Hi Tyson,
Thanks for your quick response.
R4 & VPN Concentrator have reachability through R4 Serial interface but
problem occurs when R4 lookback100 (172.16.0.1) tries to reach
Concentrator. Therefore, encryption/decryption also doesn't happen.
Attached is the output and configuration files from R4 and R2. Do I need
another static on R2 to route 172.16.0.0 network?
Appreciate your help,
-Anshul
________________________________
From: Tyson Scott [mailto:[EMAIL PROTECTED]
Sent: Monday, December 17, 2007 7:03 AM
To: Anshul Arora (akarora); [email protected]
Subject: RE: [OSL | CCIE_Security] Section 14: Task 7.5 (b):Remote
Access VPN on R4
What do the routing tables look like. Have you checked each side to see
if there are encryption decryption statistics.
Tyson Scott - CCIE #13513 R&S and Security
Technical Instructor - IPexpert, Inc.
A Cisco Learning Partner - We Accept Learning Credits!
Telephone: +1.810.326.1444
Cell: +1.248.504.7309
Fax: +1.810.454.0130
Mailto: [EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]>
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Anshul
Arora (akarora)
Sent: Sunday, December 16, 2007 9:20 PM
To: [email protected]
Subject: [OSL | CCIE_Security] Section 14: Task 7.5 (b):Remote Access
VPN on R4
Hi All,
I am able to configure Easy VPN server on concentrator. Verified the
configuration by connecting test PC as VPN client.
Configured R4 as VPN client but ping test failed as captured below. IKE
phase-1 and Phase-2 are established (sh output is attached).
I'm not sure what is missing? Appreciate any suggestions/pointers.
Thanks,
-Anshul
R4#ping 10.2.2.1 source loopback 100
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.2.2.1, timeout is 2 seconds:
Packet sent with a source address of 172.16.0.1
.....
Success rate is 0 percent (0/5)
R4:
crypto ipsec client ezvpn EZGroup
group EZGroup key abcd1234
mode network-extension
peer 192.168.5.5
acl 176
username EZUser password ccie1234
xauth userid mode local
interface Loopback100
ip address 172.16.0.1 255.255.0.0
ip nat inside
crypto ipsec client ezvpn EZGroup inside
interface Serial0/0/0
ip nat outside
crypto ipsec client ezvpn EZGroup
access-list 175 deny ip 172.16.0.0 0.0.255.255 10.2.2.0 0.0.0.255
access-list 175 deny ip 192.168.22.0 0.0.0.255 10.2.2.0 0.0.0.255
access-list 175 permit ip 172.16.0.0 0.0.255.255 any
access-list 176 permit ip 172.16.0.0 0.0.255.255 10.2.2.0 0.0.0.255
ip nat inside source list 175 interface Serial0/0/0 overload
R4#sh crypto is
R4#sh crypto isakmp sa
dst src state conn-id slot status
192.168.5.5 192.1.24.4 QM_IDLE 8 0 ACTIVE
R4#sh crypto ipsec
R4#sh crypto ipsec sa
interface: Serial0/0/0
Crypto map tag: Serial0/0/0-head-0, local addr 192.1.24.4
protected vrf: (none)
local ident (addr/mask/prot/port): (172.16.0.0/255.255.0.0/0/0)
remote ident (addr/mask/prot/port): (10.2.2.0/255.255.255.0/0/0)
current_peer 192.168.5.5 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 192.1.24.4, remote crypto endpt.: 192.168.5.5
path mtu 1500, ip mtu 1500
current outbound spi: 0x0(0)
inbound esp sas:
inbound ah sas:
inbound pcp sas:
outbound esp sas:
outbound ah sas:
outbound pcp sas:
R4#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
O 192.1.12.0/24 [110/65] via 192.1.24.2, 14:42:58, Serial0/0/0
1.0.0.0/32 is subnetted, 1 subnets
O E2 1.1.1.1 [110/11] via 192.1.24.2, 14:42:57, Serial0/0/0
2.0.0.0/32 is subnetted, 1 subnets
O 2.2.2.2 [110/65] via 192.1.24.2, 14:42:58, Serial0/0/0
C 4.0.0.0/8 is directly connected, Loopback0
O 192.1.25.0/24 [110/128] via 192.1.24.2, 14:42:58, Serial0/0/0
5.0.0.0/32 is subnetted, 1 subnets
O 5.5.5.5 [110/129] via 192.1.24.2, 14:42:58, Serial0/0/0
C 192.1.24.0/24 is directly connected, Serial0/0/0
O E2 6.0.0.0/8 [110/20] via 192.1.24.2, 14:42:59, Serial0/0/0
C 172.16.0.0/16 is directly connected, Loopback100
O E2 192.1.26.0/24 [110/20] via 192.1.24.2, 14:42:59, Serial0/0/0
9.0.0.0/32 is subnetted, 1 subnets
O 9.9.9.9 [110/2] via 192.1.49.9, 14:43:01, GigabitEthernet0/0
S 192.168.5.0/24 [1/0] via 192.1.24.2
O E2 192.1.66.0/24 [110/20] via 192.1.24.2, 14:33:06, Serial0/0/0
10.0.0.0/24 is subnetted, 3 subnets
O E2 10.5.5.0 [110/120] via 192.1.24.2, 14:43:01, Serial0/0/0
O E2 10.2.2.0 [110/10] via 192.1.24.2, 14:43:01, Serial0/0/0
O E2 10.1.1.0 [110/120] via 192.1.24.2, 14:43:00, Serial0/0/0
192.168.22.0/32 is subnetted, 1 subnets
C 192.168.22.1 is directly connected, Loopback1
O E2 212.1.5.0/24 [110/120] via 192.1.24.2, 14:43:01, Serial0/0/0
O E2 212.1.4.0/24 [110/120] via 192.1.24.2, 14:43:01, Serial0/0/0
C 192.1.49.0/24 is directly connected, GigabitEthernet0/0
O E2 212.1.7.0/24 [110/120] via 192.1.24.2, 14:43:01, Serial0/0/0
O E2 212.1.6.0/24 [110/120] via 192.1.24.2, 14:43:01, Serial0/0/0
R4#
R4#ping 10.2.2.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.2.2.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms
R4#ping 192.168.5.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.5.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
R4#
R4#sh run
Building configuration...
Current configuration : 2610 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R4
!
boot-start-marker
boot system flash:c2800nm-advipservicesk9-mz.123-14.T7.bin
boot-end-marker
!
logging buffered 51200 warnings
enable secret 5 $1$XhG4$4bU7fv3bFbd5l4j07YhqH1
enable password lab
!
no aaa new-model
!
resource policy
!
ip subnet-zero
!
!
ip cef
no ip dhcp use vrf connected
!
!
no ip ips deny-action ips-interface
!
no ftp-server write-enable
!
!
!
!
!
!
!
!
!
!
!
!
!
!
username cisco privilege 15 secret 5 $1$LcCz$x79vweHvNGPQrOvTZyXz8.
!
!
no crypto isakmp ccm
!
!
!
!
!
crypto ipsec client ezvpn EZGroup
connect auto
group EZGroup key abcd1234
mode network-extension
peer 192.168.5.5
acl 176
username EZUser password ccie1234
xauth userid mode local
!
!
!
!
!
interface Loopback0
ip address 4.4.4.4 255.0.0.0
!
interface Loopback1
ip address 192.168.22.1 255.255.255.255
!
interface Loopback10
no ip address
!
interface Loopback100
ip address 172.16.0.1 255.255.0.0
ip nat inside
ip virtual-reassembly
crypto ipsec client ezvpn EZGroup inside
!
interface GigabitEthernet0/0
ip address 192.1.49.4 255.255.255.0
duplex auto
speed auto
no mop enabled
!
interface GigabitEthernet0/1
no ip address
duplex auto
speed auto
!
interface Serial0/0/0
ip address 192.1.24.4 255.255.255.0
ip nat outside
ip virtual-reassembly
encapsulation frame-relay
ip ospf network point-to-point
frame-relay map ip 192.1.24.2 402 broadcast
no frame-relay inverse-arp
frame-relay lmi-type cisco
crypto ipsec client ezvpn EZGroup
!
router ospf 1
router-id 4.4.4.4
log-adjacency-changes
network 4.4.4.4 0.0.0.0 area 0
network 192.1.24.0 0.0.0.255 area 0
network 192.1.49.0 0.0.0.255 area 10
!
ip classless
ip route 192.168.5.0 255.255.255.0 192.1.24.2
!
!
ip http server
no ip http secure-server
ip nat inside source list 175 interface Serial0/0/0 overload
!
access-list 175 deny ip 172.16.0.0 0.0.255.255 10.2.2.0 0.0.0.255
access-list 175 deny ip 192.168.22.0 0.0.0.255 10.2.2.0 0.0.0.255
access-list 175 permit ip 172.16.0.0 0.0.255.255 any
access-list 176 permit ip 172.16.0.0 0.0.255.255 10.2.2.0 0.0.0.255
!
!
!
!
control-plane
!
!
!
!
!
!
!
!
!
alias exec ship sh ip int brief
alias exec sir sh ip route
alias exec shr sh run
!
line con 0
exec-timeout 0 0
logging synchronous
login local
stopbits 1
line aux 0
stopbits 1
line vty 0 4
privilege level 15
password csco
login local
transport input telnet
line vty 5 15
privilege level 15
password csco
login local
transport input telnet
!
scheduler allocate 20000 1000
!
end
R2#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
C 192.1.12.0/24 is directly connected, GigabitEthernet0/1
1.0.0.0/32 is subnetted, 1 subnets
O E2 1.1.1.1 [110/11] via 192.1.12.10, 14:54:18, GigabitEthernet0/1
C 2.0.0.0/8 is directly connected, Loopback0
4.0.0.0/32 is subnetted, 1 subnets
O 4.4.4.4 [110/65] via 192.1.24.4, 14:54:19, Serial0/1/0.4
C 192.1.25.0/24 is directly connected, Serial0/1/0.5
5.0.0.0/32 is subnetted, 1 subnets
O 5.5.5.5 [110/65] via 192.1.25.5, 14:54:19, Serial0/1/0.5
C 192.1.24.0/24 is directly connected, Serial0/1/0.4
D EX 6.0.0.0/8 [170/2560512256] via 192.1.26.6, 1w0d, Serial0/1/0.6
C 192.1.26.0/24 is directly connected, Serial0/1/0.6
9.0.0.0/32 is subnetted, 1 subnets
O IA 9.9.9.9 [110/66] via 192.1.24.4, 14:54:22, Serial0/1/0.4
S 192.168.5.0/24 [1/0] via 192.1.12.10
D EX 192.1.66.0/24 [170/2560512256] via 192.1.26.6, 14:44:27, Serial0/1/0.6
10.0.0.0/24 is subnetted, 3 subnets
O E2 10.5.5.0 [110/120] via 192.1.25.5, 14:54:22, Serial0/1/0.5
O E2 10.2.2.0 [110/10] via 192.1.12.10, 14:54:22, GigabitEthernet0/1
O E2 10.1.1.0 [110/120] via 192.1.12.10, 14:54:21, GigabitEthernet0/1
O E2 212.1.5.0/24 [110/120] via 192.1.25.5, 14:54:22, Serial0/1/0.5
O E2 212.1.4.0/24 [110/120] via 192.1.25.5, 14:54:22, Serial0/1/0.5
O IA 192.1.49.0/24 [110/65] via 192.1.24.4, 14:54:22, Serial0/1/0.4
O E2 212.1.7.0/24 [110/120] via 192.1.25.5, 14:54:22, Serial0/1/0.5
O E2 212.1.6.0/24 [110/120] via 192.1.25.5, 14:54:22, Serial0/1/0.5
R2#sh run
Building configuration...
Current configuration : 2091 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R2
!
boot-start-marker
boot system flash:c2800nm-advipservicesk9-mz.123-14.T7.bin
boot-end-marker
!
enable secret 5 $1$5qT1$VPa6QrQf2IDDtM21Uw8sV.
!
no aaa new-model
!
resource policy
!
ip subnet-zero
!
!
ip cef
no ip dhcp use vrf connected
!
!
no ip ips deny-action ips-interface
!
no ftp-server write-enable
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
no crypto isakmp ccm
!
!
!
!
interface Loopback0
ip address 2.2.2.2 255.0.0.0
!
interface GigabitEthernet0/0
no ip address
shutdown
duplex auto
speed auto
!
interface GigabitEthernet0/1
ip address 192.1.12.2 255.255.255.0
duplex auto
speed auto
!
interface Serial0/1/0
no ip address
encapsulation frame-relay
no frame-relay inverse-arp
frame-relay lmi-type cisco
!
interface Serial0/1/0.4 point-to-point
ip address 192.1.24.2 255.255.255.0
ip access-group 164 in
frame-relay interface-dlci 204
!
interface Serial0/1/0.5 point-to-point
ip address 192.1.25.2 255.255.255.0
ip access-group 164 in
frame-relay interface-dlci 205
!
interface Serial0/1/0.6 point-to-point
ip address 192.1.26.2 255.255.255.0
ip access-group 164 in
frame-relay interface-dlci 206
!
router eigrp 26
redistribute ospf 1 metric 1 1 1 1 1 route-map ospfeig
network 192.1.26.0
no auto-summary
!
router ospf 1
router-id 2.2.2.2
log-adjacency-changes
redistribute connected
redistribute static
redistribute eigrp 26 subnets
network 2.2.2.2 0.0.0.0 area 0
network 192.1.12.0 0.0.0.255 area 0
network 192.1.24.0 0.0.0.255 area 0
network 192.1.25.0 0.0.0.255 area 0
!
ip classless
ip route 192.168.5.0 255.255.255.0 192.1.12.10
!
!
ip http server
no ip http secure-server
!
!
route-map ospfeig permit 10
set tag 110
!
!
!
!
alias exec cc config t
alias exec ship sh ip int brief
alias exec sir sh ip route
alias exec shr sh run
!
line con 0
exec-timeout 0 0
logging synchronous
stopbits 1
line aux 0
stopbits 1
line vty 0 4
login
!
scheduler allocate 20000 1000
!
end
R2#
