!

IP route 0.0.0.0 0.0.0.0 112.221.44.17

!

access-list 100 permit ip 10.10.0.0 0.0.255.255 192.168.200.0 0.0.0.255

!

!

!

!

!

!

control plan

!

!

!

Line con 0

Synchronous recording

local connection

line to 0

line vty 0 4

exec-timeout 30 0

Synchronous recording

local connection

transport input telnet ssh

!

Scheduler allocate 20000 1000

end

When the GRE tunnel carries your traffic to private ip range, your ACL must contain address of the host of point to point the IPSec tunnel.

Since then, both routers are running EIGRP in the corporate network, let the EIGRP Exchange routes via GRE tunnel, which is a good practice, rather than push the ip ranges private individual through the IPSec tunnel.

Let me know, if that's what you want.

Thank you

Cannot access internal network so AnyConnect SSL VPN, ASA 9.1 (6)

Hello Cisco community support,

I have a lab which consists of two virtual environments connected to a 3750-G switch that is connected to a 2901 router which is connected to an ASA 5512 - X which is connected to my ISP gateway. I configured SSL VPN using AnyConnect and can establish a VPN to the ASA from the outside but once connected, I can't access internal network resources or access the internet. My information network and ASA configuration is listed below. Thank you for any assistance you can offer.

ISP network gateway: 10.1.10.0/24

ASA to the router network: 10.1.40.0/30

Pool DHCP VPN: 10.1.30.0/24

Network of the range: 10.1.20.0/24

Development network: 10.1.10.0/24

: Saved
:
: Serial number: FCH18477CPT
: Material: ASA5512, 4096 MB RAM, CPU Clarkdale 2793 MHz, 1 CPU (2 cores)
:
ASA 6,0000 Version 1
!
hostname ctcndasa01
activate bcn1WtX5vuf3YzS3 encrypted password
names of
cnd-vpn-dhcp-pool 10.1.30.1 mask - 255.255.255.0 IP local pool 10.1.30.200
!
interface GigabitEthernet0/0
nameif inside
security-level 100
IP 10.1.40.1 255.255.255.252
!
interface GigabitEthernet0/1
nameif outside
security-level 0
address IP X.X.X.237 255.255.255.248
!
interface GigabitEthernet0/2
Shutdown
No nameif
no level of security
no ip address
!
interface GigabitEthernet0/3
Shutdown
No nameif
no level of security
no ip address
!
interface GigabitEthernet0/4
Shutdown
No nameif
no level of security
no ip address
!
interface GigabitEthernet0/5
Shutdown
No nameif
no level of security
no ip address
!
interface Management0/0
management only
nameif management
security-level 100
IP 192.168.1.1 255.255.255.0
!
boot system Disk0: / asa916-1-smp - k8.bin
boot system Disk0: / asa912-smp - k8.bin
passive FTP mode
permit same-security-traffic intra-interface
network of the NETWORK_OBJ_10.1.30.0_24 object
10.1.30.0 subnet 255.255.255.0
network obj_any object
network obj_10.1.40.0 object
10.1.40.0 subnet 255.255.255.0
network obj_10.1.30.0 object
10.1.30.0 subnet 255.255.255.0
outside_access_in list extended access permitted ip object NETWORK_OBJ_10.1.30.0_24 all
FREE access-list extended ip 10.1.40.0 NAT allow 255.255.255.0 10.1.30.0 255.255.255.0
access-list 101 extended allow any4 any4-answer icmp echo
access-list standard split allow 10.1.40.0 255.255.255.0
pager lines 24
Enable logging
asdm of logging of information
Within 1500 MTU
Outside 1500 MTU
management of MTU 1500
ICMP unreachable rate-limit 1 burst-size 1
ICMP allow any inside
ICMP allow all outside
ASDM image disk0: / asdm - 743.bin
don't allow no asdm history
ARP timeout 14400
no permit-nonconnected arp
NAT (inside, outside) source obj_10.1.40.0 destination obj_10.1.40.0 static static obj_10.1.30.0 obj_10.1.30.0 non-proxy-arp-search to itinerary
NAT (inside, outside) static source any any static destination NETWORK_OBJ_10.1.30.0_24 NETWORK_OBJ_10.1.30.0_24 non-proxy-arp-search to itinerary
Access-group outside_access_in in interface outside
!
Router eigrp 1
Network 10.1.10.0 255.255.255.0
Network 10.1.20.0 255.255.255.0
Network 10.1.30.0 255.255.255.0
Network 10.1.40.0 255.255.255.252
!
Route outside 0.0.0.0 0.0.0.0 10.1.10.1 1
Timeout xlate 03:00
Pat-xlate timeout 0:00:30
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
Floating conn timeout 0:00:00
dynamic-access-policy-registration DfltAccessPolicy
without activating the user identity
identity of the user by default-domain LOCAL
Enable http server
http 192.168.1.0 255.255.255.0 management
http 192.168.1.0 255.255.255.0 inside
http X.X.X.238 255.255.255.255 outside
No snmp server location
No snmp Server contact
Crypto ipsec pmtu aging infinite - the security association
Crypto ca trustpoint ASDM_Launcher_Access_TrustPoint_0
registration auto
full domain name no
name of the object CN = 10.1.30.254, CN = ctcndasa01
ASDM_LAUNCHER key pair
Configure CRL
trustpool crypto ca policy
string encryption ca ASDM_Launcher_Access_TrustPoint_0 certificates
certificate c902a155
308201cd 30820136 a0030201 020204c 0d06092a 864886f7 0d 010105 9 02a 15530
0500302b 31133011 06035504 03130 has 63 61736130 31311430 12060355 74636e64
0403130 31302e31 2e33302e 32353430 1e170d31 35303731 32303530 3133315a b
170d 3235 30373039 30353031 33315 has 30 2 b 311330 0403130a 11060355 6374636e
64617361 30313114 30120603 55040313 0b31302e 312e3330 2e323534 30819f30
0d06092a 864886f7 010101 05000381 8 d 0d 003081 89028181 00a47cfc 6b5f8b9e
9b106ad6 857ec34c 01028f71 d35fb7b5 6a61ea33 569fefca 3791657f eeee91f2
705ab2ea 09207c4f dfbbc18a 749b19ae d3ca8aa7 3370510b a5a96fd4 f9e06332
4355 db1a4b88 475f96a1 318f7031 40668a4d afa44384 819d fa164c05 2e586ccc
3ea59b78 5976f685 2abbdcf6 f3b448e5 30aa96a8 1ed4e178 0001300 020301 4 d d
06092a 86 01010505 00038181 0093656f 639e138e 90b69e66 b50190fc 4886f70d
42d9b4a8 11828da4 e0765d9c 52d84f8b 8e70747e e760de88 c43dc5eb 1808bd0f
fd2230c1 53f68ea1 00f3e956 97eb313e 26cc49d7 25b927b5 43d8d3fa f212fcaf
59eb8104 98e3a1d9 e05d3bcb 428cd7c6 61b530f5 fe193d15 ef8c7f08 37ad16f5
d8966b50 917a88bb f4f30d82 6f8b58ba 61
quit smoking
Telnet timeout 5
SSH stricthostkeycheck
SSH timeout 5
SSH group dh-Group1-sha1 key exchange
Console timeout 0
VPN-addr-assign local reuse / 360 time
management of 192.168.1.2 - dhcpd address 192.168.1.254
enable dhcpd management
!
a basic threat threat detection
Statistics-list of access threat detection
no statistical threat detection tcp-interception
Trust ASDM_Launcher_Access_TrustPoint_0 vpnlb-ip SSL-point
SSL-trust outside ASDM_Launcher_Access_TrustPoint_0 point
WebVPN
allow outside
AnyConnect image disk0:/anyconnect-linux-3.1.09013-k9.pkg 4
AnyConnect image disk0:/anyconnect-macosx-i386-3.1.09013-k9.pkg 5
AnyConnect image disk0:/anyconnect-win-3.1.09013-k9.pkg 6
AnyConnect enable
tunnel-group-list activate
internal GroupPolicy_cnd-vpn group policy
GroupPolicy_cnd-vpn group policy attributes
WINS server no
value of server DNS 8.8.8.8
client ssl-VPN-tunnel-Protocol
by default no
xxxx GCOh1bma8K1tKZHa username encrypted password
type tunnel-group cnd - vpn remote access
tunnel-group global cnd-vpn-attributes
address-cnd-vpn-dhcp-pool
strategy-group-by default GroupPolicy_cnd-vpn
tunnel-group cnd - vpn webvpn-attributes
activation of the alias group cnd - vpn
!
ICMP-class class-map
match default-inspection-traffic
class-map inspection_default
match default-inspection-traffic
!
!
type of policy-card inspect dns preset_dns_map
parameters
maximum message length automatic of customer
message-length maximum 512
Policy-map icmp_policy
icmp category
inspect the icmp
Policy-map global_policy
class inspection_default
inspect the preset_dns_map dns
inspect the ftp
inspect h323 h225
inspect the h323 ras
inspect the rsh
inspect the rtsp
inspect esmtp
inspect sqlnet
inspect the skinny
inspect sunrpc
inspect xdmcp
inspect the sip
inspect the netbios
inspect the tftp
Review the ip options
inspect the icmp
!
global service-policy global_policy
service-policy icmp_policy outside interface
context of prompt hostname
no remote anonymous reporting call
Cryptochecksum:261228832f3b57983bcc2b4ed5a8a9d0
: end
ASDM image disk0: / asdm - 743.bin
don't allow no asdm history

Can you confirm that this is correct, your diagram shows your IP address public on ASA as 30 while you have assinged on 'outside' interface like 29?

Subnet VPN IPSec problem

Hello

I am configuring site to site connection using the pre-shared key VPN. The VPN connection is getting up and running, but I'm having problems on information routing between subnets.

Our subnet is 192.168.1.0 and we cannot use that subnet for VPN. Because of this, we use 10.240.86.33 for are created the IPSec traffic and destination network (PC) is on 164.2.107.56.

We cannot connect to the 164.2.107.56 computer network, can someone help us acomplishing this \windows\system32\conifg\system?

Our configuration is below:

interface FastEthernet0/0
Description $FW_OUTSIDE$
IP 200.111.XXX.XXX 255.255.255.248
no ip redirection
no ip unreachable
no ip proxy-arp
NBAR IP protocol discovery
NAT outside IP
IP virtual-reassembly
route IP cache flow
automatic duplex
automatic speed
No mop enabled
map SDM_CMAP_1 crypto
service-policy output SDM-QoS-policy-1
!
interface FastEthernet0/1
Description $ES_LAN$ $FW_INSIDE$
IP 192.168.1.1 255.255.255.0
no ip redirection
no ip unreachable
no ip proxy-arp
IP nat inside
IP virtual-reassembly
route IP cache flow
automatic duplex
automatic speed
No mop enabled
!
Router eigrp 1
10.0.0.0 network
network 192.168.1.0
No Auto-resume
!
IP forward-Protocol ND
IP route 0.0.0.0 0.0.0.0 200.111.XXX.XXX 2
!
!
IP http server
no ip http secure server
IP nat pool INTERNET 200.111.XXX.XXX 200.111.XXX.XXX netmask 255.255.255.248
overload INTERNET IP nat inside source map route SHEEP pool
IP nat inside source static 192.168.1.0 network 164.2.107.0/24
IP nat inside source 192.168.1.104 static 200.111.XXX.XXX
IP NAT outside source static network 10.240.86.0 192.168.1.0/24
!
recording of debug trap
access-list 10 permit 192.168.1.0 0.0.0.255
access-list 15 allow 200.6.103.241
access-list 15 permit 192.168.1.0 0.0.0.255
Access-list 100 = 4 SDM_ACL category note
Note access-list 100 IPSec rule
access-list 100 permit ip 10.240.86.0 0.0.0.255 164.2.107.56 0.0.0.1
not run cdp
!
!
SHEEP allowed 10 route map
corresponds to the IP 10
!
allowed SDM_RMAP_1 1 route map
corresponds to the IP 150
!
!
!

Hello

It is the router that ends the VPN tunnel? (I don't see the VPN configuration).

Since you can't use your real address LAN, you need to NAT before you send the traffic through the tunnel.

First, you apply the NAT rule to translate 192.168.1.0/24 to 10.240.86.33 when you go to 164.2.107.56

NAT 192.168.1.0 ip access list allow 0.0.0.255 host 164.2.107.56

NAT route map

corresponds to the IP NAT

IP pool local VPNPool 10.240.86.33 10.240.86.33

IP nat inside source overload map route NAT pool VPNPool

Next, you create the ACL list for interesting traffic to address coordinated at the address of the site to another

VPN ip host 10.240.86.33 access list permit 164.2.107.56

We will see the results.

Federico.

EIGRP on VPN

Similar Questions

Maybe you are looking for