Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to connect a Cisco IOS router to Azure via the IPSec VPN. I have used the Cisco ISR template to establish a tunnel from my router to Azure. In the Azure control panel, I can see that the connection is established. However, while "Data Out" seems to be working, the "Data In" shows zero, and I can't SSH, RDP or nslookup to or from my local network to Azure in either direction.

As the tunnel is established, I'm sure the problem is on my router. I'm not really a networking guy (sole IT guy for a small business), so any help would be appreciated.

Here's some output from my router:

murasaki#sh crypto session
Crypto session current status

Interface: Virtual-Access2
Session status: DOWN
Peer: x.x.x.x port 500
  IPSEC FLOW: permit ip 192.168.1.0/255.255.255.0 192.168.5.0/255.255.255.0
        Active SAs: 0, origin: crypto map

Interface: Dialer1
Session status: UP-ACTIVE
Peer: x.x.x.x port 500
  IKE SA: local x.x.x.x/500 remote x.x.x.x/500 Active
  IPSEC FLOW: permit ip 192.168.1.0/255.255.255.0 192.168.5.0/255.255.255.0
        Active SAs: 2, origin: crypto map

murasaki#sho crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
x.x.x.x        x.x.x.x        QM_IDLE           2002 ACTIVE

IPv6 Crypto ISAKMP SA

Here's the config of the router with the sensitive bits removed / scrubbed:

!
version 15.0
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
!
hostname murasaki
!
boot-start-marker
boot-end-marker
!
!
aaa new-model
!
!
aaa authentication ppp default local
aaa authorization network default local 
!
!
!
!
!
aaa session-id common
memory-size iomem 10
!
crypto pki trustpoint TP-self-signed-4045734018
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-4045734018
revocation-check none
rsakeypair TP-self-signed-4045734018
ip source-route
!
!
ip cef
ip inspect name normal_traffic tcp
ip inspect name normal_traffic udp
ipv6 unicast-routing
ipv6 cef
!
!
!
object-group network INTERNAL_LAN 
description All Internal subnets which should be allowed out to the Internet
192.168.1.0 255.255.255.0
192.168.20.0 255.255.255.0
10.10.10.0 255.255.255.0
192.168.40.0 255.255.255.0
192.168.6.0 255.255.255.0
!
!
!
ip ssh time-out 60
ip ssh version 2
! 
!
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 2
lifetime 28800
crypto isakmp key  address 
!
!
crypto ipsec transform-set AzureIPSec esp-aes 256 esp-sha-hmac 
!
crypto map AzureCryptoMap 10 ipsec-isakmp 
set peer 
set security-association lifetime kilobytes 102400000
set transform-set AzureIPSec 
match address AzureCloudVMs
!
bridge irb
!
!
!
!
interface BRI0
no ip address
encapsulation hdlc
shutdown
isdn termination multidrop
!
interface ATM0
mtu 1492
no ip address
no atm ilmi-keepalive
pvc 8/35 
encapsulation aal5mux ppp dialer
dialer pool-member 1
!
!
interface Vlan1
description Main LAN
ip address 192.168.1.97 255.255.255.0
ip nat inside
ip virtual-reassembly
!
interface Vlan5
description Azure VLAN
ip address 192.168.5.97 255.255.255.128
!
interface Dialer1
mtu 1492
ip address negotiated
ip access-group PORTS_ALLOWED_IN in
ip flow ingress
ip nat outside
ip inspect normal_traffic out
ip virtual-reassembly
encapsulation ppp
ip tcp adjust-mss 1350
dialer pool 1
dialer-group 1
ipv6 address autoconfig
ipv6 enable
ppp ipcp route default
no cdp enable
crypto map AzureCryptoMap
!
no ip forward-protocol nd
no ip http server
no ip http secure-server
!
ip nat translation timeout 360
ip nat inside source list SUBNETS_AND_PROTOCOLS_ALLOWED_OUT interface Dialer1 overload
ip nat inside source static tcp 192.168.x.x 55663 interface Dialer1 55663
ip nat inside source static tcp 192.168.x.x 22 interface Dialer1 22
ip nat inside source static udp 192.168.x.x 55663 interface Dialer1 55663
!
ip access-list extended AzureCloudVMs
permit ip 192.168.1.0 0.0.0.255 192.168.5.0 0.0.0.255
ip access-list extended GUEST_VLAN
permit tcp any any eq 22
permit tcp any any eq www
permit tcp any any eq 443
permit tcp any any eq domain
permit udp any any eq domain
permit icmp any any
ip access-list extended PORTS_ALLOWED_IN

remark List of ports which are allowed IN

permit gre any any
permit esp any any
permit udp any any eq non500-isakmp
permit udp any any eq isakmp
permit tcp any any eq 55663
permit udp any any eq 55663
permit tcp any any eq 22
permit tcp any any eq 222
permit tcp any any eq 1723
permit tcp any any eq 443
permit icmp any any echo-reply
permit icmp any any traceroute
permit icmp any any port-unreachable
permit icmp any any time-exceeded
deny ip any any
ip access-list extended SUBNETS_AND_PROTOCOLS_ALLOWED_OUT
deny tcp object-group INTERNAL_LAN any eq smtp
permit tcp object-group INTERNAL_LAN any
permit udp object-group INTERNAL_LAN any
permit icmp object-group INTERNAL_LAN any
deny ip any any
!
no cdp run

ipv6 route ::/0 Dialer1
!
share|improve this question
    
Shouldn't the Virtual-Access2 interface have UP status? Otherwise the rule permitting traffic between the two 192.168 subnets wouldn't seem to be in effect. –  Noah Stahl May 29 '13 at 1:01
    
Yes, I would have thought so. But this isn't an interface I have defined, so I can't go into the config and do a 'no shut'. –  Timothy May 29 '13 at 1:57
    
What I'm thinking is that doesn't mean it is configured to be down, but rather that your session isn't actually getting established. What does the Azure side report? –  Noah Stahl May 29 '13 at 3:16
    
Hmm, Azure says it's up though: postimg.org/image/5hj20a7m9 And the router says an IPsec and ISAKMP SA has been established. But I still can't RDP or SSH to or from anything using the Azure addresses (the 192.168.5.x range). –  Timothy May 29 '13 at 5:14

1 Answer 1

Turns out I just needed to remove the VLAN 5 and IP address from the Cisco router!

share|improve this answer
1  
If this solved your problem, you can accept your own answer as a solution. –  Tom O'Connor May 29 '13 at 10:14
    
Interesting. Which part of the config did you remove? –  Noah Stahl May 29 '13 at 12:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.