I'm pretty sure I know the answer to this but I don't know how to implement it.
Trying to setup an ipsec vpn from a Cisco 2811 to a linux box running openswan. So far I can get phase 1 up but phase 2 is having an issue. Its 100% a configuration issue.
What I'm trying to do is push web and some other traffic out the vpn using the internet connection on the other end of that as its gateway to the net. I'm getting cryptomap errors. Here's the setup. 220.127.116.11 being the Cisco. The 18.104.22.168 address is the linux server which only has a single nic.
192.168.x.x/24 ----- 22.214.171.124 -- INTERNET 126.96.36.199 ---->>> Internet
I understand why it can't form the phase 2 tunnel, it can't agree on the map. But I have no idea what the map should be in this case.
I've been testing it with just ICMP for now.
I excluded ICMP from NAT :
ip access-list extended NAT deny icmp 192.168.30.0 0.0.0.255 any
Then the "interesting traffic" for the vpn is:
access-list 153 permit icmp 192.168.30.0 0.0.0.255 any
On the openswan side I'm using:
left=188.8.131.52 right=184.108.40.206 rightsubnet=192.168.30.3/24
Well the cisco immediately starts throwing out:
2d11h: map_db_find_best did not find matching map 2d11h: IPSEC(validate_transform_proposal): no IPSEC cryptomap exists for local address 220.127.116.11 2d11h: ISAKMP:(0:26:SW:1): IPSec policy invalidated proposal 2d11h: ISAKMP:(0:26:SW:1): phase 2 SA policy not acceptable! (local 18.104.22.168 remote 22.214.171.124)
I know what I want it to do but I don't know how to set it up. If this were just a simple internal subnet to internal subnet vpn no problem.
Any direction here would be really helpful.
version 12.4 service timestamps debug uptime service timestamps log datetime service password-encryption ! hostname Hex-2811 ! boot-start-marker boot system flash c2800nm-advsecurityk9-mz.124-24.T5.bin boot-end-marker ! no logging buffered aaa new-model ! ! ! aaa session-id common clock timezone EST -5 clock summer-time EDT recurring no ip source-route ! ! ip cef ! ! no ip bootp server ip domain name hexhome.int ip name-server 192.168.30.8 ip auth-proxy max-nodata-conns 3 ip admission max-nodata-conns 3 ! ipv6 unicast-routing crypto isakmp policy 1 encr aes 192 authentication pre-share group 5 lifetime 43200 crypto isakmp key ********** address 126.96.36.199 ! ! crypto ipsec transform-set IOFSET2 esp-aes 192 esp-sha-hmac ! ! crypto map IOFVPN 1 ipsec-isakmp description Isle Of Man set peer 188.8.131.52 set transform-set IOFSET2 match address 153 ! ! ! ! interface FastEthernet0/0 description Internal 192 Network ip address 192.168.30.1 255.255.255.0 no ip proxy-arp ip nat inside ip virtual-reassembly ip route-cache flow duplex full speed 100 ! interface FastEthernet0/1 ip address dhcp ip access-group 112 in no ip redirects no ip unreachables ip accounting access-violations ip nbar protocol-discovery ip nat outside ip virtual-reassembly no ip route-cache cef no ip mroute-cache duplex auto speed auto no cdp enable no mop enabled crypto map IOFVPN ! ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 184.108.40.206 ! ip flow-export source FastEthernet0/0 ip flow-export version 5 ip flow-export destination 192.168.30.45 3001 no ip http server ip http access-class 23 ip http authentication local no ip http secure-server ip http timeout-policy idle 60 life 86400 requests 10000 ip nat inside source route-map POLICY-NAT interface FastEthernet0/1 overload ip access-list extended NAT deny icmp 192.168.30.0 0.0.0.255 any permit ip any any access-list 153 permit icmp 192.168.30.0 0.0.0.255 any route-map POLICY-NAT permit 10 match ip address NAT !
UPDATE: Fixed the ACL: access-list 153 permit ip 192.168.30.0 0.0.0.255 host 220.127.116.11 and the tunnel comes right up and I can ping through as expected.
Trying to get web traffic through now.. Policy routing not working. I added
route-map VPN_WEB permit 1 match ip address 155 set ip next-hop 18.104.22.168 access-list 155 permit tcp any any eq www interface FastEthernet0/1 ip address dhcp ip access-group 112 in no ip redirects no ip unreachables ip accounting access-violations ip nbar protocol-discovery ip nat outside ip virtual-reassembly no ip route-cache cef ip policy route-map VPN_WEB no ip mroute-cache duplex auto speed auto no cdp enable no mop enabled crypto map IOFVPN
I can see the route-map match on www traffic but it's not being passed through the tunnel.