I'm pretty sure I know the answer to this but I don't know how to implement it.
Trying to setup an ipsec vpn from a Cisco 2811 to a linux box running openswan. So far I can get phase 1 up but phase 2 is having an issue. Its 100% a configuration issue.
What I'm trying to do is push web and some other traffic out the vpn using the internet connection on the other end of that as its gateway to the net. I'm getting cryptomap errors. Here's the setup. 1.1.1.1 being the Cisco. The 2.2.2.2 address is the linux server which only has a single nic.
192.168.x.x/24 ----- 1.1.1.1 -- INTERNET 2.2.2.2 ---->>> Internet
I understand why it can't form the phase 2 tunnel, it can't agree on the map. But I have no idea what the map should be in this case.
I've been testing it with just ICMP for now.
I excluded ICMP from NAT :
ip access-list extended NAT
deny icmp 192.168.30.0 0.0.0.255 any
Then the "interesting traffic" for the vpn is:
access-list 153 permit icmp 192.168.30.0 0.0.0.255 any
On the openswan side I'm using:
left=2.2.2.2
right=1.1.1.1
rightsubnet=192.168.30.3/24
Well the cisco immediately starts throwing out:
2d11h: map_db_find_best did not find matching map
2d11h: IPSEC(validate_transform_proposal): no IPSEC cryptomap exists for local address 1.1.1.1
2d11h: ISAKMP:(0:26:SW:1): IPSec policy invalidated proposal
2d11h: ISAKMP:(0:26:SW:1): phase 2 SA policy not acceptable! (local 1.1.1.1 remote 2.2.2.2)
I know what I want it to do but I don't know how to set it up. If this were just a simple internal subnet to internal subnet vpn no problem.
Any direction here would be really helpful.
Router config:
version 12.4
service timestamps debug uptime
service timestamps log datetime
service password-encryption
!
hostname Hex-2811
!
boot-start-marker
boot system flash c2800nm-advsecurityk9-mz.124-24.T5.bin
boot-end-marker
!
no logging buffered
aaa new-model
!
!
!
aaa session-id common
clock timezone EST -5
clock summer-time EDT recurring
no ip source-route
!
!
ip cef
!
!
no ip bootp server
ip domain name hexhome.int
ip name-server 192.168.30.8
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
!
ipv6 unicast-routing
crypto isakmp policy 1
encr aes 192
authentication pre-share
group 5
lifetime 43200
crypto isakmp key ********** address 2.2.2.2
!
!
crypto ipsec transform-set IOFSET2 esp-aes 192 esp-sha-hmac
!
!
crypto map IOFVPN 1 ipsec-isakmp
description Isle Of Man
set peer 2.2.2.2
set transform-set IOFSET2
match address 153
!
!
!
!
interface FastEthernet0/0
description Internal 192 Network
ip address 192.168.30.1 255.255.255.0
no ip proxy-arp
ip nat inside
ip virtual-reassembly
ip route-cache flow
duplex full
speed 100
!
interface FastEthernet0/1
ip address dhcp
ip access-group 112 in
no ip redirects
no ip unreachables
ip accounting access-violations
ip nbar protocol-discovery
ip nat outside
ip virtual-reassembly
no ip route-cache cef
no ip mroute-cache
duplex auto
speed auto
no cdp enable
no mop enabled
crypto map IOFVPN
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 174.59.28.1
!
ip flow-export source FastEthernet0/0
ip flow-export version 5
ip flow-export destination 192.168.30.45 3001
no ip http server
ip http access-class 23
ip http authentication local
no ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source route-map POLICY-NAT interface FastEthernet0/1 overload
ip access-list extended NAT
deny icmp 192.168.30.0 0.0.0.255 any
permit ip any any
access-list 153 permit icmp 192.168.30.0 0.0.0.255 any
route-map POLICY-NAT permit 10
match ip address NAT
!
UPDATE: Fixed the ACL: access-list 153 permit ip 192.168.30.0 0.0.0.255 host 2.2.2.2 and the tunnel comes right up and I can ping through as expected.
Trying to get web traffic through now.. Policy routing not working. I added
route-map VPN_WEB permit 1
match ip address 155
set ip next-hop 2.2.2.2
access-list 155 permit tcp any any eq www
interface FastEthernet0/1
ip address dhcp
ip access-group 112 in
no ip redirects
no ip unreachables
ip accounting access-violations
ip nbar protocol-discovery
ip nat outside
ip virtual-reassembly
no ip route-cache cef
ip policy route-map VPN_WEB
no ip mroute-cache
duplex auto
speed auto
no cdp enable
no mop enabled
crypto map IOFVPN
I can see the route-map match on www traffic but it's not being passed through the tunnel.
