Newsgroup: it.comp.reti.cisco
Titolo: VPN su 2 interfacce

Ciao a tutti,
la mia società è divisa in 2 sedi:
SEDE1
Router 2650 con 2 interfacce pubbliche, una Fastethernet e una adsl.
Attualmente l'interfaccia fastethernet è utilizzata per le vpn verso i
clienti (una decina) e la vpn con la sede 2. L'interfaccia adsl attualmente
è configurata ma non viene utilizzata.
LAN 
192.168.1.0/24
SEDE2
Router 2600 con un interfaccia pubblica adsl utilizzata per la connettività
internet e la vpn con l'interfaccia fastethernet della sede 1.
LAN 
192.168.3.0/24
 
172.16.1.0/24
 (lan di test su cui sto facendo le prove per poter spostare la
vpn)
I problemi li ho quando cerco di redirigere la vpn tra le sedi sulle
interfacce adsl.
La vpn la vedo UP-ACTIVE ma non ho connettività tra le sedi, o meglio mi
succede una cosa abbastanza strana: quando faccio il ping tra una sede e
l'altra ricevo risposta solamente al primo pacchetto icmp inviato e poi
basta. Se riprovo il ping dopo un'ora la stessa cosa: risposta al primo e
poi niente altro. Ho provato telenet e ssh e non funziona.
Ecco le configurazione dei router e gli output che mio avviso potrebbero
aiutare:
SEDE 1
ip cef
no ip domain lookup
ip audit notify log
ip audit po max-events 100
vpdn enable
!
vpdn-group 1
! Default PPTP VPDN group
 accept-dialin
  protocol pptp
  virtual-template 1
 local name remotes
!
clns routing
no ftp-server write-enable
!
!
crypto isakmp policy 15
 encr 3des
 hash md5
 authentication pre-share
 group 2
!
crypto isakmp policy 30
 encr 3des
 hash md5
 authentication pre-share
 group 2
!
crypto isakmp policy 32
 encr 3des
 hash md5
 authentication pre-share
 group 2
!
crypto isakmp policy 35
 hash md5
 authentication pre-share
 group 2
crypto isakmp key vari_clienti address <ip_clienti_vari>
....vari clienti....
crypto isakmp key chiave_vpn_sedi address <IP_pubblico_sede2_adsl>
!
!
crypto ipsec transform-set 3des_md5 esp-3des esp-md5-hmac
crypto ipsec transform-set SDM_TRANSFORMSET_1 esp-3des esp-sha-hmac
crypto ipsec transform-set 3des_md5bis esp-3des esp-sha-hmac
crypto ipsec transform-set des_md5 esp-des esp-md5-hmac
crypto ipsec df-bit clear
!
crypto map vpn local-address FastEthernet0/0
....varie crypto map con i clienti....
crypto map vpn 58 ipsec-isakmp
 description sede 2 via Fastethernet
 set peer <IP_pubblico_sede2_adsl>
 set transform-set 3des_md5bis
 match address 197
!
crypto map link 1 ipsec-isakmp
 description sede 2 via ADSL
 set peer <IP_pubblico_sede2_adsl>
 set transform-set 3des_md5
 match address 135
!
!
interface ATM0/0
 no ip address
 no ip mroute-cache
 no atm ilmi-keepalive
 dsl operating-mode auto
!
interface ATM0/0.1 point-to-point
 pvc 8/35
  encapsulation aal5mux ppp dialer
  dialer pool-member 1
 !
!
interface FastEthernet0/0
 description $FW_OUTSIDE$$ETH-WAN$Wan outside interface
 ip address <IP_pubblico_sede1_fastethernet>
 ip nat outside
 speed auto
 full-duplex
 no mop enabled
 crypto map vpn
!
interface FastEthernet0/1
 description $FW_INDISE$$ETH-LAN$LAN inside interface
 ip address 192.168.1.100 255.255.255.0
 no ip unreachables
 no ip proxy-arp
 ip nat inside
 speed auto
 full-duplex
!
interface Ethernet1/0
 no ip address
 shutdown
 half-duplex
!
interface Ethernet1/1
 description $ETH-LAN$Frame Relay
 ip address 192.168.5.2 255.255.255.0
 ip nat outside
 half-duplex
!
interface Ethernet1/2
 no ip address
 shutdown
 half-duplex
!
interface Ethernet1/3
 description $ETH-LAN$
 ip address 192.168.2.111 255.255.255.0
 ip nat outside
 half-duplex
!
interface Virtual-Template1
 ip unnumbered FastEthernet0/1
 ip mroute-cache
 peer default ip address pool VPN-IN
 ppp encrypt mppe 40 required
 ppp authentication ms-chap
!
interface Dialer1
 description link ADSL
 ip address <IP_pubblico_sede1_adsl>
 ip nat outside
 encapsulation ppp
 dialer pool 1
 dialer-group 1
 ppp authentication chap pap callin
 ppp chap hostname <user_adsl>
 ppp chap password 0 <passwd>
 ppp pap sent-username <user_adsl> password 0 <passwd>
 crypto map link
!
ip local pool VPN-IN 192.168.6.10 192.168.6.25
ip nat inside source static tcp 192.168.1.100 1723 interface FastEthernet0/0
1723
ip nat inside source route-map SDM_RMAP_1 interface FastEthernet0/0 overload
ip classless
ip route 0.0.0.0 0.0.0.0 194.5.73.129 permanent
ip route 172.16.1.0 255.255.255.0 Dialer1
ip route 192.168.0.0 255.255.255.0 192.168.1.250
!
ip http server
ip http authentication local
ip http secure-server
!
!
access-list 100 remark SDM_ACL Category=4
access-list 100 remark IPSec Rule
access-list 100 permit ip 192.168.1.0 0.0.0.255 10.0.16.0 0.0.15.255
access-list 102 remark SDM_ACL Category=4
access-list 105 permit ip any any
access-list 110 permit ip host 192.168.1.93 host 10.2.2.21
access-list 110 permit icmp host 192.168.1.93 host 10.2.2.21
access-list 135 permit ip 192.168.1.0 0.0.0.255 172.16.1.0 0.0.0.255
access-list 151 deny ip host 192.168.1.93 host 10.2.2.21
access-list 151 deny ip any any
access-list 151 deny ip 192.168.1.0 0.0.0.255 10.0.16.0 0.0.15.255
access-list 151 deny tcp host 192.168.1.11 any
access-list 151 deny ip 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255
access-list 151 deny ip 192.168.1.0 0.0.0.255 10.0.10.0 0.0.0.255
access-list 151 deny ip 192.168.6.0 0.0.0.255 192.168.3.0 0.0.0.25
access-list 151 permit ip 192.168.6.0 0.0.0.255 any
access-list 151 permit ip 192.168.1.0 0.0.0.255 any
access-list 151 permit tcp host 192.168.1.20 any
access-list 155 permit ip 192.168.1.0 0.0.0.255 192.168.10.0 0.0.0.255
access-list 165 permit ip host 192.168.1.93 host 10.76.172.50
access-list 180 permit ip host 192.168.1.93 host 10.10.10.1
access-list 180 permit icmp host 192.168.1.93 host 10.10.10.1
access-list 180 permit ip host 192.168.1.85 host 10.10.10.1
access-list 180 permit icmp host 192.168.1.85 host 10.10.10.1
access-list 180 permit ip host 192.168.1.32 host 10.10.10.1
access-list 180 permit icmp host 192.168.1.32 host 10.10.10.1
access-list 195 permit ip host 192.168.1.93 host 10.77.36.241
access-list 195 permit icmp host 192.168.1.93 host 10.77.36.241
access-list 196 permit ip 192.168.1.0 0.0.0.255 10.0.10.0 0.0.0.255
access-list 196 permit ip 192.168.3.0 0.0.0.255 10.0.10.0 0.0.0.255
access-list 197 permit ip 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255
access-list 197 permit ip 10.0.10.0 0.0.0.255 192.168.3.0 0.0.0.255
access-list 197 permit ip 192.168.6.0 0.0.0.255 192.168.3.0 0.0.0.255
access-list 197 permit ip 192.168.1.0 0.0.0.255 192.168.7.0 0.0.0.255
dialer-list 1 protocol ip list 105
snmp-server community public RO
snmp-server enable traps tty
!
route-map SDM_RMAP_1 permit 1
 match ip address 151
!
!
!
control-plane
!
!
line con 0
line aux 0
line vty 0 4
 privilege level 15
 password letmein
 transport input telnet ssh
!
!
!
end
router#show access-list 135
Extended IP access list 135
    10 permit ip 192.168.1.0 0.0.0.255 172.16.1.0 0.0.0.255 (1654 matches)
router#show crypto map
.....
Crypto Map "link" 1 ipsec-isakmp
        Description:
        Peer = <IP_pubblico_sede2_adsl>
        Extended IP access list 135
            access-list 135 permit ip 192.168.1.0 0.0.0.255 172.16.1.0 0.0.0.255
        Current peer: <IP_pubblico_sede2_adsl>
        Security association lifetime: 4608000 kilobytes/3600 seconds
        PFS (Y/N): N
        Transform sets={
                3des_md5,
        }
        Interfaces using crypto map link:
                Dialer1
                Virtual-Access2
Router#show crypto session detail
Interface: Dialer1
Session status: UP-ACTIVE
Peer: <IP_pubblico_sede2_adsl>/500 fvrf: (none) ivrf: (none)
      Phase1_id: <IP_pubblico_sede2_adsl>
      Desc: (none)
  IKE SA: local <IP_pubblico_sede1_adsl>//500 remote
<IP_pubblico_sede2_adsl>/500 Active
          Capabilities:(none) connid:965 lifetime:04:13:16
  IPSEC FLOW: permit ip 
192.168.1.0/255.255.255.0
 
172.16.1.0/255.255.255.0
        Active SAs: 2, origin: crypto map
        Inbound: #pkts dec'ed 1018 drop 0 life (KB/Sec) 4555080/1548
        Outbound: #pkts enc'ed 1018 drop 0 life (KB/Sec) 4555080/1548
  IPSEC FLOW: permit ip 
192.168.1.0/255.255.255.0
 
172.16.1.0/255.255.255.0
        Active SAs: 2, origin: crypto map
        Inbound: #pkts dec'ed 1018 drop 0 life (KB/Sec) 4555080/1548
        Outbound: #pkts enc'ed 1018 drop 0 life (KB/Sec) 4555080/1548
SEDE 2
no ip domain lookup
ip name-server <DNS_1>
ip name-server <DNS_2>
ip dhcp excluded-address 192.168.3.1 192.168.3.9
!
ip dhcp pool bureau
   network 192.168.3.0 255.255.255.0
   default-router 192.168.3.1
   dns-server <DNS_1> <DNS_2>
!
ip audit po max-events 100
vpdn enable
!
vpdn-group 1
! Default PPTP VPDN group
 accept-dialin
  protocol pptp
  virtual-template 1
 local name remotes
!
no ftp-server write-enable
!
!
crypto isakmp policy 15
 encr 3des
 hash md5
 authentication pre-share
 group 2
!
crypto isakmp policy 30
 encr 3des
 hash md5
 authentication pre-share
 group 2
!
crypto isakmp policy 32
 encr 3des
 hash md5
 authentication pre-share
 group 2
!
crypto isakmp policy 35
 hash md5
 authentication pre-share
 group 2
crypto isakmp key chiave_vpn_sedi address <IP_pubblico_sede1_fastethernet>
crypto isakmp key chiave_vpn_sedi address <IP_pubblico_sede1_adsl>
!
!
crypto ipsec transform-set 3des_md5 esp-3des esp-md5-hmac
crypto ipsec transform-set SDM_TRANSFORMSET_1 esp-3des esp-sha-hmac
crypto ipsec transform-set 3des_md5bis esp-3des esp-sha-hmac
crypto ipsec transform-set des_md5 esp-des esp-md5-hmac
crypto ipsec df-bit clear
!
crypto map vpn 1 ipsec-isakmp
 description sede 1 Fastethernet
 set peer <IP_pubblico_sede1_fastethernet>
 set transform-set 3des_md5bis
 match address 102
crypto map vpn 5 ipsec-isakmp
 description sede 1 ADSL
 set peer <IP_pubblico_sede1_adsl>
 set transform-set 3des_md5
 match address 135
!
!
interface ATM0/0
 no ip address
 no ip mroute-cache
 no atm ilmi-keepalive
 dsl operating-mode auto
!
interface ATM0/0.1 point-to-point
 pvc 8/35
  encapsulation aal5mux ppp dialer
  dialer pool-member 1
 !
!
interface FastEthernet0/0
 description Production1
 ip address 172.16.1.1 255.255.255.0
 ip nat inside
 speed auto
 full-duplex
!
interface FastEthernet0/1
 description lan
 ip address 192.168.3.1 255.255.255.0
 ip nat inside
 speed auto
 full-duplex
!
interface Serial0/1
 no ip address
 shutdown
!
interface Serial0/2
 no ip address
 shutdown
!
interface Ethernet1/0
 no ip address
 shutdown
 half-duplex
!
interface Ethernet1/1
 no ip address
 shutdown
 half-duplex
!
interface Ethernet1/2
 no ip address
 shutdown
 half-duplex
!
interface Ethernet1/3
 no ip address
 shutdown
 half-duplex
!
interface Virtual-Template1
 ip unnumbered FastEthernet0/1
 ip mroute-cache
 peer default ip address pool VPN-IN
 ppp encrypt mppe 40 required
 ppp authentication ms-chap
!
interface Dialer1
 description Outside
 ip address <IP_pubblico_sede2_adsl>
 ip access-group 120 in
 ip nat outside
 encapsulation ppp
 dialer pool 1
 dialer-group 1
 ppp authentication chap pap callin
 ppp chap hostname <user_adsl>
 ppp chap password 0 <passwd>
 ppp pap sent-username <user_adsl> password 0 <passwd>
 crypto map vpn
!
ip local pool VPN-IN 192.168.7.10 192.168.7.15
ip nat inside source route-map nonat interface Dialer1 overload
ip nat inside source static tcp 192.168.3.1 1723 interface Dialer1 1723
no ip http server
no ip http secure-server
ip classless
ip route 0.0.0.0 0.0.0.0 Dialer1
!
!
access-list 1 permit 192.168.3.0 0.0.0.255
access-list 101 permit ip any any
access-list 102 permit ip 192.168.3.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 102 permit ip 192.168.3.0 0.0.0.255 10.0.10.0 0.0.0.255
access-list 102 permit ip 192.168.3.0 0.0.0.255 192.168.6.0 0.0.0.255
access-list 102 permit ip 192.168.7.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 110 deny ip 192.168.3.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 110 deny ip 192.168.3.0 0.0.0.255 10.0.10.0 0.0.0.255
access-list 110 deny ip 192.168.3.0 0.0.0.255 192.168.6.0 0.0.0.255
access-list 110 deny ip 192.168.7.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 110 deny ip 172.16.1.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 110 deny ip host 192.168.3.5 host 172.17.80.205
access-list 110 permit ip host 192.168.3.5 any
access-list 110 permit ip 192.168.3.0 0.0.0.255 any
access-list 110 permit ip 192.168.7.0 0.0.0.255 any
access-list 110 permit ip 172.16.1.0 0.0.0.255 any
access-list 120 deny tcp any host <IP_pubblico_sede2_adsl> eq 1863
access-list 120 permit ip any any
access-list 125 permit ip host <IP_pubblico_sede2_adsl> host
<IP_pubblico_client_x>
access-list 125 permit ip host 192.168.3.5 host 172.17.80.205
access-list 135 permit ip 172.16.1.0 0.0.0.255 192.168.1.0 0.0.0.255
dialer-list 1 protocol ip list 101
!
route-map nonat permit 10
 match ip address 110
 set ip df 0
!
snmp-server community public RO
snmp-server enable traps tty
!
!
line con 0
line aux 0
line vty 0 4
 privilege level 15
 password letmein
 transport input telnet ssh
!
!
end
router#show access-list 135
Extended IP access list 135
    10 permit ip 172.16.1.0 0.0.0.255 192.168.1.0 0.0.0.255 (1066 matches)
router#show crypto map
Crypto Map "vpn" 5 ipsec-isakmp
        Description: ADSL-ADSL
        Peer = Crypto Map "vpn" 5 ipsec-isakmp
        Description:
        Peer = <IP_pubblico_sede1_adsl>
        Extended IP access list 135
            access-list 135 permit ip 172.16.1.0 0.0.0.255 192.168.1.0 0.0.0.255
        Current peer: <IP_pubblico_sede1_adsl>
        Security association lifetime: 4608000 kilobytes/3600 seconds
        PFS (Y/N): N
        Transform sets={
                3des_md5,
        }
        Interfaces using crypto map mctel:
                Dialer1
                Virtual-Access3
Grazie per ogni aiuto,
Ginevra J.
--------------------------------
Inviato via 
http://arianna.libero.it/usenet/

Da un pc di SEDE 2 riesco a pingare tranquillamente l'interfaccia LAN del
router di SEDE 1. Se cerco di pingare qualche client dietro a questo router
non ho risposte.
