Cisco Systems OL-6426-02 manual Ip nat outside no cdp enable

Chapter 7 Configuring VPNs Using an IPSec Tunnel and Generic Routing Encapsulation

Configuration Example

BETA DRAFT - CISCO CONFIDENTIAL

ip address 10.1.1.1 255.255.255.0 ip nat inside

ip inspect firewall in ! inspection examines outbound traffic crypto map static-map

no cdp enable

!

interface fastethernet 0! FE0 is the outside or internet exposed interface ip address 210.110.101.21 255.255.255.0

ip access-group 103 in ! acl 103 permits ipsec traffic from the corp. router as well as denies internet initiated traffic inbound.

ip nat outside no cdp enable

crypto map to_corporate ! applies the ipsec tunnel to the outside interface.

!

ip nat inside source list 102 interface Ethernet1 overload ! utilize nat overload in order to make best use of the single address provided by the isp.

ip classless

ip route 0.0.0.0 0.0.0.0 210.110.101.1 no ip http server

!

!

!acl 102 associated addresses used for nat. access-list 102 permit ip 10.1.1.0 0.0.0.255 any

!acl 103 defines traffic allowed from the peer for the ipsec tunnel. access-list 103 permit udp host 200.1.1.1 any eq isakmp access-list 103 permit udp host 200.1.1.1 eq isakmp any access-list 103 permit esp host 200.1.1.1 any

access-list 103 permit icmp any any ! allow icmp for debugging but should be disabled due to security implications.

access-list 103 deny ip any any ! prevents internet initiated traffic inbound.

!acl 105 matches addresses for the ipsec tunnel to/from the corporate network.

access-list 105 permit ip 10.1.1.0 0.0.0.255 192.168.0.0 0.0.255.255 no cdp run

Cisco 1800 Series Integrated Services Routers (Fixed) Software Configuration Guide

OL-6426-02 7-11