Sounds like a routing issue, is your ippool handling out IP addr to the clients. I recently set a similar config on a 1811 and this works fine. I can send you the working config if you're intersted.
Regards, Ge Moua | Email: [EMAIL PROTECTED] Network Design Engineer University of Minnesota | Networking & Telecommunications Services -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Marc Haber Sent: Tuesday, August 26, 2008 9:01 AM To: [email protected] Subject: [c-nsp] VPN Client to 1841,default route into tunnel with exceptions Hi, this is strictly a client issue and not appropriate for cisco-nsp, but I haven't found any mailing list with this clue level for other cisco-related aspects. If there is one, I'd like to learn about it. I have a bunch of Windows clients with the Cisco VPN Client 5.0.01.0600 and an 1841 running IOS 12.4(9)T4. My configuration is as follows: aaa new-model ! aaa authentication login default local aaa authentication login userauthen local aaa authentication login localauth local aaa authorization exec default local aaa authorization network groupauthor local ! aaa session-id common ! resource policy ! ip cef ! username marc.haber privilege 15 secret 5 <snip> ! crypto isakmp policy 3 encr aes 256 authentication pre-share group 2 ! crypto isakmp client configuration group InternClient key onsh4OcyivOafmyodzet dns 10.1.2.11 10.1.2.15 wins 10.1.2.11 10.1.2.15 domain example.com pool ippool acl DefaultrouteTunnel ! ! crypto ipsec transform-set InternTransformSet esp-aes 256 esp-sha-hmac ! crypto dynamic-map InternDynmap 10 set transform-set InternTransformSet reverse-route ! ! crypto map InternClientMap client authentication list userauthen crypto map InternClientMap isakmp authorization list groupauthor crypto map InternClientMap client configuration address respond crypto map InternClientMap 10 ipsec-isakmp dynamic InternDynmap ! interface FastEthernet0/0 description $ETH-LAN$$ETH-SW-LAUNCH$$INTF-INFO-FE 0$ ip address 172.26.248.10 255.255.255.248 duplex auto speed auto crypto map InternClientMap ! ip access-list extended DefaultrouteTunnel permit ip any any ip access-list extended DefaultrouteWithoutListedNetsTunnel deny ip 192.168.8.0 0.0.0.255 any permit ip any any ! With this configuration, a client cannot communicate at all outside the tunnel, which is a desired feature in this setup. OTOH, some teleworkers would appreciate to be able to talk to their networked printers on the local LANs. I have received the advice of adding the local networks of all teleworkers to an access list, which has resulted in the "DefaultrouteWithoutListedNetsTunnel" ACL. But this does not seem to work, traffic for 192.168.8.3 still goes into the tunnel after I changed the acl reference in the crypto isakmp client configuration group InternClient. Also, I do not see any changes in the Windows client's routing tables. Can someone advice what I am doing wrong here? Additionally, do I really need to exclude all local networks of all teleworkers in the global configuration, or is it possible to control this on a per-client basis? All web-based documentation I have found deals with the VPN Concentrator series which do not seem to use IOS - at least I cannot make sense of the advice found there in my configuration. Any hints will be appreciated. Greetings Marc -- ---------------------------------------------------------------------------- - Marc Haber | "I don't trust Computers. They | Mailadresse im Header Mannheim, Germany | lose things." Winona Ryder | Fon: *49 621 72739834 Nordisch by Nature | How to make an American Quilt | Fax: *49 3221 2323190 _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
