1

I am ultimately trying to set up a PPTP VPN server inside my firewall, but to verify that the router will be configured correctly first, I am trying to pass SSH through the Cisco 881 to the SSH server (10.10.100.20). It seems like my configuration should be right, but I cannot SSH from my VPS at Linode back into my network.

I ruled out the modem, as I place my laptop at our static IP, and was able to SSH to it from my Linode. As soon as the router is in the way, I can't SSH in.

Here is my configuration

!
! Last configuration change at 08:51:36 PCTime Wed Sep 22 2010 by admin
!
version 15.0
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname router
!
boot-start-marker
boot-end-marker
!
security authentication failure rate 3 log
security passwords min-length 6
no logging buffered
no logging console
enable secret 5 
!
no aaa new-model
memory-size iomem 10
clock timezone PCTime -5
clock summer-time PCTime date Apr 6 2003 2:00 Oct 26 2003 2:00
!
crypto pki trustpoint TP-self-signed-1169761916
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-1169761916
 revocation-check none
 rsakeypair TP-self-signed-1169761916
!
!
crypto pki certificate chain TP-self-signed-1169761916
 certificate self-signed 01

    quit
no ip source-route
!
!
ip dhcp excluded-address 10.0.0.1
ip dhcp excluded-address 10.100.0.1 10.100.10.0
ip dhcp excluded-address 10.100.10.255 10.100.255.254
ip dhcp excluded-address 10.10.100.1 10.10.100.40
ip dhcp excluded-address 10.10.100.150 10.10.100.250
!
ip dhcp pool ccp-pool1
   import all
   network 10.10.10.0 255.255.255.0
   dns-server #DNS# #DNS# 
   default-router 10.10.10.1 
!
ip dhcp pool gpool
   import all
   network 10.100.10.0 255.255.255.0
   dns-server #DNS# #DNS# 
   default-router 10.100.10.1 
!
ip dhcp pool wpool
   import all
   network 10.10.100.0 255.255.255.0
   dns-server #DNS# #DNS#
   default-router 10.10.100.1 
!
ip dhcp pool wgroup
   origin file wgroup.txt
!
!
ip cef
no ip bootp server
no ip domain lookup
ip domain name viridianspark.com
ip name-server #DNS#
ip name-server #DNS#
no ipv6 cef
!
!
license udi pid CISCO881W-GN-A-K9 sn FTX143081B2
license agent notify http://192.168.56.1:9710/clm/servlet/HttpListenServlet dummy dummy 2.0
!
!
username admin privilege 15 secret 5 
!
!
ip tcp synwait-time 10
ip ssh time-out 60
ip ssh authentication-retries 2
!
class-map type inspect match-any ccp-cls-insp-traffic
 match protocol cuseeme
 match protocol dns
 match protocol ftp
 match protocol h323
 match protocol https
 match protocol icmp
 match protocol imap
 match protocol pop3
 match protocol netshow
 match protocol shell
 match protocol realmedia
 match protocol rtsp
 match protocol smtp
 match protocol sql-net
 match protocol streamworks
 match protocol tftp
 match protocol vdolive
 match protocol tcp
 match protocol udp
class-map type inspect match-all ccp-insp-traffic
 match class-map ccp-cls-insp-traffic
class-map type inspect match-any ccp-cls-icmp-access
 match protocol icmp
 match protocol tcp
 match protocol udp
class-map type inspect match-all ccp-invalid-src
 match access-group 100
class-map type inspect match-all ccp-icmp-access
 match class-map ccp-cls-icmp-access
class-map type inspect match-all ccp-protocol-http
 match protocol http
!
!
policy-map type inspect ccp-permit-icmpreply
 class type inspect ccp-icmp-access
  inspect 
 class class-default
  pass
policy-map type inspect ccp-inspect
 class type inspect ccp-invalid-src
  drop log
 class type inspect ccp-protocol-http
  inspect 
 class type inspect ccp-insp-traffic
  inspect 
 class class-default
  drop
policy-map type inspect ccp-permit
 class class-default
  drop
!
zone security out-zone
zone security in-zone
zone-pair security ccp-zp-self-out source self destination out-zone
 service-policy type inspect ccp-permit-icmpreply
zone-pair security ccp-zp-in-out source in-zone destination out-zone
 service-policy type inspect ccp-inspect
zone-pair security ccp-zp-out-self source out-zone destination self
 service-policy type inspect ccp-permit
! 
!
!
!
!
!
!
interface FastEthernet0
 switchport access vlan 2
!
interface FastEthernet1
 switchport access vlan 2
!
interface FastEthernet2
 switchport access vlan 2
!
interface FastEthernet3
 switchport access vlan 2
!
interface FastEthernet4
 description $ES_WAN$$FW_OUTSIDE$$ETH-WAN$
 ip address #EXTERNAL_IP# 255.255.255.252
 ip access-group VPN in
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat outside
 ip virtual-reassembly
 zone-member security out-zone
 duplex auto
 speed auto
!
interface wlan-ap0
 description Service module interface to manage the embedded AP
 ip unnumbered Vlan1
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip flow ingress
 arp timeout 0
!
interface Wlan-GigabitEthernet0
 description Internal switch interface connecting to the embedded AP
 switchport mode trunk
!
interface Vlan1
 description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$ES_LAN$$FW_INSIDE$
 ip address 10.10.10.1 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip flow ingress
 ip nat inside
 ip virtual-reassembly
 zone-member security in-zone
 ip tcp adjust-mss 1452
!
interface Vlan2
 ip address 10.10.100.1 255.255.255.0
 ip access-group 102 in
 ip helper-address 10.10.100.104
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip flow ingress
 ip nat inside
 ip virtual-reassembly
 zone-member security in-zone
!
interface Vlan3
 ip address 10.100.10.1 255.255.255.0
 ip access-group 101 in
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip flow ingress
 ip nat inside
 ip virtual-reassembly
 zone-member security in-zone
!
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip nat inside source list 2 interface FastEthernet4 overload
ip nat inside source list 3 interface FastEthernet4 overload
ip nat inside source list 4 interface FastEthernet4 overload
ip nat inside source static tcp 10.10.100.20 22 #EXTERNAL_IP# 22 extendable
ip route 0.0.0.0 0.0.0.0 #EXTERNAL_GATEWAY#
!
ip access-list extended VPN
 permit gre any host 10.10.100.20
 permit tcp any host 10.10.100.20 eq 22
 permit ip 10.0.0.0 0.255.255.255 any
 permit ip any any
 permit icmp any any
ip access-list extended vpn
 permit ip 10.0.0.0 0.255.255.255 any
!
logging trap debugging
logging 10.10.100.22
access-list 1 remark INSIDE_IF=Vlan1
access-list 1 remark CCP_ACL Category=2
access-list 1 permit 10.10.10.0 0.0.0.255
access-list 2 remark CCP_ACL Category=2
access-list 2 permit 10.10.10.0 0.0.0.255
access-list 3 remark CCP_ACL Category=2
access-list 3 permit 10.10.100.0 0.0.0.255
access-list 4 remark CCP_ACL Category=2
access-list 4 permit 10.100.10.0 0.0.0.255
access-list 101 permit ip 10.100.10.0 0.0.0.255 10.100.10.0 0.0.0.255
access-list 101 deny   icmp 10.100.10.0 0.0.0.255 10.10.100.0 0.0.0.255
access-list 101 deny   ip 10.100.10.0 0.0.0.255 10.10.100.0 0.0.0.255
access-list 101 permit ip 10.100.10.0 0.0.0.255 any
access-list 101 permit udp any any eq bootpc
access-list 101 permit udp any any eq bootps
access-list 102 permit ip 10.10.100.0 0.0.0.255 10.10.100.0 0.0.0.255
access-list 102 permit ip 10.10.100.0 0.0.0.255 any
access-list 102 permit udp any any eq bootpc
access-list 102 permit udp any any eq bootps
no cdp run

!
!
!
!
!
control-plane
!
banner exec ^CCC
Welcome to the jungle.

^C
banner login ^CCCIf a router goes down and no one is around to browse the internet, did it drop any packets
^C        
!
line con 0
 login local
 no modem enable
 transport output telnet
line aux 0
 login local
 transport output telnet
line 2
 no activation-character
 no exec
 transport preferred none
 transport input all
line vty 0 4
 privilege level 15
 login local
 transport input telnet ssh
!
scheduler max-task-time 5000
scheduler allocate 4000 1000
scheduler interval 500
end

3 Answers 3

1

It doesn't look like you have a security zone setup for the 'out' to 'in' traffic. You may need something like this:

!
class-map type inspect match-any ccp-ssh
 match protocol ssh
!
policy-map type inspect ccp-permit-ssh
 class type inspect ccp-ssh
  inspect
!
zone-pair security ccp-zp-out-in source out-zone destination in-zone
 service-policy type inspect ccp-permit-ssh
1
  • That fixed it. I had no idea how the zones worked. I have more to read up on, thanks! Sep 28, 2010 at 17:59
1

Try to forward from a different external port (2222 for example) to port 22 on the local IP. You currently have SSH turned on for the Cisco so that would cause some problems.

3
  • I still get a timeout when trying to SSH back in from outside even when using a different port and forwarding it to 22 on the server Sep 27, 2010 at 12:51
  • I'm not 100% sure of your network from just reading your config. But it looks like Access-List 102 might be denying you. You might want to check into that.
    – Tim
    Sep 28, 2010 at 0:05
  • I tried adding VLAN2 to access-group VPN in, and removed 102, and still no dice Sep 28, 2010 at 14:01
1

Couple Troubleshooting steps:

I would take off all of the ACLs (remove ip access group statements) to make sure. Your NAT statements do look right to me, but make sure you can see them with show ip nat translations.

Also, keep in mind ACLs happen pre-nat according to the NAT order of operations so you would need your ssh rule on the External interface to be for the public IP.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .