Cico 800 (836) VPN to Internet NAT

take a look at this Cisco doc

Router and VPN Client for Public Internet on a Stick Configuration Example

Hi Merv,

I have come across this doc before, but found others that introduce me to split-tunneling.

I didn't want to use a crypto-map neither to use the Cisco VPN client. I wanted to use the default Windows client in a next-next-finish config maner.

Anyway I tryed to adapt the solution from this doc to my setup. I had tryed a similar one before with the loopback interface for the split tunnel, but the route-map had a set ip next-hop instead of a set interface.

I did some troubleshooting and I found that the packets are being NATed to the internet, reach the target host which sends a reply back to the outside IP address of my router but seems that the reply is not being traslated back to the VPN network. (altough there is an entry for in the 'show ip nat translation' list.

Now I just read in some forum while looking for 'vpdn split tunnel' that I can't use split tunniling with pptp? is this true?

Hide quoted text -

I recall seeing something that said that for PPTP, split tunneling is client controlled (i.e. not controlled central by VPN server).

also ee Cisco PPTP FAQ

Q. I think I have a split tunneling issue. What should I do when a PPTP tunnel comes up on a PC, the PPTP router has a higher metric than the previous default, and I lose connectivity?

A. Run a batch file (batch.bat) to modify the Microsoft routing to resolve this problem. Delete the default and reinstall the default route (you must know the IP address that the PPTP client was assigned, such as 192.168.1.1).

In this example, the network inside the router is 10.13.1.x.

route delete 0.0.0.0 route add 0.0.0.0 mask 0.0.0.0 161.44.17.1 metric 1 route add 10.13.1.0 mask 255.255.255.0 192.168.1.1 metric 1

==============================

HangaS a écrit :

I just found it here is a sample which finds the pptp default route and modify it ECHO OFF IF "%1"=="GETR" GOTO GETR IF "%1"=="RP" GOTO RP

rem route add 192.168.62.0 mask 255.255.255.0 192.168.0.3 REM GOTO FIN :GETR echo ======== GETR for /f "usebackq tokens=1-5" %%I in (`CALL %0 RP`) do ( echo %%I %%J %%K %%L %%M IF %%M EQU 1 ( echo metric = %%M for gateway %%K ROUTE delete 0.0.0.0 mask 0.0.0.0 %%K REM route add 0.0.0.0 mask 0.0.0.0 192.168.0.3 ROUTE add 192.168.62.0 mask 255.255.255.0 %%K ) )

GOTO FIN

:RP echo ======== RP route print | find " 0.0.0.0" GOTO FIN

:FIN

hope it helps

I posted this early in the morning : HangaS a écrit : > Hi Merv, >

Split tunneling can't be set with pptp as it is the responsability of the vpn client to manage access w/wo a policy pushed by the routeur (tunnel end point on branch side) You have to manage static routes on the client side, as with pptp the default gw alwaysdefaults to the pptp address (make a route print on your client) I hab a batch to modify it. I'll try to find quickly and post it here

Hope this helps

Daniel

=3D=3D=3D=3D=3D=3D

Yes Marv, I think that was what I read quouted somewhere, together with some discution on the subject.

But I think it has to do with PPTP itself. Before moving to the 836 I had a similar setup in a Linux box running PopTop (a PPTP acess server) and I didn't had this issue. More, I could define a default gateway for the PPP connection, that I defined to be same default router I use for the internal network. So I think it's some kind of limitation on the IOS on 1) defining a default GW for a PPP connection or 2) The IOS (or my configuration) not being able to properly NAT traffic comming from the tunnel.

Maybe I confused the meanings. I thought that you could also "split the tunnel" in the VPN server, matching the VPN trafic and route it to somewhere else. And that the Loopbakc interface trick was just a way of making the trafic look like it came from the internal network rather then from the tunnel.

I guess I will make some tries with the L2TP/IPSEC tunnel and still using the windows client with minimum configuration by the user.

Hi danniel.

Thxs by the routing rules. I realy wanted to avoid messing with the clients config, as it is a bit cumbersome to make about 50 users change their configs.

I also wanted to avoid using the Cisco VPN client. But if I recalled correcly, I can push the routing configuration from the server to the Cisco client, making the configuration on the client easyer for me and for the users. So this may be a way out for me.

Be prefered scenario would be making the VPN traffic to NAT correctly, I'll will spend some more time on this solution. Unless someone says "I can't be done!"

I confirm the only way to push a policy to the end client is using a vpn client. With a vpn client you can have it launched by openning a session and it can manage split tunnelings and all the policies you have setup.

From my experience using pptp meant:

1- have the user launch the connection in the network panel 2- have him launching a batch to modify routes

I couldn't find a way to launch both operations in a batch (with netsh for example) Deploying the vpn client is rather simple as you can setup an ini file ready to be imported in the Cisco vpn client It can also be used to open a session (to be exhaustive, there might be means to open a session with pptp as well, therefore you could think of launching an open session batch under 2K or XP)

The only 2 ways I know for both types of clients to be launched is either at session openning or by launching it from the network panel.

Hope this helps

Hi Daniel,

Yes I'm starting to share my opinion with you. I built some resistence about using the Cisco client since I was unable to connect to this particular VPN (not controled by me) that required the intgrated firewal to be running, and the Vista version of Cisco VPN client no longer comes with the Integrated Firewall feature.I like the ideia of the .ini file Thanks for you feedback. I think cisco VPN client is becoming the way to go. I will do some tests with it.