Thanks for the reply
Unfortunately I a GUI handicapped - so I do need help putting down the access policy for the GRE interface since this isn't easily implemented through the GUI.
Here is the config as requested (Homebase - central location):
! ADTRAN, Inc. OS version R10.6.0.E
! Boot ROM version 17.06.01.00
! Platform: NetVanta 3430, part number 1202820G1
!
!
hostname "Homebase"
enable password Password
!
clock timezone -5-Eastern-Time
!
ip subnet-zero
ip classless
ip routing
ipv6 unicast-routing
!
!
domain-name "Homebase.contoso.com"
domain-proxy
name-server 75.75.75.75 75.75.76.76
!
!
no auto-config
!
event-history on
no logging forwarding
logging forwarding priority-level info
no logging email
!
no service password-encryption
!
username "admin" password "Password"
!
banner motd #
****** Important Banner Message ******
Enable and Telnet passwords are configured to "password".
HTTP and HTTPS default username is "admin" and password is "password".
Please change them immediately.
The ethernet 0/1 interface is enabled with an address of 10.10.10.1
Telnet, HTTP, and HTTPS access are also enabled.
To remove this message, while in configuration mode type "no banner motd".
****** Important Banner Message ******
#
!
ip firewall
no ip firewall alg msn
no ip firewall alg mszone
no ip firewall alg h323
!
no dot11ap access-point-control
!
ip crypto
!
crypto ike policy 101
initiate main
respond anymode
local-id address 1.2.3.177
peer 2.3.4.106
attribute 1
encryption 3des
hash md5
authentication pre-share
!
crypto ike remote-id address 2.3.4.106 preshared-key keyonetwothree ike-policy 101 crypto map VPN 20 no-mode-config no-xauth
!
crypto ipsec transform-set esp-3des-esp-md5-hmac esp-3des esp-md5-hmac
mode tunnel
!
crypto map VPN 20 ipsec-ike
description Eastside
match address VPN-20-vpn-selectors
set peer 2.3.4.106
set transform-set esp-3des-esp-md5-hmac
reverse-route
ike-policy 101
!
no ethernet cfm
!
interface eth 0/1
description Inside
ip address 172.16.1.254 255.255.255.0
ip access-policy Private
no shutdown
!
!
interface eth 0/2
description Internet
ip address 1.2.3.177 255.255.255.252
ip mtu 1500
ip access-policy Public
crypto map VPN
no rtp quality-monitoring
no shutdown
!
interface tunnel 1 gre ip
description HFTunnel
ip address 172.16.0.1 255.255.255.252
ip mtu 1400
ip access-policy Private
tunnel source 1.2.3.177
tunnel destination 3.6.9.165
tunnel key 12345678
keepalive
no shutdown
!
ip access-list standard wizard-ics
remark Internet Connection Sharing
permit any
!
ip access-list extended self
remark Traffic to NetVanta
permit ip any any log
!
ip access-list extended VPN-20-vpn-selectors
permit ip 172.16.1.0 0.0.0.255 172.16.2.0 0.0.0.255
!
ip access-list extended web-acl-10
remark RDP33891
permit tcp any host 172.16.1.254 eq 33891 log
!
ip access-list extended web-acl-11
remark RDP33892
permit tcp any host 1.2.3.177 eq 33892 log
!
ip access-list extended web-acl-13
remark PPTPVPN
permit gre any host 1.2.3.177 log
permit tcp any host 1.2.3.177 eq 1723 log
!
ip access-list extended web-acl-7
remark RDP33894
permit tcp any host 1.2.3.177 eq 33894 log
!
ip access-list extended web-acl-8
remark RDP33893
permit tcp any host 1.2.3.177 eq 33893 log
!
ip access-list extended wizard-remote-access
remark do not hand edit this ACL
permit icmp any any echo log
permit tcp any any eq https log
!
ip policy-class Private
allow list VPN-20-vpn-selectors stateless
allow list self self
nat source list wizard-ics interface eth 0/2 overload
!
ip policy-class Public
allow reverse list VPN-20-vpn-selectors stateless
allow list wizard-remote-access self
nat destination list web-acl-7 address 172.16.1.4 port 3389
nat destination list web-acl-8 address 172.16.1.3 port 3389
nat destination list web-acl-10 address 172.16.1.1 port 3389
nat destination list web-acl-11 address 172.16.1.2 port 3389
nat destination list web-acl-13 address 172.16.1.4
!
ip route 0.0.0.0 0.0.0.0 1.2.3.178
ip route 172.16.3.0 255.255.255.0 172.16.1.30
ip route 172.16.4.0 255.255.255.0 172.16.0.2
!
no tftp server
no tftp server overwrite
http server
http secure-server
no snmp agent
no ip ftp server
ip ftp server default-filesystem flash
no ip scp server
no ip sntp server
!
ip sip udp 5060
ip sip tcp 5060
!
line con 0
login
password Password
!
line telnet 0 4
login
password Password
no shutdown
line ssh 0 4
login local-userlist
no shutdown
!
sntp server us.pool.ntp.org version 3
!
ntp source ethernet 0/2
!
end
Again what I need to do is get subnets 172.16.1.x connected/routing to 172.16.3.x (172.16.2.x works via the VPN put in place by the wizard).
Thanks,
Paul
