I am trying to connect a Cisco IOS router to Azure via the IPSec VPN. I have used the Cisco ISR template to establish a tunnel from my router to Azure. In the Azure control panel, I can see that the connection is established. However, while "Data Out" seems to be working, the "Data In" shows zero, and I can't SSH, RDP or nslookup to or from my local network to Azure in either direction.
As the tunnel is established, I'm sure the problem is on my router. I'm not really a networking guy (sole IT guy for a small business), so any help would be appreciated.
Here's some output from my router:
murasaki#sh crypto session Crypto session current status Interface: Virtual-Access2 Session status: DOWN Peer: x.x.x.x port 500 IPSEC FLOW: permit ip 192.168.1.0/255.255.255.0 192.168.5.0/255.255.255.0 Active SAs: 0, origin: crypto map Interface: Dialer1 Session status: UP-ACTIVE Peer: x.x.x.x port 500 IKE SA: local x.x.x.x/500 remote x.x.x.x/500 Active IPSEC FLOW: permit ip 192.168.1.0/255.255.255.0 192.168.5.0/255.255.255.0 Active SAs: 2, origin: crypto map murasaki#sho crypto isakmp sa IPv4 Crypto ISAKMP SA dst src state conn-id status x.x.x.x x.x.x.x QM_IDLE 2002 ACTIVE IPv6 Crypto ISAKMP SA
Here's the config of the router with the sensitive bits removed / scrubbed:
! version 15.0 no service pad service timestamps debug datetime msec service timestamps log datetime msec ! hostname murasaki ! boot-start-marker boot-end-marker ! ! aaa new-model ! ! aaa authentication ppp default local aaa authorization network default local ! ! ! ! ! aaa session-id common memory-size iomem 10 ! crypto pki trustpoint TP-self-signed-4045734018 enrollment selfsigned subject-name cn=IOS-Self-Signed-Certificate-4045734018 revocation-check none rsakeypair TP-self-signed-4045734018 ip source-route ! ! ip cef ip inspect name normal_traffic tcp ip inspect name normal_traffic udp ipv6 unicast-routing ipv6 cef ! ! ! object-group network INTERNAL_LAN description All Internal subnets which should be allowed out to the Internet 192.168.1.0 255.255.255.0 192.168.20.0 255.255.255.0 10.10.10.0 255.255.255.0 192.168.40.0 255.255.255.0 192.168.6.0 255.255.255.0 ! ! ! ip ssh time-out 60 ip ssh version 2 ! ! crypto isakmp policy 10 encr aes 256 authentication pre-share group 2 lifetime 28800 crypto isakmp key address ! ! crypto ipsec transform-set AzureIPSec esp-aes 256 esp-sha-hmac ! crypto map AzureCryptoMap 10 ipsec-isakmp set peer set security-association lifetime kilobytes 102400000 set transform-set AzureIPSec match address AzureCloudVMs ! bridge irb ! ! ! ! interface BRI0 no ip address encapsulation hdlc shutdown isdn termination multidrop ! interface ATM0 mtu 1492 no ip address no atm ilmi-keepalive pvc 8/35 encapsulation aal5mux ppp dialer dialer pool-member 1 ! ! interface Vlan1 description Main LAN ip address 192.168.1.97 255.255.255.0 ip nat inside ip virtual-reassembly ! interface Vlan5 description Azure VLAN ip address 192.168.5.97 255.255.255.128 ! interface Dialer1 mtu 1492 ip address negotiated ip access-group PORTS_ALLOWED_IN in ip flow ingress ip nat outside ip inspect normal_traffic out ip virtual-reassembly encapsulation ppp ip tcp adjust-mss 1350 dialer pool 1 dialer-group 1 ipv6 address autoconfig ipv6 enable ppp ipcp route default no cdp enable crypto map AzureCryptoMap ! no ip forward-protocol nd no ip http server no ip http secure-server ! ip nat translation timeout 360 ip nat inside source list SUBNETS_AND_PROTOCOLS_ALLOWED_OUT interface Dialer1 overload ip nat inside source static tcp 192.168.x.x 55663 interface Dialer1 55663 ip nat inside source static tcp 192.168.x.x 22 interface Dialer1 22 ip nat inside source static udp 192.168.x.x 55663 interface Dialer1 55663 ! ip access-list extended AzureCloudVMs permit ip 192.168.1.0 0.0.0.255 192.168.5.0 0.0.0.255 ip access-list extended GUEST_VLAN permit tcp any any eq 22 permit tcp any any eq www permit tcp any any eq 443 permit tcp any any eq domain permit udp any any eq domain permit icmp any any ip access-list extended PORTS_ALLOWED_IN remark List of ports which are allowed IN permit gre any any permit esp any any permit udp any any eq non500-isakmp permit udp any any eq isakmp permit tcp any any eq 55663 permit udp any any eq 55663 permit tcp any any eq 22 permit tcp any any eq 222 permit tcp any any eq 1723 permit tcp any any eq 443 permit icmp any any echo-reply permit icmp any any traceroute permit icmp any any port-unreachable permit icmp any any time-exceeded deny ip any any ip access-list extended SUBNETS_AND_PROTOCOLS_ALLOWED_OUT deny tcp object-group INTERNAL_LAN any eq smtp permit tcp object-group INTERNAL_LAN any permit udp object-group INTERNAL_LAN any permit icmp object-group INTERNAL_LAN any deny ip any any ! no cdp run ipv6 route ::/0 Dialer1 !