Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

we are connecting Cisco 887VA router with various other Non-Cisco routers.

VPN tunnels are up and we can ping devices on the remote network through the VPN.

However, we have a few devices (on the Cisco lan) that provide a web interface (NAS etc) and these are not accessible over the VPN, the connection seems to just hang like its waiting for a response but it never gets one and eventually the browser times out.

Strangely, if I request a page that does not exist from the NAS (eg. http://192.168.3.x/test) I will receive a 404 error so it is kind of working.

Similar problems with SMB, if I access \\192.168.3.x I can list the content (4 items) but if I go into one of those folders (containing 10+ items) it hangs and eventually gives up.

I have tried adjusting MTU and MSS with no change.

Any ideas cause I'm running out of hair :)

My config is below, it is most likely a mess as this is my first Cisco device so please go easy ;)

version 15.1
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname XXXXXXXX
!
boot-start-marker
boot-end-marker
!
enable secret level 1 4 XXXXXXX
enable secret 4 XXXXXXX
enable password 7 XXXXXXX
!
no aaa new-model
memory-size iomem 10
crypto pki token default removal timeout 0
!
ip source-route
!
ip dhcp excluded-address 192.168.3.1 192.168.3.149
ip dhcp excluded-address 192.168.3.200 192.168.3.255
ip dhcp excluded-address 192.168.3.150
ip dhcp excluded-address 192.168.3.168
!
ip dhcp pool lanpool
 network 192.168.3.0 255.255.255.0
 default-router 192.168.3.1
 dns-server XXX.XXX.143.36 XXX.XXX.128.17
!
ip cef
no ipv6 cef
!
license udi pid CISCO887VA-M-K9 sn XXXXXXX
!
username admin privilege 15 secret 4 XXXXXXX
!
controller VDSL 0
!
crypto isakmp policy 1
 encr aes 256
 authentication pre-share
 group 5
crypto isakmp key XXXXXXX address XXX.XXX.246.212
crypto isakmp key XXXXXXX address XXX.XXX.246.196
crypto isakmp key XXXXXXX address XXX.XXX.198.46
crypto isakmp key XXXXXXX address XXX.XXX.183.86
crypto isakmp keepalive 15
!
!
crypto ipsec transform-set ESP_AES_SHA esp-aes esp-sha-hmac
no crypto ipsec nat-transparency udp-encapsulation
!
crypto map TUNNELS 10 ipsec-isakmp
 set peer XXX.XXX.246.212
 set transform-set ESP_AES_SHA
 match address JAR
crypto map TUNNELS 20 ipsec-isakmp
 set peer XXX.XXX.198.46
 set transform-set ESP_AES_SHA
 match address BIR
crypto map TUNNELS 40 ipsec-isakmp
 set peer XXX.XXX.183.86
 set transform-set ESP_AES_SHA
 match address BOL
crypto map TUNNELS 60 ipsec-isakmp
 set peer XXX.XXX.246.196
 set transform-set ESP_AES_SHA
 match address HEB
!
interface Ethernet0
 no ip address
!
interface ATM0
 no ip address
 no atm ilmi-keepalive
 pvc 0/38
  encapsulation aal5mux ppp dialer
  dialer pool-member 1
 !
!
interface FastEthernet0
 no ip address
!
interface FastEthernet1
 no ip address
!
interface FastEthernet2
 no ip address
!
interface FastEthernet3
 no ip address
!
interface Vlan1
 ip address 192.168.3.1 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip flow ingress
 ip nat inside
 ip virtual-reassembly in
 no autostate
!
interface Dialer0
 ip address negotiated
 ip access-group d0.in in
 ip access-group d0.out out
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat outside
 ip virtual-reassembly in
 encapsulation ppp
 ip tcp adjust-mss 1427
 dialer pool 1
 ppp authentication chap callin
 ppp chap hostname XXXXXXXXXX
 ppp chap password 7 XXXXXXXXXX
 no cdp enable
 crypto map TUNNELS
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
ip nat pool windisplay0 192.168.3.55 192.168.3.55 netmask 255.255.255.0 type rotary
ip nat pool windisplay1 192.168.3.56 192.168.3.56 netmask 255.255.255.0 type rotary
ip nat pool windisplay2 192.168.3.57 192.168.3.57 netmask 255.255.255.0 type rotary
ip nat inside source static tcp 192.168.3.103 8082 interface Dialer0 8082
ip nat inside source static tcp 192.168.3.240 8888 interface Dialer0 8888
ip nat inside source route-map test interface Dialer0 overload
ip nat inside destination list windisplay0 pool windisplay0
ip nat inside destination list windisplay1 pool windisplay1
ip nat inside destination list windisplay2 pool windisplay2
ip route 0.0.0.0 0.0.0.0 Dialer0
!
ip access-list extended BIR
 permit ip 192.168.3.0 0.0.0.255 192.168.0.0 0.0.0.255
ip access-list extended BOL
 permit ip 192.168.3.0 0.0.0.255 192.168.2.0 0.0.0.255
ip access-list extended HEB
 permit ip 192.168.3.0 0.0.0.255 192.168.9.0 0.0.0.255
ip access-list extended JAR
 permit ip 192.168.3.0 0.0.0.255 192.168.5.0 0.0.0.255
ip access-list extended LOW
 deny   ip 192.168.3.0 0.0.0.255 192.168.0.0 0.0.255.255
 permit ip 192.168.3.0 0.0.0.255 any
ip access-list extended d0.in
 permit ip any any
ip access-list extended d0.out
 permit ip any any
 permit ip 192.168.3.0 0.0.0.255 any
!
route-map test permit 10
 match ip address LOW
!
line con 0
 password 7 XXXXXXXXX
 login
line aux 0
 login local
line vty 0 4
 password 7 XXXXXXXXX
 login
 transport input all
!
scheduler max-task-time 5000
end
share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.