Hi,
I'm new to CISCO and have read up a lot on forums and tutorials with regards to setting up a new CISCO 1941 router.
However, I have two issues that are still unresolved:
1) Hairpinning (allowing our mail server 192.168.1.200 to be accessed while clinets are on the internal network 192.168.1.0 using its domain name pop.company.com). Access to pop.company.com works when clients are NOT on the company's network and MX record with public DNS resolves pop.company.com to IP1.IP1.IP1.IP1.
2) Routing VPN internet traffic through gateway GW1.GW1.GW1.GW1 when clients are connected via VPN to the router. Clients connected via VPN can access LAN services, e.g. printer, file servers, etc, however cannot access the internet via GW1.GW1.GW1.GW1.
Any help would be much appreciated!!
There are the network parameters:
Name server 1: NS1.NS1.NS1.NS1
Name server 2: NS2.NS2.NS2.NS2
Public IP address: IP1.IP1.IP1.IP1
Public IP address subnet: SN1.SN1.SN1.SN1
Public IP address gateway: GW1.GW1.GW1.GW1
Router LAN Address: 192.168.1.1
Mail server LAN Address: 192.168.1.200
Internal LAN: 192.168.1.0/24
VPN LAN: 192.168.2.100 to 192.168.2.200
Below is my config:
aaa authentication login default local
aaa authentication login VPNCompany local
aaa authorization exec default local
aaa authorization network CompanyVPN local
!
ip dhcp excluded-address 192.168.1.1
!
ip dhcp pool CompanyLAN-Pool
network 192.168.1.0 255.255.255.0
dns-server NS1.NS1.NS1.NS1 NS2.NS2.NS2.NS2
default-router 192.168.1.1
!
ip domain name Company.local
ip name-server NS1.NS1.NS1.NS1
ip name-server NS2.NS2.NS2.NS2
ip cef
no ipv6 cef
!
ip ssh version 2
!
crypto isakmp policy 1
encr aes
authentication pre-share
group 2
!
crypto isakmp client configuration group CompanyVPN
key Compnay
dns NS1.NS1.NS1.NS1
domain Company.local
pool VPNPool
max-users 10
netmask 255.255.255.0
crypto isakmp profile ISAKMPPROFILE
match identity group CompanyVPN
client authentication list VPNCompany
isakmp authorization list CompanyVPN
client configuration address respond
virtual-template 1
!
crypto ipsec transform-set TRANSFORMSET esp-aes esp-sha-hmac
mode tunnel
!
crypto ipsec profile CompanyVPN
set transform-set TRANSFORMSET
set isakmp-profile ISAKMPPROFILE
!
interface Embedded-Service-Engine0/0
no ip address
shutdown
!
interface GigabitEthernet0/0
description Main Router
ip address 192.168.1.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
!
interface GigabitEthernet0/1
description PrimaryWANDesc_PrimaryWAN
ip address IP1.IP1.IP1.IP1 SN1.SN1.SN1.SN1
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
!
interface Virtual-Template1 type tunnel
ip unnumbered GigabitEthernet0/0
tunnel mode ipsec ipv4
tunnel protection ipsec profile FabAccVPN
!
ip local pool VPNPool 192.168.2.100 192.168.2.200
ip forward-protocol nd
!
ip http server
ip http authentication local
ip http secure-server
!
ip nat inside source list 1 interface GigabitEthernet0/1 overload
ip nat inside source static tcp 192.168.1.200 465 interface GigabitEthernet0/1 465
ip nat inside source static tcp 192.168.1.200 995 interface GigabitEthernet0/1 995
ip nat inside source static tcp 192.168.1.200 25 interface GigabitEthernet0/1 25
ip nat inside source static tcp 192.168.1.200 993 interface GigabitEthernet0/1 993
ip route 0.0.0.0 0.0.0.0 GW1.GW1.GW1.GW1
!
access-list 1 permit any
!
control-plane
!
line con 0
line aux 0
line 2
no activation-character
no exec
transport preferred none
transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
stopbits 1
line vty 0 4
transport input ssh
!
end
