additional subnets for IPSEC IOS users

[kinmun]

i have setup ipsec for ios users. created one subnet for testing.

everything works fine.

but when i add a second subnet to the same rule, the 2nd subnet cannot be access.

what else do i need to do in order for it to work?

do I need to do any routing ?

[kinmun]

found the solutions by adding to the vpn tunnel setup.

but i cannot add a second subnet that is in my DMZ segment.

how can i create a VPN tunnel for both LAN and DMZ segment ?

[emnoc]

A copy the cfg configuration would be nice but I think you need to define a 2nd Phase2 proposal.

e.g

config vpn ipsec phase2-interface

 edit "VPNvodafone01-p2-001"         set auto-negotiate enable         set keepalive enable         set pfs disable         set phase1name "vodaphoneES"         set proposal aes128-sha1         set replay disable         set dst-subnet 172.16.102.0 255.255.255.0         set keylifeseconds 3600         set src-subnet 192.168.24.0 255.255.255.0     next  edit "VPNvodafone01-p2-002"         set auto-negotiate enable         set keepalive enable         set pfs disable         set phase1name "vodaphoneES"         set proposal aes128-sha1         set replay disable         set dst-subnet 172.16.102.0 255.255.255.0         set keylifeseconds 3600         set src-subnet 192.168.25.0 255.255.255.0     next

Obviously you need correct firewall-policies and the far-end must be setup for the 2 phase2 configs. Also if your deploying route-based VPNs, you need a route at the far end for the 2nd subnet.

In my case the 192.168.24|25.0/24 are my lan1 and lan2 interface, but this could have been anything from a DMZ segment,etc.........

Just add more phase2-configurations against the original  phase1 name as you grow more and more subnets.

Hope that helps.

[kinmun]

adding of 2nd proposal can only be done in the cli ??

[kinmun]

my current config is like this 

config vpn ipsec phase1-interface edit "IOS-VPN" set type dynamic set interface "port2" set mode aggressive set peertype one set mode-cfg enable set proposal aes256-md5 aes256-sha1 set comments "VPN: IOS-VPN (Created by VPN wizard)" set dhgrp 2 set wizard-type dialup-ios set xauthtype auto set authusrgrp "iosusers" set peerid "IOS" set ipv4-start-ip 10.199.99.161 set ipv4-end-ip 10.199.99.170 set ipv4-netmask 255.255.255.0 set dns-mode auto set ipv4-split-include "grp.network1" set psksecret ENC LCVkCh9ic1s58sTBdMQ1eQg8Vgr/XSMgujBCrZbGdqDmYOH7G8HvFfVyWrJKdxprKvBG6NltDhXqlb/J+nZllrvc75NPmlYbJwrlMLNdKVS+Tb4Uiry14XdOyIR8AZF8jYxn+owno5sheKSPWdzATJMFA0ZJNmW2dsO0jJObux0SyaQILPfJmEHKTaazMOFy/PHVDA== next end config vpn ipsec phase2-interface edit "IOS-VPN" set phase1name "IOS" set proposal aes256-md5 aes256-sha1 set pfs disable set keepalive enable set comments "VPN: IOS (Created by VPN wizard)" next end

[emnoc]

So this a dynamic vpn, you need to diag debug flow the  subnet that's having problems.

e.g

diag debug en

diag debug reset

diag debug flow filter addr x.x.x.x

diag debug flow show-console enable

diag debug flow trace start 100

Than have the cliet who's autheticated via the vpn ping or access whatever adress ( x.x.x.x ) on the subnetwork that's not allowing access.

When your finished

diag debug reset

diag debug disable

Post the output once you have done this and search here in this forum for more  diag debug flow  examples. Also check that split-group assignment to ensure the client is allowed the 2nd subnet. I bet that's your problem.