Newsgroup: it.comp.reti.cisco
Titolo: VPN pix to pix

Dopo aver smanettato un po' con la configurazione di due Pix 501, finalmente 
il led vicino alla scritta VPN Tunnel si è acceso, ma se dalla rete interna 
15.2.0.0/255.255.255.0
 provo a pingare la rete interna dall'altra parte del 
tunnel (15.3.0.0255.255.255.0) non ricevo risposta.
Ho dimenticato qualcosa ? Ho sbagliato qualcosa ?
Grazie per eventuali suggerimenti !
*********************************
hostname pix-luna
*********************************
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
names
access-list 101 permit ip 15.3.0.0 255.255.255.0 15.2.0.0 255.255.255.0
access-list ipsec permit ip 15.3.0.0 255.255.255.0 15.2.0.0 255.255.255.0
ip address outside 216.210.208.195 255.255.255.248
ip address inside 15.3.0.2 255.255.255.0
global (outside) 1 interface
nat (inside) 0 access-list 101
route outside 0.0.0.0 0.0.0.0 216.210.208.193 1
crypto ipsec transform-set myset esp-3des esp-sha-hmac
crypto map mymap 21 ipsec-isakmp
crypto map mymap 21 match address ipsec
crypto map mymap 21 set peer 216.219.176.187
crypto map mymap 21 set transform-set myset
crypto map mymap interface outside
isakmp enable outside
isakmp key ******** address 216.219.176.187 netmask 255.255.255.255 no-xauth
isakmp identity address
isakmp policy 21 authentication pre-share
isakmp policy 21 encryption 3des
isakmp policy 21 hash sha
isakmp policy 21 group 1
isakmp policy 21 lifetime 1000
*********************************
hostname pix-sole
*********************************
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
names
access-list 101 permit ip 15.2.0.0 255.255.255.0 15.3.0.0 255.255.255.0
access-list ipsec permit ip 15.2.0.0 255.255.255.0 15.3.0.0 255.255.255.0
ip address outside 216.219.176.187 255.255.255.248
ip address inside 15.2.0.2 255.255.255.0
global (outside) 1 interface
nat (inside) 0 access-list 101
route outside 0.0.0.0 0.0.0.0 216.219.176.185 1
crypto ipsec transform-set myset esp-3des esp-sha-hmac
crypto map mymap 21 ipsec-isakmp
crypto map mymap 21 match address ipsec
crypto map mymap 21 set peer 216.210.208.195
crypto map mymap 21 set transform-set myset
crypto map mymap interface outside
isakmp enable outside
isakmp key ******** address 216.210.208.195 netmask 255.255.255.255 no-xauth
isakmp identity address
isakmp policy 21 authentication pre-share
isakmp policy 21 encryption 3des
isakmp policy 21 hash sha
isakmp policy 21 group 1
isakmp policy 21 lifetime 1000
*********************************
pix-luna(config)# show crypto ipsec sa
*********************************
interface: outside
    Crypto map tag: mymap, local addr. 216.210.208.195
   local  ident (addr/mask/prot/port): (
15.3.0.0/255.255.255.0/0/0
)
   remote ident (addr/mask/prot/port): (
15.2.0.0/255.255.255.0/0/0
)
   current_peer: 
216.219.176.187:500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 23, #pkts encrypt: 23, #pkts digest 23
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress 
failed: 0
    #send errors 1, #recv errors 0
     local crypto endpt.: 216.210.208.195, remote crypto endpt.: 
216.219.176.187
     path mtu 1500, ipsec overhead 56, media mtu 1500
     current outbound spi: 8667c300
     inbound esp sas:
      spi: 0x703f7ed1(1883209425)
        transform: esp-3des esp-sha-hmac ,
        in use settings ={Tunnel, }
        slot: 0, conn id: 1, crypto map: mymap
        sa timing: remaining key lifetime (k/sec): (4608000/26488)
        IV size: 8 bytes
        replay detection support: Y
     inbound ah sas:
     inbound pcp sas:
     outbound esp sas:
      spi: 0x8667c300
(2254947072
)
        transform: esp-3des esp-sha-hmac ,
        in use settings ={Tunnel, }
        slot: 0, conn id: 2, crypto map: mymap
        sa timing: remaining key lifetime (k/sec): (4607998/26488)
        IV size: 8 bytes
        replay detection support: Y
     outbound ah sas:
     outbound pcp sas:

 Ho dimenticato qualcosa ? Ho sbagliato qualcosa ?
Mi sa che hai dimenticato un bel "sysopt connection permit-ipsec"
Ciao,
         Tosh. 

 Ciao, Tosh.
Adesso funziona :)
Grazie per avermi dato il giusto suggerimento !