0

I am trying to connect a Cisco IOS router to Azure via the IPSec VPN. I have used the Cisco ISR template to establish a tunnel from my router to Azure. In the Azure control panel, I can see that the connection is established. However, while "Data Out" seems to be working, the "Data In" shows zero, and I can't SSH, RDP or nslookup to or from my local network to Azure in either direction.

As the tunnel is established, I'm sure the problem is on my router. I'm not really a networking guy (sole IT guy for a small business), so any help would be appreciated.

Here's some output from my router:

murasaki#sh crypto session
Crypto session current status

Interface: Virtual-Access2
Session status: DOWN
Peer: x.x.x.x port 500
  IPSEC FLOW: permit ip 192.168.1.0/255.255.255.0 192.168.5.0/255.255.255.0
        Active SAs: 0, origin: crypto map

Interface: Dialer1
Session status: UP-ACTIVE
Peer: x.x.x.x port 500
  IKE SA: local x.x.x.x/500 remote x.x.x.x/500 Active
  IPSEC FLOW: permit ip 192.168.1.0/255.255.255.0 192.168.5.0/255.255.255.0
        Active SAs: 2, origin: crypto map

murasaki#sho crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
x.x.x.x        x.x.x.x        QM_IDLE           2002 ACTIVE

IPv6 Crypto ISAKMP SA

Here's the config of the router with the sensitive bits removed / scrubbed:

!
version 15.0
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
!
hostname murasaki
!
boot-start-marker
boot-end-marker
!
!
aaa new-model
!
!
aaa authentication ppp default local
aaa authorization network default local 
!
!
!
!
!
aaa session-id common
memory-size iomem 10
!
crypto pki trustpoint TP-self-signed-4045734018
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-4045734018
revocation-check none
rsakeypair TP-self-signed-4045734018
ip source-route
!
!
ip cef
ip inspect name normal_traffic tcp
ip inspect name normal_traffic udp
ipv6 unicast-routing
ipv6 cef
!
!
!
object-group network INTERNAL_LAN 
description All Internal subnets which should be allowed out to the Internet
192.168.1.0 255.255.255.0
192.168.20.0 255.255.255.0
10.10.10.0 255.255.255.0
192.168.40.0 255.255.255.0
192.168.6.0 255.255.255.0
!
!
!
ip ssh time-out 60
ip ssh version 2
! 
!
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 2
lifetime 28800
crypto isakmp key  address 
!
!
crypto ipsec transform-set AzureIPSec esp-aes 256 esp-sha-hmac 
!
crypto map AzureCryptoMap 10 ipsec-isakmp 
set peer 
set security-association lifetime kilobytes 102400000
set transform-set AzureIPSec 
match address AzureCloudVMs
!
bridge irb
!
!
!
!
interface BRI0
no ip address
encapsulation hdlc
shutdown
isdn termination multidrop
!
interface ATM0
mtu 1492
no ip address
no atm ilmi-keepalive
pvc 8/35 
encapsulation aal5mux ppp dialer
dialer pool-member 1
!
!
interface Vlan1
description Main LAN
ip address 192.168.1.97 255.255.255.0
ip nat inside
ip virtual-reassembly
!
interface Vlan5
description Azure VLAN
ip address 192.168.5.97 255.255.255.128
!
interface Dialer1
mtu 1492
ip address negotiated
ip access-group PORTS_ALLOWED_IN in
ip flow ingress
ip nat outside
ip inspect normal_traffic out
ip virtual-reassembly
encapsulation ppp
ip tcp adjust-mss 1350
dialer pool 1
dialer-group 1
ipv6 address autoconfig
ipv6 enable
ppp ipcp route default
no cdp enable
crypto map AzureCryptoMap
!
no ip forward-protocol nd
no ip http server
no ip http secure-server
!
ip nat translation timeout 360
ip nat inside source list SUBNETS_AND_PROTOCOLS_ALLOWED_OUT interface Dialer1 overload
ip nat inside source static tcp 192.168.x.x 55663 interface Dialer1 55663
ip nat inside source static tcp 192.168.x.x 22 interface Dialer1 22
ip nat inside source static udp 192.168.x.x 55663 interface Dialer1 55663
!
ip access-list extended AzureCloudVMs
permit ip 192.168.1.0 0.0.0.255 192.168.5.0 0.0.0.255
ip access-list extended GUEST_VLAN
permit tcp any any eq 22
permit tcp any any eq www
permit tcp any any eq 443
permit tcp any any eq domain
permit udp any any eq domain
permit icmp any any
ip access-list extended PORTS_ALLOWED_IN

remark List of ports which are allowed IN

permit gre any any
permit esp any any
permit udp any any eq non500-isakmp
permit udp any any eq isakmp
permit tcp any any eq 55663
permit udp any any eq 55663
permit tcp any any eq 22
permit tcp any any eq 222
permit tcp any any eq 1723
permit tcp any any eq 443
permit icmp any any echo-reply
permit icmp any any traceroute
permit icmp any any port-unreachable
permit icmp any any time-exceeded
deny ip any any
ip access-list extended SUBNETS_AND_PROTOCOLS_ALLOWED_OUT
deny tcp object-group INTERNAL_LAN any eq smtp
permit tcp object-group INTERNAL_LAN any
permit udp object-group INTERNAL_LAN any
permit icmp object-group INTERNAL_LAN any
deny ip any any
!
no cdp run

ipv6 route ::/0 Dialer1
!
4
  • Shouldn't the Virtual-Access2 interface have UP status? Otherwise the rule permitting traffic between the two 192.168 subnets wouldn't seem to be in effect.
    – Noah Stahl
    May 29, 2013 at 1:01
  • Yes, I would have thought so. But this isn't an interface I have defined, so I can't go into the config and do a 'no shut'.
    – Timothy
    May 29, 2013 at 1:57
  • What I'm thinking is that doesn't mean it is configured to be down, but rather that your session isn't actually getting established. What does the Azure side report?
    – Noah Stahl
    May 29, 2013 at 3:16
  • Hmm, Azure says it's up though: postimg.org/image/5hj20a7m9 And the router says an IPsec and ISAKMP SA has been established. But I still can't RDP or SSH to or from anything using the Azure addresses (the 192.168.5.x range).
    – Timothy
    May 29, 2013 at 5:14

1 Answer 1

0

Turns out I just needed to remove the VLAN 5 and IP address from the Cisco router!

2
  • Interesting. Which part of the config did you remove?
    – Noah Stahl
    May 29, 2013 at 12:02
  • He had a local interface (vlan 5) with an IP space overlapping with its Azure subnet, so the router was trying to locally route that traffic instead of sending that into the tunnel. Also a reverse route check would've dropped that traffic when coming from Azure. Feb 20, 2015 at 0:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .