Hi All,
I am able to configure Easy VPN server on concentrator. Verified the
configuration by connecting test PC as VPN client.
Configured R4 as VPN client but ping test failed as captured below. IKE
phase-1 and Phase-2 are established (sh output is attached).
I'm not sure what is missing? Appreciate any suggestions/pointers.
Thanks,
-Anshul
R4#ping 10.2.2.1 source loopback 100
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.2.2.1, timeout is 2 seconds:
Packet sent with a source address of 172.16.0.1
.....
Success rate is 0 percent (0/5)
R4:
crypto ipsec client ezvpn EZGroup
group EZGroup key abcd1234
mode network-extension
peer 192.168.5.5
acl 176
username EZUser password ccie1234
xauth userid mode local
interface Loopback100
ip address 172.16.0.1 255.255.0.0
ip nat inside
crypto ipsec client ezvpn EZGroup inside
interface Serial0/0/0
ip nat outside
crypto ipsec client ezvpn EZGroup
access-list 175 deny ip 172.16.0.0 0.0.255.255 10.2.2.0 0.0.0.255
access-list 175 deny ip 192.168.22.0 0.0.0.255 10.2.2.0 0.0.0.255
access-list 175 permit ip 172.16.0.0 0.0.255.255 any
access-list 176 permit ip 172.16.0.0 0.0.255.255 10.2.2.0 0.0.0.255
ip nat inside source list 175 interface Serial0/0/0 overload
R4#sh crypto isakmp sa
dst src state conn-id slot status
192.168.5.5 192.1.24.4 QM_IDLE 6 0 ACTIVE
R4#
R4#sh crypto ipsec sa
interface: Serial0/0/0
Crypto map tag: Serial0/0/0-head-0, local addr 192.1.24.4
protected vrf: (none)
local ident (addr/mask/prot/port): (172.16.0.0/255.255.0.0/0/0)
remote ident (addr/mask/prot/port): (10.2.2.0/255.255.255.0/0/0)
current_peer 192.168.5.5 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 5, #pkts encrypt: 5, #pkts digest: 5
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 192.1.24.4, remote crypto endpt.: 192.168.5.5
path mtu 1500, ip mtu 1500
current outbound spi: 0x34E2AFD5(887271381)
inbound esp sas:
spi: 0x4737209A(1194795162)
transform: esp-3des esp-md5-hmac ,
in use settings ={Tunnel, }
conn id: 3002, flow_id: Onboard VPN:2, crypto map: Serial0/0/0-head-0
sa timing: remaining key lifetime (k/sec): (4402748/27783)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0x34E2AFD5(887271381)
transform: esp-3des esp-md5-hmac ,
in use settings ={Tunnel, }
conn id: 3001, flow_id: Onboard VPN:1, crypto map: Serial0/0/0-head-0
sa timing: remaining key lifetime (k/sec): (4402747/27766)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
R4#R4#sh run
Building configuration...
Current configuration : 2610 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R4
!
boot-start-marker
boot system flash:c2800nm-advipservicesk9-mz.123-14.T7.bin
boot-end-marker
!
logging buffered 51200 warnings
enable secret 5 $1$XhG4$4bU7fv3bFbd5l4j07YhqH1
enable password lab
!
no aaa new-model
!
resource policy
!
ip subnet-zero
!
!
ip cef
no ip dhcp use vrf connected
!
!
no ip ips deny-action ips-interface
!
no ftp-server write-enable
!
!
!
!
!
!
username cisco privilege 15 secret 5 $1$LcCz$x79vweHvNGPQrOvTZyXz8.
!
!
no crypto isakmp ccm
!
!
!
!
!
crypto ipsec client ezvpn EZGroup
connect auto
group EZGroup key abcd1234
mode network-extension
peer 192.168.5.5
acl 176
username EZUser password ccie1234
xauth userid mode local
!
!
!
!
!
interface Loopback0
ip address 4.4.4.4 255.0.0.0
!
interface Loopback1
ip address 192.168.22.1 255.255.255.255
!
interface Loopback10
no ip address
!
interface Loopback100
ip address 172.16.0.1 255.255.0.0
ip nat inside
ip virtual-reassembly
crypto ipsec client ezvpn EZGroup inside
!
interface GigabitEthernet0/0
ip address 192.1.49.4 255.255.255.0
duplex auto
speed auto
no mop enabled
!
interface GigabitEthernet0/1
no ip address
duplex auto
speed auto
!
interface Serial0/0/0
ip address 192.1.24.4 255.255.255.0
ip nat outside
ip virtual-reassembly
encapsulation frame-relay
ip ospf network point-to-point
frame-relay map ip 192.1.24.2 402 broadcast
no frame-relay inverse-arp
frame-relay lmi-type cisco
crypto ipsec client ezvpn EZGroup
!
router ospf 1
router-id 4.4.4.4
log-adjacency-changes
network 4.4.4.4 0.0.0.0 area 0
network 192.1.24.0 0.0.0.255 area 0
network 192.1.49.0 0.0.0.255 area 10
!
ip classless
ip route 192.168.5.0 255.255.255.0 192.1.24.2
!
!
ip http server
no ip http secure-server
ip nat inside source list 175 interface Serial0/0/0 overload
!
access-list 175 deny ip 172.16.0.0 0.0.255.255 10.2.2.0 0.0.0.255
access-list 175 deny ip 192.168.22.0 0.0.0.255 10.2.2.0 0.0.0.255
access-list 175 permit ip 172.16.0.0 0.0.255.255 any
access-list 176 permit ip 172.16.0.0 0.0.255.255 10.2.2.0 0.0.0.255
!
alias exec ship sh ip int brief
alias exec sir sh ip route
alias exec shr sh run
!
line con 0
exec-timeout 0 0
logging synchronous
login local
stopbits 1
line aux 0
stopbits 1
line vty 0 4
privilege level 15
password csco
login local
transport input telnet
line vty 5 15
privilege level 15
password csco
login local
transport input telnet
!
scheduler allocate 20000 1000
!
end
R4#
