Telnet access

Greetings,

I test on the lines of the telnet access lists and I'm having a bit of a problem. I applied a router access list 'a' and applied it to the line vty 0 4. This access list restricts telnet access to one switch, another router 'b' and many portable computers. Laptops can get in OK if they go directly to the router 'a', however, is they connect first to router 'b' and then try to telnet to router 'b', they get the message "access denied on router" a"even if the ip of the router's Ethernet interface"b"are both.

explicitly permitted in the access list, as well as the ip addresses of the laptops. There are no instructions 'decline' in the access list, except the statement implicitly denied at the end.

Router 'a' and 'b' is connected with each other through subinterfaces on serial ports with the frame relay connections.

Any ideas why the laptops cannot telnet sessions to the router "b"?

Any ideas?

Thank you

Dallas

I think you have the wrong IP address for router B in A access list. It could also be a vs problem generic mask subnet mask.

First thing to check: what IP address router did see you telnet in with router B?

I'll assume the standard of access list number you use is 1. (It can be anything, 1-99, or it may be a named access list. "I'll use 1 here.)

The router has, under 'line vty 0 4', remove the command "access-class 1 in. Then, log in to the router A to router B. On router A, run "users to see the" to see the address IP think you just. It is the address (or subnet, depending on how you hide) that you need in your order of "license to access-list 1.

If both routers are on different LANs with different subnets, but are connected by serial link, then the IP address on the interface closest to the router has that B will use to initiate the telnet session. And the closest interface would be the subinterface series you mentioned.

You said you used the Ethernet interface IP addresses. They would work if both routers are on the same LAN or subnet. or they would work if the LAN interfaces were along the route of the road between the two devices, the LAN interfaces have been on different subnets. In case you have several connections between two routers, whatever the you telnet to East the subnet and interface on that your turns off session IP address.

Second thing to check: you have a good command of "license to access-list 1? Look for the address or the subnet that you saw above. Sometimes, the address is correct, but the problem is with the which is the reverse of the subnet mask.

For example, specify a static route to a specific host would address 10.1.2.3 and subnet mask 255.255.255.255. in an access list, allowing a specific host would use address 10.1.2.3 and mask with joker 0.0.0.0.

In the case of a subnet, if you want to specify a static route to the 10.1.0.0 with a 16-bit subnet mask, you must use the subnet mask 255.255.0.0. The mask of generic access list for the same subnet would be 0.0.255.255.

And in the case of a point type subnet point-to-point minimalist on a subinterface series WAN link, if you want to allow access to the 'whole' in a single command subnet, let's say your subnet was 10.168.212.4 with a 30-bit subnet mask (if you have sous-reseau.4 IDS, two addresses to IP et.6 and IP address of subnet diffusion.7 utilisables.5) your subnet mask 255.255.255.252 while your mask with joker would be 0.0.0.3.

See the model? First octet of the subnet, added to the first byte of the generic mask, mask is 255. Ditto for the second, third, and fourth bytes. If not, then something is wrong — double check your numbers.

Last thing to do: put in the "access-list 1 permit 10.168.212.4 0.0.0.3" command on A router (or any address/wildcard combination you need for router B) and add the command "access-class 1 in" back to your 'line vty 0 4 '. Try your telnet to router B to router A. It should work.

I hope this helps.

Tags: Cisco Security

Similar Questions

  • Unauthorized telnet access

    Hello

    If someone could guide in writing script of EEM to allow users to access based on the IP address telnet session...

    Or send by email whenever someone telnets to the device.

    Kind regards

    Faizan.

    If you want to restrict access by IP telnet, use a list of access and access-class on the VTY lines.  EEM can help.

    You can have the EEM react to messages provided you have 'connection-success journal' configured logon.  It would be:

    Event Manager applet telnet-login

    syslog event model "port of connection Success.*local: 23.

    Our mail action 1.0 from [email protected] / * / to [email protected] / * / subject to body of server 10.1.1.1 "Telnet Login" "user just telneted to the device.

  • CUE Telnet access

    Is it possible to access telnet directly to the address of service-module without going through the router of the CME and then using the session command

    Thank you

    What happens if you change 'transport exit telnet, rlogin lapb - your v120 udptn ssh MOP pad' for ' transport output all "?

    Brandon

  • SSH and Telnet access for catalyst 4503 list

    I was wondering the structure of command to apply an access list to ssh and telnet on a catalyst 4503. I keep a list of access for indoors and outdoors. Can afford two different IPs from the outside? Thank you

    You will need create an access list indicating the networks/hosts that you want to allow.

    -Example

    access-list 10 permit 10.10.1.10

    access-list 10 permit 10.10.2.10

    access-list 10 permit 127.1.0.0 0.0.255.255

    access-list 10 permit 192.168.1.0 0.0.0.255

    So you want to put this list of access on the VTY interfaces.

    -Example

    line vty 0 4

    access-class 10

    entry ssh transport * if you only want to SSH *.

    line vty 5 15

    access-class 10

    entry ssh transport * Ditto *.

    Now you can do all this with * line vty 0 15 * but, it gives you a better idea of what is happening. It is a simplistic configuration. Remember that it is advisable not to allow ssh. If you want to allow at the same time, let him * transport input ssh * out of the configuration.

    I hope that gives you an idea of the structure. If this is not the case, let me know.

  • can I use aaa for telnet access to a pix?

    It's a 6.2 (2) the 506e running. I have all my routers and switches use Ganymede authentication. is it possible on with the pix? useful links or instructions?

    Thank you

    YES, you can control access to pix via Ganymede or any aaa server. Here is the link perfact explaining config etc for

    http://www.Cisco.com/warp/customer/110/authtopix.shtml

  • Configuration of the ACL to restrict access via SSH/Telnet

    You want to shoot a SSH/Telnet access to ISP address/IP of my switch interface.  Since the Dells have no strict vty/con interface to apply an ACL I guess I just have to match on an interface instead.  Using the ACL below.  Problem is that applying it kills telnet/ssh sessions completely and does them in.  Replaced the iPs in the wrong example with IPs.  Confirm that my public IP address is 112.94.236.58.  You will see a 112.94.236.56/29 with a permit instruction.

    TEST from the list of access permitted tcp 111.126.50.0 255.255.255.0 111.126.50.16 255.255.255.0 eq 22

    TEST from the list of access permitted tcp 111.126.50.0 255.255.255.0 111.126.50.16 255.255.255.0 eq telnet

    TEST tcp allowed access list 112.94.236.56 255.255.255.248 111.126.50.16 255.255.255.0 eq 22

    TEST the access permitted tcp 112.94.236.56 list 255.255.255.248 111.126.50.16 255.255.255.0 eq telnet

    TEST from the list of access permitted tcp 112.94.254.0 255.255.255.128 111.126.50.16 255.255.255.0 eq 22

    TEST from the list of access permitted tcp 112.94.254.0 255.255.255.128 111.126.50.16 255.255.255.0 eq telnet

    TEST the access permitted tcp 112.94.248.176 list 255.255.255.248 111.126.50.16 255.255.255.0 eq 22

    TEST the access permitted tcp 112.94.248.176 list 255.255.255.248 111.126.50.16 255.255.255.0 eq telnet

    access list tcp TEST refuse any 111.126.50.16 255.255.255.0 eq 22

    access list tcp TEST refuse any 111.126.50.16 255.255.255.0 eq telnet

    TEST the ip access list allow a whole

    111.126.50.16 is the switch

    Maybe I should use a destination host in the ACL instead?  (edit, nope, tried with a subnet of 255 s all, same problem)

    The ACL is created using the command access-list config mode.  On the interface it won't let me use ip access-class.

    Figured it out.  Kept, see references to "MACL", think why I needed a MAC access control list.

    Nope.

    Dell world, this means access control list management.

  • Cannot access admin (ReadyNAS 102) Panel

    After turn on my NAS gets 192.168.2.25 IP address, I can ping from my PC. Power led blinks constantly after power to the top, I can't disable it only by unpluging power cord. I can't access Admin Panel by browser (connection refused) in Chrome and IE. I tried the procedure of resetting factory and OS reinstall that brings no improvement. RAIDar software is the realization that one SIN, but the firmware version is empty, so I guess there's the problem. Is there a way I can download the firmware - for example from USB when I have no access to admin panel? I am very disappointed because this is the State of the new product and my business really needs it goes fast...

    Hello CPR,

    Welcome to the community!

    The operating system and data are saved on the disc that is inserted in the ReadyNAS chassis. Without the records, there is no, you will not be able to access the admin page. SSH is also disabled by default, so if you want to access via SSH, you must Access the first admin page and then allow it to from there. Telnet access is designed for engineering and support of L3.

    Kind regards

  • How a router via the Telnet command file

    Dear boss

    I have a few remote cisco router and have telnet access to the router (172.16.1.1, 172.16.2.1...). I want to add a route to the router through a windows batch file. How do I? Please help me with the sample.

    Thanking you

    Shahid

    Hey Shahid,

    The issue of Windows XP, you have posted is better suited for the IT Pro TechNet public. Please post your question in the

    TechNet Script Center for assistance.

    Hope the helps of information.

    Concerning
    Joel S
    Microsoft Answers Support Engineer
    Visit our Microsoft answers feedback Forum and let us know what you think.

  • Firewall XP slows telnet and pop requests to other servers

    with xp firewall WE telnet takes about 10 seconds to connect to my linux server. workstation on the same POP form xp server takes about 10 seconds
    with xp firewall OFF it connects instantly
    I've tried doing the fomr even another machine winxp and this problem does NOT occur. So it seems that I have a machine that has a firewall problem
    all windows updates and patches have been installed
    This dbeen has now lasted about a year. time to find out how to fix :)

    Well, for all those interested, ive worked the definitive answer to this problem underway long myself for "xp firewall slows down applications to other telnet servers and pop.

    After doing a few capture and analysis of communication between my workstation and server, I noticed the server sending some 113 applications port to my work in response to the pop stations and requests for telnet access and I think than ftp also.

    Port 113 refers to "ident" username for authentication on the servers running of authentication such as "identd". If the workstation does not respond, then it may delay the connection. The solution is to put an exception on the firewall of my computer such as windows xp firewall to allow port 113 through.

    To do, it is very easy for all of us here are the steps for your Windows XP workstation:

    Start | Control Panel | Windows Firewall | Exceptions | Add Port. 113 TCP Port number. Comment: The authentication of the user name to the server with the ident Protocol

    So there you have it. Finally... INSTANTLY connect and response of the connection for pop, telnet and ftp :)

    Edward Jozis

  • WAG320N telnet ssh

    Hello!

    you know that you can activate the ssh / telnet / rlogin into the modem / router wag320n?

    Thank you
    Walter

    It is always a consumer device. If she had telnet access some customers would use and some wouldn't have the slightest idea what they due and, but Linksys would have to provide the service to all the...

    Check out the 3rd party firmware like dd - wrt or similar. There you can do whatever you want. Of course, it is not covered by warranty.

  • NAS200 telnet? fsck? Lost + found? Help me please.

    Hello world.

    I NEED to access the NAS200 drives.

    Somehow my file system was broken.

    Yesterday I was copying some files on the device (attached to a dedicated UPS, so no power failure when writing) during the copy (it was long) I tried to delete some files in a different folder.

    The player responded: removal of the files had a life (even if the copy is complete) it took about 40 seconds to delete each file...

    So I decided to cancel the operation and restart the device.

    I pressed the power button, I heard the stop sound and turns off after a while.

    I turned on it once, it happened as usually: leds (power - activity - disk1 and disk2), beeps...

    Then I tried to access my files, but vista gave me a network share could not be found.

    First of all, I ping the device, he was there.

    Then I have connected to the web management, made a successful logon, checked state.

    All right: two recognized discs. Chip Disk1: OK, chip Disk2logical disk K 0 (raid 0): ok.

    Total space 1, 5 to, free space 200 GB.

    I tried with the web service "access to my files"... and then, I throw a shout!

    I got an error, something like 'Path of ACCESS not FOUND' (previously I had two /DISK and /PUBLIC_DISK actions)

    Then I tried again with FTP (same error)

    Then I launched "Scandisk" (still within the management interface) in the newspaper I see "scandisk has failed."

    I tried to launch it again and after one hour, the unit was not responding.

    Is there a way to access the ext3 FS without the web interface?

    How can I make fschk?

    I need to recover the data

    I have lots of photos & videos of my babies when they are born, working documents, working source code

    Any tips?

    What can I do?

    (Material) discs seem to be ok.

    The raid goes to the top.

    The file system appears to be damaged but not bad (or I don't know disk space / free)...

    If the disk file system are not accessible through NAS200 can I connect the disks in a PC with linux and a raid controller? Or is the only raid array works with the controller in NAS200?

    Please help me.

    Thank you in advance.

    The RAID is a software RAID using mdadm. If you have a Linux system, it should be easy to mount hard drives SATA or eSATA or (at most) a USB to SATA converter. If you define for the journaled file system, the NAS200 uses XFS. It uses ext2 for not journaled.

    If you connect the disks on a Linux machine, you will find 3 partitions on each disk: (1) the data partition, (2) a configuration partition, and (3) a swap partition. I do not recommend making any changes to the configuration partition unless you know what you're doing.

    Connect the drive on a Linux system is going to allow you to recover things MUCH faster that to do with the NAS200 (who is actually a PC 133 headless of 486 MHz which feels like it is clocked at 100 MHz).

    If you insist to leave readers in the NAS and you wish to SSH or Telnet access, you can install my firmware . It will not affect your configuration or your hard drives, it will always be like the Linksys firmware (I only added additional features and didn't touch any of the Linksys stuff) and you can easily put the original firmware if you don't like it or don't need more.

    There is no telnet or SSH access in the default firmware.

    = Jac

  • Telnet on a X 1018

    Hello

    I'm having a problem with a switch in series X, a 1018. As part of our security policy, that I need to disable telnet, howevre it seems I can disable only SSH and HTTPS, that seems a bit backwards.

    Can someone tell me if and how I can disable telnet access?

    Thanks in advance

    With the series X-series, there is not a method of disabling just telnet. You must use access profiles to limit access. You can learn more on this topic on page 109 of the user guide.

    http://Dell.to/1NSYeYk

    I also put in place a few steps how to do here.

    http://bit.LY/21fmaNa

    I would like to know if you find this useful.

  • Telnet or SSH to AP 1142

    Hello

    I am trying to connect to an access point to distance within our network... is it possible to activate telnet or ssh access point by WCS or https. Please let me know

    Knockaert

    WCS, you could push a model AP.  On the 'the AP settings' tab, you can enable ssh and telnet access and then apply it to the AP.

    http://www.Cisco.com/en/us/partner/docs/wireless/WCS/6.0/Configuration/Guide/6_0temp.html#wp1064409

  • How can I disable telnet on AIR-AP1242AG-E-K9?

    I activated the SSH with user name and password, but I noticed that when I type a username he accepts, as I have to disable the telnet, while I am using SSH

    Configure these commands in your AP

    !

    block-telnet extended IP access list

    permit tcp any any telnet neq

    !

    line vty 0 4

    block telnet access class in

    !

    Ragards

  • No internet access through VPN

    Hi, I have the router Cisco 881 (MPC8300) with c880data-universalk9 - mz.153 - 3.M4.bin when users establish a VPN connection to the corporate network, had access to all the resources but no internet access, please help me what else I need to configure to achieve my goal. I don't want to split the tunnel, internet via VPN, users must have. In my opinion, I have put an additional configuration for NAT, but my router not recognize u-Turn and NAT commands on the object on the network.

    My config:

    Building configuration...

    Current configuration: 13562 bytes
    !
    ! Last configuration change at 09:52:38 PCTime Saturday, May 16, 2015, by admin
    version 15.3
    no service button
    horodateurs service debug datetime msec
    Log service timestamps datetime msec
    no password encryption service
    !
    XXX host name
    !
    boot-start-marker
    start the flash system: c880data-universalk9 - mz.153 - 3.M4.bin
    boot-end-marker
    !
    !
    logging buffered 51200 warnings
    !
    AAA new-model
    !
    !
    AAA authentication login default local
    AAA authentication login ciscocp_vpn_xauth_ml_1 local
    AAA authentication login ciscocp_vpn_xauth_ml_2 local
    AAA authorization exec default local
    AAA authorization ciscocp_vpn_group_ml_1 LAN
    AAA authorization ciscocp_vpn_group_ml_2 LAN
    !
    !
    !
    !
    !
    AAA - the id of the joint session
    iomem 10 memory size
    clock timezone PCTime 1 0
    PCTime of summer time clock day March 30, 2003 02:00 October 26, 2003 03:00
    !
    Crypto pki trustpoint TP-self-signed-1751279470
    enrollment selfsigned
    name of the object cn = IOS - Self - signed - certificate - 1751279470
    revocation checking no
    rsakeypair TP-self-signed-1751279470
    !
    !
    TP-self-signed-1751279470 crypto pki certificate chain
    certificate self-signed 01
    XXXX
    !
    !
    Protocol-IP port-map user - 2 tcp 8443 port
    user-Protocol IP port-map - 1 tcp 3389 port
    !

    !
    !
    !
    IP domain name dmn.local
    8.8.8.8 IP name-server
    IP-server names 8.8.4.4
    IP cef
    No ipv6 cef
    !
    !
    license udi pid CISCO881-K9 sn FCZ174992C8
    !
    !
    username privilege 15 secret 5 xxxx xxxx
    username secret VPNUSER 5 xxxx
    !
    !
    !
    !
    !
    !
    type of class-card inspect sdm-nat-user-protocol--2-1 correspondence
    game group-access 105
    corresponds to the user-Protocol - 2
    type of class-card inspect entire game SDM_AH
    match the name of group-access SDM_AH
    type of class-card inspect entire game PAC-skinny-inspect
    Skinny Protocol game
    type of class-card inspect entire game SDM_IP
    match the name of group-access SDM_IP
    type of class-card inspect entire game PAC-h323nxg-inspect
    match Protocol h323-nxg
    type of class-card inspect entire game PAC-cls-icmp-access
    match icmp Protocol
    tcp protocol match
    udp Protocol game
    type of class-card inspect entire game PAC-h225ras-inspect
    match Protocol h225ras
    type of class-card inspect entire game SDM_ESP
    match the name of group-access SDM_ESP
    type of class-card inspect entire game PAC-h323annexe-inspect
    match Protocol h323-annex
    type of class-card inspect entire game PAC-cls-insp-traffic
    match Protocol pptp
    dns protocol game
    ftp protocol game
    https protocol game
    match icmp Protocol
    match the imap Protocol
    pop3 Protocol game
    netshow Protocol game
    Protocol shell game
    match Protocol realmedia
    match rtsp Protocol
    smtp Protocol game
    sql-net Protocol game
    streamworks Protocol game
    tftp Protocol game
    vdolive Protocol game
    tcp protocol match
    udp Protocol game
    type of class-card inspect the correspondence SDM_GRE
    match the name of group-access SDM_GRE
    type of class-card inspect entire game PAC-h323-inspect
    h323 Protocol game
    type of class-card inspect correspondence ccp-invalid-src
    game group-access 103
    type of class-card inspect entire game PAC-sip-inspect
    sip protocol game
    type of class-card inspect correspondence sdm-nat-https-1
    game group-access 104
    https protocol game
    type of class-card inspect all match mysql
    match the mysql Protocol
    type of class-card inspect correspondence ccp-Protocol-http
    http protocol game
    type of class-card inspect entire game CCP_PPTP
    corresponds to the SDM_GRE class-map
    inspect the class-map match PAC-insp-traffic type
    corresponds to the class-map PAC-cls-insp-traffic
    type of class-card inspect entire game SDM_EASY_VPN_SERVER_TRAFFIC
    match Protocol isakmp
    match Protocol ipsec-msft
    corresponds to the SDM_AH class-map
    corresponds to the SDM_ESP class-map
    type of class-card inspect correspondence ccp-icmp-access
    corresponds to the class-ccp-cls-icmp-access card
    type of class-card inspect the correspondence SDM_EASY_VPN_SERVER_PT
    corresponds to the SDM_EASY_VPN_SERVER_TRAFFIC class-map
    !
    type of policy-map inspect PCB - inspect
    class type inspect PCB-invalid-src
    Drop newspaper
    class type inspect mysql
    inspect
    class type inspect PCB-Protocol-http
    inspect
    class type inspect PCB-insp-traffic
    inspect
    class type inspect PCB-sip-inspect
    inspect
    class type inspect PCB-h323-inspect
    inspect
    class type inspect ccp-h323annexe-inspect
    inspect
    class type inspect ccp-h225ras-inspect
    inspect
    class type inspect ccp-h323nxg-inspect
    inspect
    class type inspect PCB-skinny-inspect
    inspect
    class class by default
    drop
    type of policy-card inspect sdm-license-ip
    class type inspect SDM_IP
    Pass
    class class by default
    Drop newspaper
    type of policy-card inspect sdm-pol-NATOutsideToInside-1
    class type inspect sdm-nat-https-1
    inspect
    class type inspect sdm-nat-user-protocol--2-1
    inspect
    class type inspect CCP_PPTP
    Pass
    class class by default
    Drop newspaper
    type of policy-card inspect PCB-enabled
    class type inspect SDM_EASY_VPN_SERVER_PT
    Pass
    class class by default
    drop
    type of policy-card inspect PCB-permits-icmpreply
    class type inspect PCB-icmp-access
    inspect
    class class by default
    Pass
    !
    safety zone-to-zone
    security of the area outside the area
    ezvpn-safe area of zone
    zone-pair security PAC-zp-self-out source destination outside zone auto
    type of service-strategy inspect PCB-permits-icmpreply
    zone-pair security PAC-zp-in-out source in the area of destination outside the area
    type of service-strategy inspect PCB - inspect
    source of PAC-zp-out-auto security area outside zone destination auto pair
    type of service-strategy inspect PCB-enabled
    sdm-zp-NATOutsideToInside-1 zone-pair security source outside the area of destination in the area
    type of service-strategy inspect sdm-pol-NATOutsideToInside-1
    in the destination box source sdm-zp-in-ezvpn1 ezvpn-pairs area security
    type of service-strategy inspect sdm-license-ip
    source of sdm-zp-out-ezpn1 of security area outside zone ezvpn-zone time pair of destination
    type of service-strategy inspect sdm-license-ip
    safety zone-pair sdm-zp-ezvpn-out1-source ezvpn-zone of destination outside the area
    type of service-strategy inspect sdm-license-ip
    safety zone-pair source sdm-zp-ezvpn-in1 ezvpn-area destination in the area
    type of service-strategy inspect sdm-license-ip
    !
    !
    crypto ISAKMP policy 1
    BA 3des
    preshared authentication
    Group 2
    !
    crypto ISAKMP policy 2
    BA aes 256
    preshared authentication
    Group 2
    !
    Configuration group customer crypto isakmp Domena
    key XXXXXX
    DNS 192.168.1.2
    Dmn.local field
    pool SDM_POOL_1
    Save-password
    Max-users 90
    netmask 255.255.255.0
    banner ^ Cwelcome ^ C
    ISAKMP crypto ciscocp-ike-profile-1 profile
    match of group identity Domena
    client authentication list ciscocp_vpn_xauth_ml_2
    ISAKMP authorization list ciscocp_vpn_group_ml_2
    client configuration address respond
    virtual-model 1
    !
    !
    Crypto ipsec transform-set esp - aes 256 esp-sha-hmac ESP_AES-256_SHA
    tunnel mode
    !
    Profile of crypto ipsec CiscoCP_Profile1
    game of transformation-ESP_AES-256_SHA
    set of isakmp - profile ciscocp-ike-profile-1
    !
    !
    !
    !
    !
    !
    !
    interface Loopback0
    IP 192.168.9.1 255.255.255.0
    !
    interface FastEthernet0
    no ip address
    !
    interface FastEthernet1
    no ip address
    !
    interface FastEthernet2
    no ip address
    !
    interface FastEthernet3
    no ip address
    !
    interface FastEthernet4
    Description $ETH - WAN$ $FW_OUTSIDE$
    IP x.x.x.x 255.255.255.248
    NAT outside IP
    IP virtual-reassembly in
    outside the area of security of Member's area
    automatic duplex
    automatic speed
    !
    type of interface virtual-Template1 tunnel
    IP unnumbered Loopback0
    ezvpn-safe area of Member's area
    ipv4 ipsec tunnel mode
    Tunnel CiscoCP_Profile1 ipsec protection profile
    !
    interface Vlan1
    Description $ETH_LAN$ $FW_INSIDE$
    IP 192.168.1.1 255.255.255.0
    IP access-group 100 to
    IP nat inside
    IP virtual-reassembly in
    Security members in the box area
    IP tcp adjust-mss 1452
    !
    local IP SDM_POOL_1 192.168.10.10 pool 192.168.10.100
    IP forward-Protocol ND
    IP http server
    23 class IP http access
    local IP http authentication
    IP http secure server
    IP http timeout policy slowed down 60 life 86400 request 10000
    !
    The dns server IP
    IP nat inside source list 3 interface FastEthernet4 overload
    IP nat inside source static tcp 192.168.1.3 interface FastEthernet4 443 443
    IP nat inside source static tcp 192.168.1.2 8443 interface FastEthernet4 8443
    IP route 0.0.0.0 0.0.0.0 X.x.x.x
    !
    SDM_AH extended IP access list
    Note the category CCP_ACL = 1
    allow a whole ahp
    SDM_ESP extended IP access list
    Note the category CCP_ACL = 1
    allow an esp
    SDM_GRE extended IP access list
    Note the category CCP_ACL = 1
    allow a gre
    SDM_IP extended IP access list
    Note the category CCP_ACL = 1
    allow an ip
    !
    not run cdp
    !
    Note access-list 3 INSIDE_IF = Vlan1
    Note CCP_ACL category in the list to access 3 = 2
    access-list 3 Let 192.168.1.0 0.0.0.255
    Note access-list 23 category CCP_ACL = 17
    access-list 23 permit 192.168.1.0 0.0.0.255
    access-list 23 allow 10.10.10.0 0.0.0.7
    Note access-list 100 Auto generated by SDM management access feature
    Note access-list 100 category CCP_ACL = 1
    access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 192.168.1.1 eq 22
    access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 192.168.1.1 eq www
    access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 192.168.1.1 eq 443
    access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 192.168.1.1 eq cmd
    access-list 100 tcp refuse any host 192.168.1.1 eq telnet
    access-list 100 tcp refuse any host 192.168.1.1 eq 22
    access-list 100 tcp refuse any host 192.168.1.1 eq www
    access-list 100 tcp refuse any host 192.168.1.1 eq 443
    access-list 100 tcp refuse any host 192.168.1.1 eq cmd
    access-list 100 deny udp any host 192.168.1.1 eq snmp
    access ip-list 100 permit a whole
    Note access-list 101 category CCP_ACL = 1
    access-list 101 permit ip 192.168.1.0 0.0.0.255 any
    Note access-list 102 CCP_ACL category = 1
    access-list 102 permit ip 192.168.1.0 0.0.0.255 any
    Note access-list 103 CCP_ACL category = 128
    access-list 103 allow the ip 255.255.255.255 host everything
    access-list 103 allow ip 127.0.0.0 0.255.255.255 everything
    access-list 103 allow ip 93.179.203.160 0.0.0.7 everything
    Note 104 CCP_ACL category = 0 access-list
    IP access-list 104 allow any host 192.168.1.3
    Note access-list 105 CCP_ACL category = 0
    IP access-list 105 allow any host 192.168.1.2

    -----------------------------------------------------------------------
    ^ C
    !
    Line con 0
    no activation of the modem
    line to 0
    line vty 0 4
    access-class 102 in
    transport input telnet ssh
    line vty 5 15
    access class 101 in
    transport input telnet ssh
    !
    !
    end

    I'd be grateful for help

    concerning

    Hello

    Enter the subnet pool VPN to access-list 3 for source NAT

    You may need to check the firewall also rules to allow the connection based on areas you

    HTH,

    Averroès

Maybe you are looking for