6

I have a C891FW router with IOS 15.4 on which I'm trying to configure a remote access VPN for Android's native VPN client. I'm authenticating with RSA-Sig and XAUTH. The tunnel forms but I can't reach any internal resources, nor can I reach the Internet through the tunnel. Any help with what could be wrong would be much appreciated!

I've removed parts of the config that I deemed irrelevant or sensitive.

!
hostname Skynet
enable secret 5 xxxxx
!
aaa new-model
!
!
aaa authentication login local_auth local
aaa authentication login ClientAuth local
aaa authorization console
aaa authorization exec local_auth local
aaa authorization network local_auth local
aaa authorization network ClientAuth local
!
!
!
aaa session-id common
clock timezone CET 1 0
clock summer-time CET recurring last Sun Mar 2:00 last Sun Oct 3:00
!
crypto pki trustpoint vpn-tp
 usage ike
 revocation-check none
 rsakeypair vpn-tp
!
!
crypto pki certificate chain vpn-tp
 certificate 01
          xxx
quit
 certificate ca 00EC7044BAD01A044F
          xxx
quit
no ip source-route
no ip gratuitous-arps
!
!
!
ip cef
!
!
!
username jimmy privilege 15 secret 5 xxxx
username vpnuser privilege 0 secret 5 xxxx
!
ip ssh time-out 60
ip ssh authentication-retries 2
ip ssh version 2
ip ssh dh min size 4096
!
!
crypto isakmp policy 3
 encr aes
 group 2
crypto isakmp identity dn
!
crypto isakmp client configuration group <group>
 key <secret key>
 dns y.y.y.y
 pool dynpool
 include-local-lan
 netmask 255.255.255.0
crypto isakmp profile IKE-PROFILE
   ca trust-point vpn-tp
   match identity group <group>
   client authentication list ClientAuth
   isakmp authorization list ClientAuth
   client configuration address initiate
   client configuration address respond
   virtual-template 1
!
!
crypto ipsec transform-set ESP-3DES-SHA esp-aes 256 esp-sha-hmac
 mode tunnel
!
crypto ipsec profile IPSEC_PROFILE1
 set transform-set ESP-3DES-SHA
 set isakmp-profile IKE-PROFILE
!
!
interface GigabitEthernet8
 ip address dhcp client-id FastEthernet0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nbar protocol-discovery
 ip nat outside
 ip virtual-reassembly in
 ip verify unicast source reachable-via rx allow-default 100
 duplex auto
 speed auto
 no cdp enable
!
interface Virtual-Template1 type tunnel
 ip unnumbered GigabitEthernet8
 no ip unreachables
 ip nat inside
 ip virtual-reassembly in
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile IPSEC_PROFILE1
!
interface Vlan1
 ip address 10.0.0.1 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat inside
 ip virtual-reassembly in
!
!
ip local pool dynpool 192.168.0.100 192.168.0.101 recycle delay 1
!
!
ip pim bidir-enable
ip nat inside source list NAT2 interface GigabitEthernet8 overload
ip route 0.0.0.0 0.0.0.0 GigabitEthernet8
!
ip access-list standard ANY
 permit any
ip access-list standard Deny_RFC1918
 deny   10.0.0.0 0.255.255.255
 deny   172.16.0.0 0.15.255.255
 deny   192.168.0.0 0.0.255.255
 permit any
!
ip access-list extended NAT2
 deny   ip 10.0.0.0 0.0.0.255 host 192.168.0.100
 deny   ip 10.0.0.0 0.0.0.255 host 192.168.0.101
 permit ip 10.0.0.0 0.0.0.255 any
 permit ip 192.168.0.0 0.0.0.255 any

!
Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Jan 5, 2021 at 2:23

2 Answers 2

Reset to default
1
  1. Create an ACL with VPN IP address pool as source address and destination as any or specific IP address which you want to access.
  2. Bind that ACL to a client configuration group. It will work.

Example:

access-list 108 permit ip X.X.X.X 0.0.0.255 Y.Y.Y.Y 0.0.0.255
crypto isakmp client configuration group <group>
acl 108
Improve this answer
2
  • I realize this is a few years late but I'm still working on this problem every now and then and enabling split tunneling would not help to force the Internet traffic through the tunnel.
    – Jimmy
    Jun 23, 2017 at 17:52
  • did you ever try to configure IKEv2 on the Router for remote access VPN? IKEv2 support seems to be there on any halfway recent IOS, and, as cursory research suggests, Android does support IKEv2 as well.
    – Marc 'netztier' Luethi
    Sep 26, 2018 at 9:40
-1

Go to Google Play and download Cisco Anyconnect Client. This will enable you to connect to IOS 15.4.

http://www.cisco.com/c/en/us/products/collateral/security/anyconnect-secure-mobility-client/data_sheet_c78-527494.html

Improve this answer
2
  • Unfortunately Cisco anyconnect does not seem to support rsa-sig with Xauth nor preshared key with xauth for authentication.
    – Jimmy
    Aug 11, 2015 at 18:11
  • 1
    You'll have to take that up with Cisco. I am unaware of any android client that can do xauth.
    – Ricky
    Aug 31, 2015 at 0:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.