Newsgroup: it.comp.reti.cisco
Titolo: Client VPN non funziona..

Ciao ragazzi..non so piu' dove sbattere la testa..
questa la mia stituazione...
-  LAN 
10.0.10.0/24
 con Cisco  tunneling server  10.0.10.254
   interfaccia di loopback0   10.0.0.254
- client VPN (windows remote access) 10.0.0.1
- pptp - ms-chap -  aaa local
Quando attivo la connessione dal client mi prende come server IP add
10.0.0.254,come client IP add 10.0.0.1 ma non riesco neanche a ping
10.0.0.254..di accedere nella LAN 
10.0.10.0/24
 non se ne parla
proprio.. qualcuno puo' aiutarmi.
Di seguito la mia configurazione.
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname Cisco
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 warnings
enable secret 5 **********
!
aaa new-model
!
!
aaa authentication ppp default local
!
aaa session-id common
!
resource policy
!
clock timezone PCTime 0
clock summer-time PCTime date Mar 30 2003 1:00 Oct 26 2003 2:00
no ip dhcp use vrf connected
ip dhcp excluded-address 10.0.10.1
ip dhcp excluded-address 10.0.10.254
!
ip dhcp pool Cisco_Scope
   network 10.0.10.0 255.255.255.0
   default-router 10.0.10.254
   dns-server 192.74.65.68 194.72.9.34
!
!
no ip cef
ip inspect name firewall tcp
ip inspect name firewall udp alert on
ip inspect name firewall tftp
ip inspect name firewall ftp timeout 120
ip domain name tg26@.com
ip name-server 194.74.65.68
ip name-server 194.72.9.34
vpdn enable
!
vpdn-group clientinit
! Default L2TP VPDN group
! Default PPTP VPDN group
 accept-dialin
  protocol any
  virtual-template 1
!
!
!
crypto pki trustpoint TP-self-signed-3996847148
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-3996847148
 revocation-check none
 rsakeypair TP-self-signed-3996847148
!
!
crypto pki certificate chain TP-self-signed-3996847148
 certificate self-signed 01
  30820247 308201B0 A0030201 02020101 300D0609 2A864886 F70D0101
04050030
  *
  quit
username ************* privilege 15 secret 5 *************
username test password 7 021201481F
!
!
!
!
!
interface Loopback0
 ip address 10.0.0.254 255.255.255.0
!
interface ATM0
 no ip address
 no atm ilmi-keepalive
 dsl operating-mode auto
!
interface ATM0.1 point-to-point
 description ***** Server_room *****
 no snmp trap link-status
 pvc 0/38
  encapsulation aal5mux ppp dialer
  dialer pool-member 1
 !
!
interface FastEthernet0
 no cdp enable
!
interface FastEthernet1
 no cdp enable
!
interface FastEthernet2
 no cdp enable
!
interface FastEthernet3
 no cdp enable
!
interface Virtual-Template1
 ip unnumbered Loopback0
 peer default ip address pool dial-in
 ppp encrypt mppe auto required
 ppp authentication ms-chap ms-chap-v2
!
interface Dot11Radio0
 no ip address
 shutdown
 speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0
36.0 48.0 54.0
 station-role root
!
interface Vlan1
 description ***** Server room VLAN 1 *****
 ip address 10.0.10.254 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 ip tcp adjust-mss 1452
!
interface Dialer0
 ip address 81.*.*.* 255.255.255.254
 ip inspect firewall out
 ip nat outside
 ip virtual-reassembly
 encapsulation ppp
 dialer pool 1
 dialer-group 1
 no cdp enable
 ppp authentication chap pap callin
 ppp chap hostname **************
 ppp chap password 7 082C4D400700514E43
 ppp pap sent-username ************ password 7 1104180B190B5F5555
!
ip local pool dial-in 10.0.0.1 10.0.0.10
ip route 0.0.0.0 0.0.0.0 Dialer0
!
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat translation timeout 300
ip nat translation tcp-timeout 120
ip nat translation syn-timeout 120
ip nat translation icmp-timeout 180
ip nat translation max-entries 5000
ip nat inside source list 1 interface Dialer0 overload
ip nat inside source static tcp 10.0.10.254 22 interface Dialer0 22
ip nat inside source static udp 10.0.10.1 53 interface Dialer0 53
ip nat inside source static tcp 10.0.10.1 20 interface Dialer0 20
ip nat inside source static tcp 10.0.10.1 21 interface Dialer0 21
ip nat inside source static tcp 10.0.10.1 80 interface Dialer0 80
ip nat inside source static tcp 10.0.10.1 3389 interface Dialer0 3389
ip nat inside source static tcp 10.0.10.1 5501 interface Dialer0 5501
ip nat inside source static tcp 10.0.10.1 5502 interface Dialer0 5502
ip nat inside source static tcp 10.0.10.1 5503 interface Dialer0 5503
ip nat inside source static tcp 10.0.10.1 5504 interface Dialer0 5504
ip nat inside source static tcp 10.0.10.1 5505 interface Dialer0 5505
!
access-list 1 permit 10.0.10.0 0.0.0.255
access-list 101 permit udp any eq isakmp any eq isakmp
access-list 110 remark **** icmp traffic ****
access-list 110 permit icmp any any unreachable
access-list 110 permit icmp any any echo-reply
access-list 110 permit icmp any any echo
access-list 110 permit icmp any any traceroute
access-list 110 remark **** dns traffic ****
access-list 110 permit udp any any eq domain
access-list 110 remark **** services ****
access-list 110 permit tcp any any eq www
access-list 110 permit tcp any any eq ftp
access-list 110 permit tcp any any eq ftp-data
access-list 110 permit tcp any any eq 5501
access-list 110 permit tcp any any eq 5502
access-list 110 permit tcp any any eq 5503
access-list 110 permit tcp any any eq 5504
access-list 110 permit tcp any any eq 5505
access-list 110 remark **** vpn services ****
access-list 110 permit tcp any any eq 1723
access-list 110 permit gre any any
access-list 110 remark **** remote access ****
access-list 110 permit tcp any any eq 3389
access-list 110 permit tcp any any eq 22
dialer-list 1 protocol ip permit
no cdp run
!
control-plane
!
banner login  Targetgrange Tld
Disconnect IMMEDIATELY if you are not an authorized user! 
!
line con 0
 no modem enable
line aux 0
line vty 0 4
 privilege level 15
 transport input telnet ssh
!
scheduler max-task-time 5000
end
Se nel virtual template assumo come ip unnumbered la vlan1 e
attribuisco al pool per la vpn, un range della stessa subnet della
LAN..tutto funziona...
ma io vorrei avere una subnet differente per la mia vpn..come posso
fare?
Ciao e grazie

 Ciao e grazie
-------------------------------------------------------
Messaggio inviato da 
http://www.sandlab.org/newsgroup/
Accesso gratuito via web ai Newsgroup

 Risolto l' inspection ?
si grazie.. ho risolto come ho scritto nell ultimo post..escludento l
ip inspect sul traffico http..
adesso mi preme davvero risolvere questa situazione..
ciao

 o debug ip icmp per vedere il ping
quando provo a pingare dal client vpn 10.0.0.1 al server vpn
10.0.0.254
assolutamente niente..

 assolutamente niente..
se invece imposto una route statica da windows del tipo
route add 10.0.0.0 mask 255.255.255.0 10.0.0.1 metric 5
riesco a pingare il server vpn
e questo il debug sul router
*Mar  9 22:50:20.351: ICMP: echo reply sent, src 10.0.0.254, dst
10.0.0.1
*Mar  9 22:50:21.355: ICMP: echo reply sent, src 10.0.0.254, dst
10.0.0.1
*Mar  9 22:50:22.423: ICMP: echo reply sent, src 10.0.0.254, dst
10.0.0.1
*Mar  9 22:50:23.355: ICMP: echo reply sent, src 10.0.0.254, dst
10.0.0.1
manon riesco a pingare la LAN 10.0.10.0 /24

 S*   
0.0.0.0/0
 is directly connected, Dialer0
fai un :
show user
show vpdn
in questo modo puoi verificare il client remoto ,
comunque qualcosa non mi è chiaro, visto che stai in tabella e dovresti
pingare.
Io ti consiglio di cambiare la classe del client remoto  in una distinta ,
magari una 172.16 o altra visto che il router la vede la 10 come /8 
ciao.



ci provo e posto il risultato...
Ciao

 Ciao
ciao.



Ora..ho cambiato la subnet per la vpn in 172.16.0.0 255.255.0.0 e ora
client e server vpn riescono a comunicare..
Interfaccia di loopback 172.16.0.254 e client vpn 172.16.0.1..
Un problema lo abbiamo risolto..
La connessione e attiva.. ma non riesco a pingare la subnet 10.0.10.0
dietro al router..
Ti posto un po' di sh.. sperando di riuscire a risolvere tutto..
grazie per il supporto..

Cisco#sh conf
Using 5482 out of 131072 bytes
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname Cisco
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 warnings
enable secret 5 ***************

 certificate self-signed 01 nvram:IOS-Self-Sig#3802.cer
username **** privilege 15 secret 5 $**********
username test password 7 021201481F
!
!
!
!
!
interface Loopback0
 ip address 172.16.0.254 255.255.0.0

 ip address 81.149.88.109 255.255.255.254
 ip inspect firewall out
 ip nat outside
 ip virtual-reassembly
 encapsulation ppp
 dialer pool 1
 dialer-group 1
 no cdp enable
 ppp authentication chap pap callin
 ppp chap hostname **********
 ppp chap password 7 *******
 ppp pap sent-username *********** password 7 1********
!
ip local pool dial-in 172.16.0.1 172.16.0.253
ip route 0.0.0.0 0.0.0.0 Dialer0
!
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat translation timeout 300
ip nat translation tcp-timeout 120
ip nat translation syn-timeout 120
ip nat translation icmp-timeout 180
ip nat translation max-entries 5000
ip nat inside source list 101 interface Dialer0 overload
ip nat inside source static tcp 10.0.10.1 5505 interface Dialer0 5505
ip nat inside source static tcp 10.0.10.1 5504 interface Dialer0 5504
ip nat inside source static tcp 10.0.10.1 5503 interface Dialer0 5503
ip nat inside source static tcp 10.0.10.1 5502 interface Dialer0 5502
ip nat inside source static tcp 10.0.10.1 5501 interface Dialer0 5501
ip nat inside source static tcp 10.0.10.1 3389 interface Dialer0 3389
ip nat inside source static tcp 10.0.10.1 80 interface Dialer0 80
ip nat inside source static tcp 10.0.10.1 21 interface Dialer0 21
ip nat inside source static tcp 10.0.10.1 20 interface Dialer0 20
ip nat inside source static udp 10.0.10.1 53 interface Dialer0 53
ip nat inside source static tcp 10.0.10.254 22 interface Dialer0 22
!
access-list 101 remark **** denat ****
access-list 101 deny   ip 10.0.10.0 0.0.0.255 172.16.0.0 0.0.255.255
access-list 101 permit ip 10.0.10.0 0.0.0.255 any
access-list 110 remark **** icmp traffic ****
access-list 110 permit icmp any any unreachable
access-list 110 permit icmp any any echo-reply
access-list 110 permit icmp any any echo
access-list 110 permit icmp any any traceroute
access-list 110 remark **** dns traffic ****
access-list 110 permit udp any any eq domain
access-list 110 remark **** services ****
access-list 110 permit tcp any any eq www
access-list 110 permit tcp any any eq ftp
access-list 110 permit tcp any any eq ftp-data
access-list 110 permit tcp any any eq 5501
access-list 110 permit tcp any any eq 5502
access-list 110 permit tcp any any eq 5503
access-list 110 permit tcp any any eq 5504
access-list 110 permit tcp any any eq 5505
access-list 110 remark **** vpn services ****
access-list 110 permit tcp any any eq 1723
access-list 110 permit gre any any
access-list 110 permit udp any any eq isakmp
access-list 110 remark **** remote access ****
access-list 110 permit tcp any any eq 3389
access-list 110 permit tcp any any eq 22
dialer-list 101 protocol ip permit
no cdp run
!
control-plane
!
banner login ^CTargetgrange Tld
Disconnect IMMEDIATELY if you are not an authorized user!^C
!
line con 0
 no modem enable
line aux 0
line vty 0 4
 privilege level 15
 transport input telnet ssh
!
scheduler max-task-time 5000
end
Cisco#sh user
    Line       User       Host(s)              Idle       Location
*  2 vty 0     administra idle                 00:00:00 10.0.10.1
  Interface    User               Mode         Idle     Peer Address
  Vi3                             PPPoATM      00:00:00 217.47.132.72
Cisco#sh vpdn
%No active L2F tunnels
%No active L2TP tunnels
PPTP Tunnel and Session Information Total tunnels 1 sessions 1
LocID Remote Name     State    Remote Address  Port  Sessions VPDN
Group
24                    estabd   217.35.98.139   1108  1
clientinit
LocID RemID TunID Intf    Username      State   Last Chg Uniq ID
24    256   24    Vi5     test          estabd  00:00:22 24

Ah..dimenticavo...
con l ultima configurazione postata riesco:
- a pingare il server VPN dal client...
- se imposto una route statica del tipo ROUTE ADD 10.0.10.0 MASK
255.255.255.0 172.16.0.1 MATRIC 10

Ricapitolando...
con l ultima configurazione, riesco a pingare il server VPN
(172.16.0.254) e se imposto una route statica sul client windows del
tipo
ROUTE ADD 10.0.10.0 MASK 255.255.255.0 172.16.0.1 METRIC 10

 255.255.255.0 172.16.0.1 MATRIC 10
riesco anche ad entrare nella subnet del router...
cosa bisogna fare per evitare la route statica a mano?

ma...@tg26.com
 wrote:





 cosa bisogna fare per evitare la route statica a mano?
Non ti seguo!!, non č possibile che tu fai una static sul client per poter
entrare a una rete dietro il router server vpn,.... ameno che il tuo
client windows sta proprio dietro il router con una interfaccia ethernet
collegata al router e un altra verso la vpn, se e cosi che  stai lavorando
 , allora dimmelo subito!.



Non avrei nessun interesse nel tralasciare informazioni.. anzi.. sto
postando anche i miei indirizzi
pubblici..in modo tale da porti nelle condizioni di aiutarmi...
sto lavorando su due linee differenti che non sono fisicamente
collegate..
router -> Un server Linux -> e ->in wireless Client Windows1 con
Remote Access per VPN (il mio client)
router cisco -> int ext - Server Windows - int int -> switch -> Client
Windows2
Ora..cofiguro il router in SSH dal client 2 e effettuo la connessione
VPN dal client 1
Se vuoi ti posto le route table con e senza la vpn attiva dal client 2
(client VPN)

Vedi..questa e' la tabella di route prima della VPN
=======================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface
Metric
          0.0.0.0          0.0.0.0      10.0.30.254      10.0.30.53
20
        10.0.30.0    255.255.255.0       10.0.30.53      10.0.30.53
20
       10.0.30.53  255.255.255.255        127.0.0.1       127.0.0.1
20
   10.255.255.255  255.255.255.255       10.0.30.53      10.0.30.53
20
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1
1
      169.254.0.0      255.255.0.0       10.0.30.53      10.0.30.53
30
        224.0.0.0        240.0.0.0       10.0.30.53      10.0.30.53
20
  255.255.255.255  255.255.255.255       10.0.30.53               3
1
  255.255.255.255  255.255.255.255       10.0.30.53      10.0.30.53
1
Default Gateway:       10.0.30.254
======================================================
questa dopo la VPN
Active Routes:
Network Destination        Netmask          Gateway       Interface
Metric
          0.0.0.0          0.0.0.0      10.0.30.254      10.0.30.53
20
        10.0.30.0    255.255.255.0       10.0.30.53      10.0.30.53
20
       10.0.30.53  255.255.255.255        127.0.0.1       127.0.0.1
20
   10.255.255.255  255.255.255.255       10.0.30.53      10.0.30.53
20
    81.149.88.109  255.255.255.255      10.0.30.254      10.0.30.53
20
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1
1
      169.254.0.0      255.255.0.0       10.0.30.53      10.0.30.53
30
       172.16.0.0      255.255.0.0       172.16.0.1      172.16.0.1
1
       172.16.0.1  255.255.255.255        127.0.0.1       127.0.0.1
50
   172.16.255.255  255.255.255.255       172.16.0.1      172.16.0.1
50
        224.0.0.0        240.0.0.0       10.0.30.53      10.0.30.53
20
        224.0.0.0        240.0.0.0       172.16.0.1      172.16.0.1
50
  255.255.255.255  255.255.255.255       10.0.30.53      10.0.30.53
1
  255.255.255.255  255.255.255.255       172.16.0.1      172.16.0.1
1
  255.255.255.255  255.255.255.255       172.16.0.1               3
1
Default Gateway:       10.0.30.254
=======================================================
e l idea della route statica mi e' venuta perche' non ho visto nessuna
route per la subnet dietro la VPN...

 proprieta' TCP/IP-> advanced -> disabilita' gatway su remote
network) e inserire una route statica verso la LAN dietro la VPN
attraverso il client VPN del tipo
ROUTE ADD "subnet_lan_vpn" MASK "mask_lan_vpn" "ip_client_vpn" METRIC
10
Questa e' la soluzione a cui sono arrivato..
erny..e' tutto giusto o hai altre idee?

 questa dopo la VPN




ma...@tg26.com
 wrote:






 erny..e' tutto giusto o hai altre idee?
ho gia postato .
ciao.


per il tuo caso puo fungere ma come dici tu, non piace!
consigliami una migliore situazione.. sicuramente la mia e' troppo
approssimativa..
Ciao

 Ciao


 10.0.30.53       20  <========== la vediiiii la 10.255.255.255
prova !
