Velocity Reviews

Velocity Reviews (http://www.velocityreviews.com/forums/index.php)
-   Cisco (http://www.velocityreviews.com/forums/f27-cisco.html)
-   -   Cisco Easy VPN connects, but can't access remote LAN (http://www.velocityreviews.com/forums/t947539-cisco-easy-vpn-connects-but-cant-access-remote-lan.html)

sky 06-26-2012 02:46 PM

Cisco Easy VPN connects, but can't access remote LAN
 
I have Cisco Easy VPN setup on a SR520 router with IOS Version 12.4(20)T6. The client computer is running Linux using vpnc 0.5.3 http://www.unix-ag.uni-kl.de/~massar/vpnc/. I'm able to establish the vpn connection, but can't ping the SR520 router that the connection is made to or any other devicesattached to the switch ports on this router.

After making a vpn connection if I ping the router vlan ip from the client computer the numbers increase shown by this command:

Router#show crypto ipsec sa
#pkts decaps: 25, #pkts decrypt: 25, #pkts verify: 25

I don't get a reply shown by the ping command either on the client or if I ping from the router to the client vpn assigned IP.

Here is the routing table on the Linux client computer after establishing the vpn.
$ netstat -r
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
10.50.6.0 * 255.255.255.255 UH 0 0 0 tun0
sr520 public ip 192.168.1.2 255.255.255.255 UGH 1500 0 0 eth0
10.50.6.0 * 255.255.255.192 U 0 0 0 tun0
localnet * 255.255.255.0 U 0 0 0 eth0
loopback * 255.0.0.0 U 0 0 0 lo
default 192.168.1.2 0.0.0.0 UG 0 0 0 eth0

Here is the router config:

Current configuration : 2991 bytes
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname sr520
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
enable secret 5 removed
!
aaa new-model
!
!
aaa authentication login default local
aaa authorization network default local
!
!
aaa session-id common
!
!
dot11 syslog
ip source-route
!
!
ip cef
!
no ipv6 cef
multilink bundle-name authenticated
!
!
username removed privilege 15 secret 5 removed
!
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
!
crypto isakmp client configuration group vpn
key removed
pool dpool
acl 107
crypto isakmp profile vi
match identity group vpn
isakmp authorization list default
client configuration address respond
client configuration group vpn
virtual-template 1
!
!
crypto ipsec transform-set set esp-3des esp-sha-hmac
!
crypto ipsec profile vi
set transform-set set
set isakmp-profile vi
!
!
archive
log config
hidekeys
!
!
!
!
!
interface Loopback0
no ip address
!
interface ATM0
no ip address
no atm ilmi-keepalive
dsl operating-mode auto
!
interface ATM0.1 point-to-point
description WAN via ADSL
pvc 0/35
pppoe-client dial-pool-number 1
!
!
interface FastEthernet0
switchport access vlan 75
!
interface FastEthernet1
switchport access vlan 75
!
interface FastEthernet2
switchport access vlan 75
!
interface FastEthernet3
switchport access vlan 75
!
interface Virtual-Template1 type tunnel
ip unnumbered Loopback0
tunnel mode ipsec ipv4
tunnel protection ipsec profile vi
!
interface Vlan1
no ip address
shutdown
!
interface Vlan75
ip address 10.50.6.14 255.255.255.192
ip nat inside
ip virtual-reassembly
!
interface Dialer0
ip address negotiated
ip nat outside
ip virtual-reassembly
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication chap pap callin
ppp chap hostname removed
ppp chap password 7 removed
ppp pap sent-username removed password 7 removed
!
ip local pool dpool 10.50.6.15
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Dialer0
!
no ip http server
no ip http secure-server
ip nat inside source list 100 interface Dialer0 overload
!
access-list 100 permit tcp 10.50.6.16 0.0.0.192 any
access-list 107 permit ip host 10.50.6.0 any
!

Suspecting it may be a NAT issue I tried removing this command

ip nat inside source list 100 interface Dialer0 overload

but I still can't ping even without that.

alex 06-26-2012 06:28 PM

Re: Cisco Easy VPN connects, but can't access remote LAN
 
> After making a vpn connection if I ping the router vlan ip from the client computer the numbers increase shown by this command:
>
> Router#show crypto ipsec sa
> #pkts decaps: 25, #pkts decrypt: 25, #pkts verify: 25
>


Can you confirm that if you send 5 ICMP packets then the pkts encr/decr
increase both by 5?

Alex

sky 06-26-2012 07:16 PM

Re: Cisco Easy VPN connects, but can't access remote LAN
 
On Tuesday, June 26, 2012 2:28:15 PM UTC-4, alex wrote:
> > After making a vpn connection if I ping the router vlan ip from the client computer the numbers increase shown by this command:
> >
> > Router#show crypto ipsec sa
> > #pkts decaps: 25, #pkts decrypt: 25, #pkts verify: 25
> >

>
> Can you confirm that if you send 5 ICMP packets then the pkts encr/decr
> increase both by 5?
>
> Alex


$ ping -c 5 10.50.6.14

Router#show crypto ipsec sa
....
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 5, #pkts decrypt: 5, #pkts verify: 5
....

The encrypt is 0, but decrypt is 5 after sending 5 packets.

alex 06-27-2012 07:53 AM

Re: Cisco Easy VPN connects, but can't access remote LAN
 
>
> $ ping -c 5 10.50.6.14
>
> Router#show crypto ipsec sa
> ...
> #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
> #pkts decaps: 5, #pkts decrypt: 5, #pkts verify: 5
> ...
>
> The encrypt is 0, but decrypt is 5 after sending 5 packets.


Can you check where your router's routing table sees the assigned IP
address of the client?

sh ip route <IP address>

I remember about "set reverse-route", you might need to set that option.

Optionally you can set a bidirectionaly ACL for the src and dst ping and
use debug ip packet <ACL #> to see where the response goes.

Alex

sky 06-27-2012 12:49 PM

Re: Cisco Easy VPN connects, but can't access remote LAN
 
On Wednesday, June 27, 2012 3:53:24 AM UTC-4, alex wrote:
> >
> > $ ping -c 5 10.50.6.14
> >
> > Router#show crypto ipsec sa
> > ...
> > #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
> > #pkts decaps: 5, #pkts decrypt: 5, #pkts verify: 5
> > ...
> >
> > The encrypt is 0, but decrypt is 5 after sending 5 packets.

>
> Can you check where your router's routing table sees the assigned IP
> address of the client?
>
> sh ip route <IP address>
>
> I remember about "set reverse-route", you might need to set that option.
>
> Optionally you can set a bidirectionaly ACL for the src and dst ping and
> use debug ip packet <ACL #> to see where the response goes.
>
> Alex


Router#sh ip route 10.50.6.15
Routing entry for 10.50.6.15/32
Known via "static", distance 1, metric 0
Routing Descriptor Blocks:
* <client public IP>, via Virtual-Access3
Route metric is 0, traffic share count is 1

I also created this ACL and turned on 'debug ip packet 100'
and 'term mon'

access-list 100 permit ip host 10.50.6.15 host <client public IP>
access-list 100 permit ip host <client public IP> host 10.50.6.15

No debug info is displayed when pinging from the client



alex 06-27-2012 01:52 PM

Re: Cisco Easy VPN connects, but can't access remote LAN
 

> I also created this ACL and turned on 'debug ip packet 100'
> and 'term mon'
>
> access-list 100 permit ip host 10.50.6.15 host <client public IP>
> access-list 100 permit ip host <client public IP> host 10.50.6.15
>
> No debug info is displayed when pinging from the client


Try

no access-list 100
access-list 100 permit ip host 10.50.6.15 host 10.50.6.14
access-list 100 permit ip host 10.50.6.14 host 10.50.6.15

debug ip packet 100

and try pinging again


alex 06-27-2012 01:57 PM

Re: Cisco Easy VPN connects, but can't access remote LAN
 
>> I also created this ACL and turned on 'debug ip packet 100'
>> and 'term mon'
>>
>> access-list 100 permit ip host 10.50.6.15 host <client public IP>
>> access-list 100 permit ip host <client public IP> host 10.50.6.15
>>
>> No debug info is displayed when pinging from the client

>
> Try
>
> no access-list 100
> access-list 100 permit ip host 10.50.6.15 host 10.50.6.14
> access-list 100 permit ip host 10.50.6.14 host 10.50.6.15
>
> debug ip packet 100
>
> and try pinging again


I sent the mail too fast :)
I meant pinging from the client (10.50.6.15) to the router (10.50.6.14)

sky 06-27-2012 02:18 PM

Re: Cisco Easy VPN connects, but can't access remote LAN
 
On Wednesday, June 27, 2012 9:52:33 AM UTC-4, alex wrote:
> > I also created this ACL and turned on 'debug ip packet 100'
> > and 'term mon'
> >
> > access-list 100 permit ip host 10.50.6.15 host <client public IP>
> > access-list 100 permit ip host <client public IP> host 10.50.6.15
> >
> > No debug info is displayed when pinging from the client

>
> Try
>
> no access-list 100
> access-list 100 permit ip host 10.50.6.15 host 10.50.6.14
> access-list 100 permit ip host 10.50.6.14 host 10.50.6.15
>
> debug ip packet 100
>
> and try pinging again


From the Linux client
$ ping -c1 10.50.6.14
PING 10.50.6.14 (10.50.6.14) 56(84) bytes of data.

--- 10.50.6.14 ping statistics ---
1 packets transmitted, 0 received, 100% packet loss, time 0ms

debug info shown on the router during the ping

*Mar 12 11:35:20.024: IP: s=10.50.6.15 (Virtual-Access3), d=10.50.6.14, len 84, input feature, MCI Check(59), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
*Mar 12 11:35:20.024: IP: tableid=0, s=10.50.6.15 (Virtual-Access3), d=10.50.6.14 (Vlan75), routed via RIB
*Mar 12 11:35:20.024: IP: s=10.50.6.15 (Virtual-Access3), d=10.50.6.14 (Vlan75), len 84, output feature, NAT Inside(7), rtype 1, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
*Mar 12 11:35:20.024: IP: s=10.50.6.15 (Virtual-Access3), d=10.50.6.14 (Vlan75), len 84, output feature, Stateful Inspection(19), rtype 1, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
*Mar 12 11:35:20.024: IP: s=10.50.6.15 (Virtual-Access3), d=10.50.6.14, len 84, rcvd 4
*Mar 12 11:35:20.024: IP: s=10.50.6.15 (Virtual-Access3), d=10.50.6.14, len 84, stop process pak for forus packet
*Mar 12 11:35:20.024: IP: s=10.50.6.14 (local), d=10.50.6.15, len 84, local feature, NAT(2), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
*Mar 12 11:35:20.024: IP: s=10.50.6.14 (local), d=10.50.6.15 (Virtual-Access3), len 84, sending

sky 06-27-2012 02:47 PM

Re: Cisco Easy VPN connects, but can't access remote LAN
 
On Wednesday, June 27, 2012 9:52:33 AM UTC-4, alex wrote:
> > I also created this ACL and turned on 'debug ip packet 100'
> > and 'term mon'
> >
> > access-list 100 permit ip host 10.50.6.15 host <client public IP>
> > access-list 100 permit ip host <client public IP> host 10.50.6.15
> >
> > No debug info is displayed when pinging from the client

>
> Try
>
> no access-list 100
> access-list 100 permit ip host 10.50.6.15 host 10.50.6.14
> access-list 100 permit ip host 10.50.6.14 host 10.50.6.15
>
> debug ip packet 100
>
> and try pinging again


I posted a reply but it didn't show up, so here it is again hopefully this won't result in a double post.

From the Linux vpn client
$ ping -c1 10.50.6.14
PING 10.50.6.14 (10.50.6.14) 56(84) bytes of data.

--- 10.50.6.14 ping statistics ---
1 packets transmitted, 0 received, 100% packet loss, time 0ms

Debug info shown on router during the ping

*Mar 12 11:35:20.024: IP: s=10.50.6.15 (Virtual-Access3), d=10.50.6.14, len 84, input feature, MCI Check(59), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
*Mar 12 11:35:20.024: IP: tableid=0, s=10.50.6.15 (Virtual-Access3), d=10.50.6.14 (Vlan75), routed via RIB
*Mar 12 11:35:20.024: IP: s=10.50.6.15 (Virtual-Access3), d=10.50.6.14 (Vlan75), len 84, output feature, NAT Inside(7), rtype 1, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
*Mar 12 11:35:20.024: IP: s=10.50.6.15 (Virtual-Access3), d=10.50.6.14 (Vlan75), len 84, output feature, Stateful Inspection(19), rtype 1, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
*Mar 12 11:35:20.024: IP: s=10.50.6.15 (Virtual-Access3), d=10.50.6.14, len 84, rcvd 4
*Mar 12 11:35:20.024: IP: s=10.50.6.15 (Virtual-Access3), d=10.50.6.14, len 84, stop process pak for forus packet
*Mar 12 11:35:20.024: IP: s=10.50.6.14 (local), d=10.50.6.15, len 84, local feature, NAT(2), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
*Mar 12 11:35:20.024: IP: s=10.50.6.14 (local), d=10.50.6.15 (Virtual-Access3), len 84, sending

alex 06-27-2012 03:14 PM

Re: Cisco Easy VPN connects, but can't access remote LAN
 
Could you pls post the output of

show interface Virtual-Access3

?


All times are GMT. The time now is 04:04 AM.

Powered by vBulletin®. Copyright ©2000 - 2014, vBulletin Solutions, Inc.
SEO by vBSEO ©2010, Crawlability, Inc.