Tuesday, February 23, 2010

How to configure IPSec VPN on a cisco router (This terminates only remote Users)

The configurationn below only terminates VPN remote users on a cisco router.

This post is still in progress.... (NOT COMPLETE YET)

crypto isakmp policy 10
encr 3des
authentication pre-share
group 2
crypto isakmp invalid-spi-recovery
!
crypto isakmp client configuration group REMOTEVPNGROUP
key 6 XXXXXXXXX
pool R-VPNpool
acl split-tunnel
crypto isakmp profile REMOTEclient
match identity group REMOTEVPNGROUP
client authentication list REMOTEclient
isakmp authorization list REMOTEclient
client configuration address respond
no keepalive
!
!
crypto ipsec transform-set REMOTE-RM-TS esp-3des esp-md5-hmac
!
crypto dynamic-map REMOTE-map 10
set transform-set REMOTE-RM-TS
set isakmp-profile REMOTEclient
reverse-route
!
!
crypto map REMOTEMAP1 100 ipsec-isakmp dynamic REMOTE-map
!
interface FastEthernet0
description ********
ip address dhcp
ip access-group OutsideTraffic_IN in
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip virtual-reassembly
ip route-cache flow
duplex auto
speed auto
crypto map REMOTEMAP1
!
interface FastEthernet1
no ip address
duplex auto
speed auto
!
ip local pool R-VPNpool 10.10.X.X 10.10.X.X
ip forward-protocol nd
!
ip nat inside source route-map nonat interface FastEthernet0 overload
!
remark no remark NAT ACCESS_LIST
ip access-list extended NAT_Exempt
deny ip 192.168.0.0 0.0.0.255 10.10.20.0 0.0.0.255
permit ip 192.168.0.0 0.0.0.255 any

ip access-list extended OutsideTraffic_IN

ip access-list extended split-tunnel
permit ip 192.168.0.0 0.0.0.255 10.10.20.0 0.0.0.255
!
route-map nonat permit 10
match ip address NAT_Exempt
!