Newsgroup: it.comp.reti.cisco
Titolo: Configurare C1721 come PPTP client

Salve
Ho un C1721 32F/128D - IOS 12.4(8)ADVIPSERVICES con link ADSL statico
RFC1483.
Volevo chiedere se è possibile configurare il cisco come PPTP client.
Avrei bisogno di configurare il cisco come PPTP client, in modo che
appena il cisco è up, e il link adsl è up, esso (il C1721) si connette
al server remoto tramite una chiamata PPTP, in modo che tutta la mia lan
a valle del cisco, si collega fuori tramite VPN pptp.
grazie
-- 
Posted via Mailgate.ORG Server - 
http://www.Mailgate.ORG

Salve
sono riuscito a configurare il C1721 come PPTP client. la connessione la fa, 
sembra tutto ok..... per i primi 30 secondi.
Devo impazzire ora con il policy routing.
In pratica il cisco va in loop per il seguente motivo:
Rubo un post mio su comp.dcom.sys.cisco
| > | The only problem wich lasts now is that the connection stays up and 
then
| > | drops every minute or two.
| >
| > Are you sure that it is working correctly when it is up?  That kind of
| > cycling is a typical symptom of the routing loop issue I mentioned.
|
| -Many PPTP servers use their primary address (i.e., the address that
| you might use in the vpdn-group's "initiate-to ip" command) for their end
| of the ppp connection.  This is a problem because IOS will install a /32
| route to that address through the dialer interface thus creating a loop
| that chokes the connection (and possibly even crashes the router).  If
| you can't find an alternate address for the server you will need to use
| policy routing to work around the problem as it appears that nothing can
| compete with a /32 "directly" connected interface route.
Mi hanno suggerito di usare il policy routing che gią in passato ha risolto 
il problema:
Any packets sent into the vpn will disappear into a black hole because
of the routing loop created by using the same address for the server's
end of the PPP link and the initiate-to.  That's what is killing the vpn
by blocking the keepalives.  Since your access to the internet was
apparently working you must not have been sending packets out through the
vpn.
In any case, you need to use policy based routing to force the encapsulated
vpn traffic through the correct interface in spite of the /32 that is
installed when the link comes up.  Try something like this:
interface Ethernet0
 ip policy route-map pptp
!
interface FastEthernet0
 ip policy route-map pptp
!
interface Dialer0
 ip policy route-map pptp
!
interface ATM0.35 point-to-point
 ip policy route-map pptp
!
ip local policy route-map pptp
!
access-list 112 permit ip any host 88.233.168.2
access-list 112 permit ip any host 88.233.168.3
access-list 112 permit ip any host 88.233.168.4
access-list 112 permit ip any host 88.233.168.5
access-list 112 permit ip any host 88.233.168.6
access-list 112 permit ip any host 88.233.168.7
access-list 112 deny   ip any any
route-map pptp permit 10
 match ip address 112
 set interface ATM0.35
La mia conf č relativa ad una connettivitą ADSL RFC1483 su ip statico.
allego la conf qui sotto:
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service internal
service sequence-numbers
!
hostname gateway
!
boot-start-marker
boot-end-marker
!
security authentication failure rate 3 log
security passwords min-length 6
logging buffered 4096 notifications
no logging console
no logging monitor
enable password 7 <XXXXXXXXXXXXXX>
!
no aaa new-model
!
resource policy
!
clock timezone CET 2
no ip source-route
no ip gratuitous-arps
ip cef
!
!
ip tcp selective-ack
ip tcp synwait-time 10
!
!
no ip bootp server
ip domain round-robin
no ip domain lookup
ip domain name 
spadhausen.org
ip name-server 217.97.32.2
ip name-server 217.97.32.7
ip multicast-routing
ip ssh time-out 90
ip ssh version 2
login block-for 120 attempts 5 within 60
login on-failure log
vpdn enable
!
vpdn-group 1
 request-dialin
  protocol pptp
  rotary-group 0
 initiate-to ip 83.233.168.2
 initiate-to ip 83.233.168.3
 initiate-to ip 83.233.168.4
 initiate-to ip 83.233.168.5
 initiate-to ip 83.233.168.6
 initiate-to ip 83.233.168.7
!
!
ipv6 unicast-routing
ipv6 general-prefix WAN 6to4 ATM0.35
ipv6 cef
!
!
!
!
!
!
!
!
!
!
!
!
!
crypto pki trustpoint TP-self-signed-1683529703
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-1683529703
 revocation-check none
 rsakeypair TP-self-signed-1683529703
!
!
crypto pki certificate chain TP-self-signed-1683529703
 certificate self-signed 01
X
X
X
X
X
X REMOVED
X
X
username maggiore privilege 15 password 7 0<XXXXXXXXXXXXXX>
!
!
!
!
!
!
interface Tunnel0
 no ip address
 no ip redirects
 ipv6 unnumbered FastEthernet0
 tunnel source ATM0.35
 tunnel mode ipv6ip 6to4
!
interface Null0
 no ip unreachables
!
interface ATM0
 bandwidth 256
 no ip address
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 atm ilmi-keepalive
 dsl operating-mode itu-dmt
 hold-queue 224 in
!
interface ATM0.35 point-to-point
 bandwidth 1280
 ip address 89.186.68.6 255.255.255.252
 ip access-group 100 in
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat outside
 ip virtual-reassembly
 pvc 8/35
  encapsulation aal5snap
 !
!
interface FastEthernet0
 description LAN FastEthernet Link
 bandwidth 10000000
 ip address 192.168.1.254 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat inside
 ip virtual-reassembly
 no ip mroute-cache
 speed auto
 full-duplex
 ipv6 address WAN 0:0:0:1::/64 eui-64
 no cdp enable
 hold-queue 100 in
!
interface Dialer0
 description VPN Tunnel to Relakks
 mtu 1450
 ip address negotiated
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip pim dense-mode
 ip nat outside
 ip virtual-reassembly
 encapsulation ppp
 shutdown
 dialer in-band
 dialer idle-timeout 0
 dialer string 123
 dialer vpdn
 dialer-group 1
 no keepalive
 no cdp enable
 ppp pfc local request
 ppp pfc remote apply
 ppp encrypt mppe auto
 ppp chap hostname maggiore
 ppp chap password 7 <XXXXXXXXXXXXXX>
 no ppp link reset
!
ip local policy route-map pptp
ip route 0.0.0.0 0.0.0.0 ATM0.35
!
!
no ip http server
no ip http secure-server
ip nat translation timeout 3600
ip nat translation tcp-timeout 1200
ip nat translation udp-timeout 100
ip nat translation finrst-timeout 15
ip nat translation syn-timeout 45
ip nat translation icmp-timeout 120
ip nat inside source list 102 interface ATM0.35 overload
ip nat inside source static tcp 192.168.1.2 20 89.186.68.6 20 extendable
ip nat inside source static tcp 192.168.1.2 21 89.186.68.6 21 extendable
ip nat inside source static tcp 192.168.1.2 3389 89.186.68.6 80 extendable
ip nat inside source static tcp 192.168.1.11 2010 89.186.68.6 2010 
extendable
ip nat inside source static tcp 192.168.1.11 2011 89.186.68.6 2011 
extendable
ip nat inside source static tcp 192.168.1.11 2012 89.186.68.6 2012 
extendable
ip nat inside source static tcp 192.168.1.11 2013 89.186.68.6 2013 
extendable
ip nat inside source static tcp 192.168.1.11 2014 89.186.68.6 2014 
extendable
ip nat inside source static tcp 192.168.1.11 2015 89.186.68.6 2015 
extendable
ip nat inside source static tcp 192.168.1.2 3389 89.186.68.6 3389 extendable
ip nat inside source static tcp 192.168.1.11 3724 89.186.68.6 3724 
extendable
ip nat inside source static tcp 192.168.1.11 6112 89.186.68.6 6112 
extendable
ip nat inside source static udp 192.168.1.11 17447 89.186.68.6 17447 
extendable
ip nat inside source static tcp 192.168.1.2 32770 89.186.68.6 32770 
extendable
ip nat inside source static tcp 192.168.1.2 32771 89.186.68.6 32771 
extendable
ip nat inside source static tcp 192.168.1.2 32772 89.186.68.6 32772 
extendable
ip nat inside source static tcp 192.168.1.2 32773 89.186.68.6 32773 
extendable
ip nat inside source static tcp 192.168.1.2 32774 89.186.68.6 32774 
extendable
ip nat inside source static tcp 192.168.1.2 32775 89.186.68.6 32775 
extendable
ip nat inside source static tcp 192.168.1.2 32776 89.186.68.6 32776 
extendable
ip nat inside source static tcp 192.168.1.2 32777 89.186.68.6 32777 
extendable
ip nat inside source static tcp 192.168.1.2 32778 89.186.68.6 32778 
extendable
ip nat inside source static tcp 192.168.1.2 32779 89.186.68.6 32779 
extendable
ip nat inside source static tcp 192.168.1.2 32780 89.186.68.6 32780 
extendable
ip nat inside source static tcp 192.168.1.11 3389 89.186.68.6 33389 
extendable
!
!
logging trap debugging
logging facility syslog
logging 192.168.1.4
access-list 100 deny   ip 85.33.96.177 0.0.0.8 any log
access-list 100 deny   ip 0.0.0.0 0.255.255.255 any
access-list 100 deny   ip 10.0.0.0 0.255.255.255 any
access-list 100 deny   ip 127.0.0.0 0.255.255.255 any
access-list 100 deny   ip 169.254.0.0 0.0.255.255 any
access-list 100 deny   ip 172.16.0.0 0.15.255.255 any
access-list 100 deny   ip 192.0.2.0 0.0.0.255 any
access-list 100 deny   ip 192.168.0.0 0.0.255.255 any
access-list 100 deny   ip 224.0.0.0 15.255.255.255 any
access-list 100 deny   ip host 255.255.255.255 any
access-list 100 deny   ip host 89.186.68.6 host 89.186.68.6
access-list 100 deny   ip host 89.186.68.6 any
access-list 100 deny   tcp any lt 1030 any lt 1030
access-list 100 permit udp any eq ntp host 89.186.68.6
access-list 100 permit udp any eq domain host 89.186.68.6
access-list 100 deny   udp any lt 1030 any lt 1030
access-list 100 permit ip any host 89.186.68.6 fragments
access-list 100 permit icmp any host 89.186.68.6 echo
access-list 100 permit icmp any host 89.186.68.6 echo-reply
access-list 100 permit icmp any host 89.186.68.6 time-exceeded
access-list 100 permit icmp any host 89.186.68.6 packet-too-big
access-list 100 permit icmp any host 89.186.68.6 unreachable
access-list 100 permit icmp any host 89.186.68.6 source-quench
access-list 100 deny   icmp any any
access-list 100 permit igmp any host 89.186.68.6
access-list 100 deny   udp any any range 33400 34400
access-list 100 permit tcp any host 89.186.68.6 range ftp-data 22
access-list 100 permit tcp any host 89.186.68.6 eq www
access-list 100 deny   tcp any host 89.186.68.6 eq 135
access-list 100 deny   udp any host 89.186.68.6 eq 135
access-list 100 deny   tcp any host 89.186.68.6 range 137 139
access-list 100 deny   udp any host 89.186.68.6 range netbios-ns netbios-ss
access-list 100 deny   tcp any host 89.186.68.6 eq 445
access-list 100 deny   udp any host 89.186.68.6 eq 445
access-list 100 deny   tcp any host 89.186.68.6 range 1433 1434
access-list 100 deny   udp any host 89.186.68.6 range 1433 1434
access-list 100 deny   tcp any host 89.186.68.6 eq 1720
access-list 100 deny   tcp any host 89.186.68.6 eq 5060
access-list 100 permit tcp any host 89.186.68.6 established
access-list 100 deny   udp any host 89.186.68.6 range snmp snmptrap
access-list 100 permit tcp any host 89.186.68.6 gt 1030
access-list 100 permit udp any host 89.186.68.6
access-list 100 permit 41 any host 89.186.68.6
access-list 100 permit gre any host 89.186.68.6
access-list 100 deny   ip any any log
access-list 102 permit ip 192.168.1.0 0.0.0.255 any
access-list 112 permit ip any host 88.233.168.2
access-list 112 permit ip any host 88.233.168.3
access-list 112 permit ip any host 88.233.168.4
access-list 112 permit ip any host 88.233.168.5
access-list 112 permit ip any host 88.233.168.6
access-list 112 permit ip any host 88.233.168.7
access-list 112 deny   ip any any
dialer-list 1 protocol ip permit
!
no cdp run
ipv6 route 2002::/16 Tunnel0
ipv6 route ::/0 2002:C058:6301::1
!
route-map pptp permit 10
 match ip address 112
 set interface ATM0.35
!
control-plane
!
!
!
!
!
!
!
!
banner login ^CC
           You are connected to $(hostname).$(domain) on line $(line).
        If you are not authorized to access this system, disconnect now.
                       THIS IS FOR AUTHORIZED USE ONLY
          Unauthorized or improper use of this system may result in
    administrative disciplinary action and civil and criminal penalties.
  By continuing to use this system you indicate your awareness of and 
consent
   to these terms and conditions of use. LOG OFF IMMEDIATELY if you do not
                  agree to the conditions stated in this warning.
                   Network Administrator: xxxxxxxxx
^C
!
line con 0
 login local
 transport output telnet
 stopbits 1
line aux 0
 login local
 transport preferred none
 transport output telnet
 stopbits 1
line vty 0 4
 login local
 transport preferred ssh
 transport input ssh
 transport output none
 flowcontrol software
!
scheduler max-task-time 5000
sntp server 193.204.114.105
sntp server 192.43.244.18
end