Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

First time configureing remote access VPN for 8.3 / 8.4 so the NAT and VPN commands are a bit diffrent for me.

Below is the VPN config and the coresponding NAT to NO NAT the IP space. If someone could have a look over it and let me know if I am missing anything. The network is 192.0.0.0 / 24 ha, not a typo.


crypto ikev1 enable outside

crypto ikev1 policy 10
encryption 3des
authentication pre-share
hash sha

access-list SPLIT-TUNNEL-VPN standard permit 192.0.1.0 255.255.255.0
access-list SPLIT-TUNNEL-VPN standard permit 192.0.0.0 255.255.255.0

group-policy REMOTE-VPN-GP internal
group-policy REMOTE-VPN-GP attributes
vpn-tunnel-protocol ikev1
address-pools value REMOTE-VPN-POOL
split-tunnel-policy tunnelspecified
split-tunnel-network-list value SPLIT-TUNNEL-VPN
dns-server value 192.0.0.201

tunnel-group REMOTE-VPN-TG type remote-access
tunnel-group REMOTE-VPN-TG general-attributes
default-group-policy REMOTE-VPN-GP
authentication-server-group LOCAL

tunnel-group REMOTE-VPN-TG ipsec-attributes
ikev1 pre-shared-key **********

ip local pool REMOTE-VPN-POOL 192.0.1.1-192.0.1.100 mask 255.255.255.0

crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map OUTSIDE-DYNMAP 65535 set ikev1 transform-set ESP-3DES-SHA

crypto map OUTSIDE_MAP 65535 ipsec-isakmp dynamic OUTSIDE-DYNMAP
crypto map OUTSIDE_MAP interface outside

//No NAT subnet

object network INSIDE_LAN
subnet 192.0.0.0 255.255.255.0

object network VPN_LAN
subnet 192.0.1.0 255.255.255.0

nat (inside,outside) source static INSIDE_LAN INSIDE_LAN  destination static VPN_LAN VPN_LAN

or would I do this for the no nat:

nat (inside,outside) 1 source static any any destination static VPN_LAN VPN_LAN

My NAT is currently set up as:

object network LAN_NAT
subnet 192.0.0.0 255.255.255.0
nat (inside,outside) dynamic interface
share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

If 192.0.0.0/24 is your inside interface/LAN then what is 192.0.1.0/24?

You have given the object name of VPN_LAN to the 192.0.1.0/24 subnet? However, you define the remote-access VPN address pool as 10.1.2.140-10.1.2.145. The addresses assigned to the client VPN adapters will be in the range of 10.1.2.140-10.1.2.145.

I am going to assume that 192.0.1.0/24 is not needed and that your inside is 192.0.0.0/24 and your VPN client adapters will have IP's pulled from the 10.1.2.140-10.1.2.145 pool -- you may just want to make this 10.1.2.0/24 -- however I will continue with your existing pool.

You can configure your inside outbound dynamic interface PAT setup with the following. You have created another LAN_NAT object when you can define your dynamic interface PAT right in the INSIDE_LAN object -- they appear in two different parts of the configuration (subnet definition and object NAT) but are (and can) still defined in the same object.

object network INSIDE_LAN
 subnet 192.0.0.0 255.255.255.0
 nat (inside,outside) dynamic interface

Below is a network object created that represents the IP block that is the pool. Does not redefine the pool itself as that is ip local pool.

object network RAVPN_POOL
 subnet 10.1.2.0 255.255.255.0   ! adjust this and pool itself to meet needs

Configure your identity NAT (no nat) as follows -- not in an object, but a twice NAT.

nat (inside,outside) source INSIDE_LAN INSIDE_LAN destination static RAVPN_POOL RAVPN_POOL description [[ Inside to RA Identity NAT ]]

Assuming I understand your setup you can then rid yourself of the LAN_NAT and VPN_LAN objects and the 192.0.1.0/24 entry in the SPLIT-TUNNEL-VPN ACL.

no access-list SPLIT-TUNNEL-VPN standard permit 192.0.1.0 255.255.255.0
no object network LAN_NAT
no object network VPN_LAN

There are some additional things to be considered on your P1/IKE policy as well -- 3DES/MD5 in P1 when you have P2 defined as 3DES/SHA is fine, but slightly odd.

share|improve this answer
    
Thanks for the great write up. I actually had the wrong IP range in my VPN pool. It was supposed to be 192.0.1.1-192.0.1.100. I also change the P1 to SHA as well. It looks like with the VPN range correction I should be good, correct? –  evolvd Nov 3 '11 at 9:28
    
@evolvd Just ensure that whatever range you choose you have the pool set correctly, the NAT Identity set correctly, and split-tunnel-network-list ACL set correctly. Your P1, P2/crypto map, and Tunnel-Group look fine. –  Weaver Nov 5 '11 at 15:19
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.