Trying to get the VPN tunnel to Azure working on a Cisco ISR 1941 but have been unable to get any traffic flowing back from Azure to site.
The tunnel looks to be up and a machine in Azure is receiving the pings but the local machine doesn't receive the response. I assume I've mucked up the config and am hoping someone much much more competent than I am with Cisco routers can point it out to me.
Thanks in advance!
The subnets are as follows:
Azure Config: 192.168.200.0/24 <=> 192.168.30.0/22
Site 1: Subnet 1 192.168.1.0/24 Subnet 2 192.168.31.0/24
Site 2: Subnet 1 192.168.2.0/24 Subnet 2 192.168.32.0/24
Site 3: Subnet 1 192.168.3.0/24 Subnet 2 192.168.33.0/24
At each site, Subnet 1 is the existing subnet for workstations and Subnet 2 is the new subnet I have introduced for machines that talk only to Azure.
My config is as follows:
wfhwatgw#show running-config
Building configuration...
Current configuration : 7016 bytes
!
version 15.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname wfhwatgw
!
boot-start-marker
boot-end-marker
!
!
logging buffered 51200 warnings
!
no aaa new-model
!
!
!
!
!
!
!
!
!
!
!
ip dhcp excluded-address 192.168.1.1
!
ip dhcp pool Default
import all
network 192.168.1.0 255.255.255.128
dns-server 192.168.1.10
default-router 192.168.1.1
!
!
!
ip domain name wfh.local
ip name-server 203.8.183.1
ip name-server 192.189.54.33
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
cts logging verbose
!
crypto pki trustpoint TP-self-signed-930478159
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-930478159
revocation-check none
rsakeypair TP-self-signed-930478159
!
!
crypto pki certificate chain TP-self-signed-930478159
certificate self-signed 01
30820229 30820192 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
30312E30 2C060355 04031325 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 39333034 37383135 39301E17 0D313531 30323230 31303631
335A170D 32303031 30313030 30303030 5A303031 2E302C06 03550403 1325494F
532D5365 6C662D53 69676E65 642D4365 72746966 69636174 652D3933 30343738
31353930 819F300D 06092A86 4886F70D 01010105 0003818D 00308189 02818100
AA09432E 1CD882EA 4ACE6CA2 FB2D65D9 A779E861 C8D6E462 3A6DA653 DB587703
A08486C2 C9C0E517 CA948D80 3626CB63 E15C46DA BAD47A07 21BCEDCC CF13D682
09AA1CA8 33028713 CE4E0A46 79F4797E 96CADDA7 A41AC4A9 24851926 5707C8A5
239794E0 2D92AF07 CEDFA3C7 6D9B2B53 923F1ACE 3DF6636A 8F3A454A 07B5A8FB
02030100 01A35330 51300F06 03551D13 0101FF04 05300301 01FF301F 0603551D
23041830 168014AE 9E16B1D8 6B4B306E E7139775 D2CFD1D2 B235D130 1D060355
1D0E0416 0414AE9E 16B1D86B 4B306EE7 139775D2 CFD1D2B2 35D1300D 06092A86
4886F70D 01010505 00038181 007EF058 8D7DD324 75F3DFCF 81A00AF7 846298E1
17264021 83EF919A 2F80FB22 2AC0F570 A3683687 BB0E10AD 2F9E3035 13D6E497
241AF42A 71E2158C 3A72182B F2610CBB B13529B4 015EC062 E47C9452 7FBD76A7
F037D93C 3A1F803D 4FA093ED 03EA9CEF 75E8372E 0672F5D8 D6829951 E37786A1
E121F71B C7D24A84 9597B4FD CD
quit
license udi pid CISCO1941/K9 sn xxxxxx
license boot module c1900 technology-package securityk9
!
!
username admin privilege 15 secret 5 $1$EKdt$JnArUet2M7sgxD5gtABPJ/
!
redundancy
!
crypto ikev2 proposal Azure-Proposal
encryption aes-cbc-256 aes-cbc-128 3des
integrity sha1
group 2
!
crypto ikev2 policy Azure-Policy
proposal Azure-Proposal
!
crypto ikev2 keyring Azure-Keyring
peer xxx.xxx.xxx.xxx
address xxx.xxx.xxx.xxx
pre-shared-key xxxxxx
!
!
!
crypto ikev2 profile Azure-Profile
match address local interface Dialer1
match identity remote address xxx.xxx.xxx.xxx 255.255.255.255
authentication remote pre-share
authentication local pre-share
keyring local Azure-Keyring
!
!
!
!
!
!
crypto ipsec transform-set Azure-IPSec-Proposal-Set esp-aes 256 esp-sha-hmac
mode tunnel
!
!
crypto ipsec profile vti
set transform-set Azure-IPSec-Proposal-Set
set ikev2-profile Azure-Profile
!
!
!
!
!
!
interface Tunnel1
ip address 169.254.0.1 255.255.255.0
ip tcp adjust-mss 1350
tunnel source Dialer1
tunnel mode ipsec ipv4
tunnel destination xxx.xxx.xxx.xxx
tunnel protection ipsec profile vti
!
interface Embedded-Service-Engine0/0
no ip address
shutdown
!
interface GigabitEthernet0/0
description ETH-SW-LAUNCH$INTF-INFO-GE 0/0$ETH-LAN$
ip address 192.168.31.254 255.255.255.0 secondary
ip address 192.168.1.1 255.255.255.0 secondary
ip address 192.168.1.254 255.255.255.0
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
!
interface GigabitEthernet0/1
description WAN Connection
no ip address
duplex auto
speed auto
pppoe enable group global
pppoe-client dial-pool-number 1
!
interface Dialer1
mtu 1350
ip address negotiated
ip nat outside
ip virtual-reassembly in
encapsulation ppp
ip tcp adjust-mss 1310
dialer pool 1
ppp chap hostname [email protected]
ppp chap password 0 xxxxx
ppp pap sent-username [email protected] password 0 xxxxx
!
ip forward-protocol nd
!
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip nat inside source list DSL_ACCESSLIST interface Dialer1 overload
ip route 0.0.0.0 0.0.0.0 Dialer1
ip route 192.168.200.0 255.255.252.0 Tunnel1
ip route 192.168.200.0 255.255.255.0 Tunnel1
!
ip access-list extended DSL_ACCESSLIST
permit ip 192.168.1.0 0.0.0.255 any
permit ip 192.168.31.0 0.0.0.255 any
!
dialer-list 1 protocol ip permit
dialer-list 2 protocol ip permit
dialer-list 3 protocol ip permit
!
!
access-list 101 permit ip 192.168.31.0 0.0.0.255 192.168.200.0 0.0.3.255
!
control-plane
!
!
banner exec ^C
