Newsgroup: it.comp.reti.cisco
Titolo: backup ISDN x VPN

--------2600__HDSL__________________ADSL__1700---------
          |                                 | 
          |-----Backup IPSec over ISDN------| 
Per avere la ISDN come linea di backup per la VPN voglio usare :
EIGRP + tunnel + dialer watch
Ho pero' dei dubbi :
creo le int di loopback
creo le int per il tunnel che applico alle int loopback del primo e del 
secondo router
applico le crypto map alle int tunnel
Giusto ?
Adesso L'eigrp gira sul tunnel GRE, ma come fa a sapere un router come 
raggiungere l'int di loopback dell'altro router per fare il tunnel, con 
una route statica ? con una di default ?
Ma se fosse cosi' lo stesso ind ip lo devo avere sia sulla int per 
l'HDSL/ADSL che su quella per la ISDN per avere una default route ?
Per la ISDN devo avere un ip fisso ?
posto la conf di uno dei due router  ( l'altra e' simmetrica ):
router A 2610
Current configuration:
version 12.1
service timestamps debug uptime
service timestamps log uptime
service password-encryption
no service tcp-small-servers
no service udp-small-servers
!
hostname Cisco2610
!
enable password xxxxxx
!
ip source-route
no ip name-server
!
isdn switch-type basic-net3
!
ip subnet-zero
no ip domain-lookup
ip routing
!
! Internet Key Exchange (IKE)
!
crypto isakmp enable
crypto isakmp identity address
!
crypto isakmp policy 1
 encryption 3des
 hash md5
 authentication pre-share
 group 2
 lifetime 86400
crypto isakmp key vpnkey address 192.168.254.5
!
! IPSec
!
crypto ipsec transform-set mytransformset1 ah-md5-hmac esp-3des esp-md5-
hmac
crypto map mycryptomap local-address tunnel 0
!
crypto map mycryptomap 1 ipsec-isakmp
 match address 100
 set transform-set mytransformset1
 set security-association lifetime seconds 3600
 set security-association lifetime kilobytes 4608000
 set peer 192.168.254.5
!
interface Dialer 1
 description Backup ISDN Dialer interface
 crypto map mycryptomap
 ip address negotiated
 ip nat outside
 no ip route-cache
 ip inspect DIALER in
 ip access-group 103 in
 no ip split-horizon
 encapsulation ppp
 dialer in-band
 dialer idle-timeout 120
 dialer string 
7023456789
 dialer hold-queue 10
 dialer-group 1
 ppp authentication chap pap callin
 ppp chap hostname xxxxxxx
 ppp chap password xxxxxxx
 ppp pap sent-username xxxxxxxx password xxxxxxxx
 no ppp multilink
 no cdp enable
!
interface Ethernet 0/0
 no shutdown
 description connected to Internal LAN
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
 ip inspect LAN in
 ip access-group 101 in
 keepalive 10
!
interface BRI 0/0
 no shutdown
 description Backup ISDN interface
 no ip address
 dialer rotary-group 1
!
interface Ethernet 1/0
 no shutdown
 description connected to DMZ
 ip address 80.120.115.9 255.255.255.248
 ip access-group 102 in
 keepalive 10
!
interface Serial 0/0
 bandwidth 1536
 no shutdown
 description HDSL Interbusiness
 no ip address
 encapsulation frame-relay IETF
 no ip route-cache 
 no ip mroute-cache 
 no ip proxy-arp
 no fair-queue
 no cdp enable
 frame-relay lmi-type cisco
!
interface Serial 0/0.1 point-to-point
 bandwidth 1536
 no shutdown
 description connected to Internet - PVC verso Interbusiness
 crypto map mycryptomap
 ip address 80.120.115.18 255.255.255.252
 ip nat outside
 no ip redirects
 no ip unreachables
 no ip route-cache
 no ip mroute-cache
 no ip proxy-arp
 no fair-queue
 ip inspect WAN in
 ip access-group 104 in
 no cdp enable
 frame-relay interface-dlci 50 IETF
!
interface Serial 0/1
 no description
 no ip address
 shutdown
!
interface loopback0
 ip address 10.2.2.2 255.255.255.0
!
interface tunnel 0
 description Tunnel GRE verso Router Roma
 ip address 192.168.254.6 255.255.255.252
 tunnel source loopback0
 tunnel destination 10.1.1.1
!
! Access Control List 1
!
access-list 1 permit 192.168.1.0 0.0.0.255
!
! Access Control List 100
!
access-list 100 permit ip host 80.120.115.18 host 80.120.115.21
!
! Access Control List 102
!
no access-list 102
access-list 102 deny ip 192.168.1.0 0.0.0.255 any
access-list 102 permit udp any eq rip any eq rip
!
! Dialer Control List 1
!
no dialer-list 1
dialer-list 1 protocol ip permit
!
! Dynamic NAT
!
ip nat translation timeout 86400
ip nat translation tcp-timeout 86400
ip nat translation udp-timeout 300
ip nat translation dns-timeout 60
ip nat translation finrst-timeout 60
ip nat inside source route-map Serial interface Serial 0/0.1 overload
ip nat inside source route-map Dialer interface Dialer 1 overload
!
!
! Route Maps
!
route-map Serial permit 10
match ip address 1
match interface Serial 0/0.1
route-map Dialer permit 10
match ip address 1
match interface Dialer 1
!
router eigrp
 network 192.168.1.0 0.0.0.255
 network 80.120.115.8 0.0.0.7
 network 10.2.2.0 0.0.0.255
 no auto-summary
 no eigrp log-neighbor-changes
!
!
ip classless
!
! IP Static Routes
ip route 0.0.0.0 0.0.0.0 Serial 0/0.1
ip route 0.0.0.0 0.0.0.0 Dialer 1
no ip http server
snmp-server community public RO
no snmp-server location
no snmp-server contact
!
line console 0
 exec-timeout 0 0
 password xxxxxxx
 login
!
line vty 0 4
 password xxxxxxx
 login
!
end

> creo le int di loopback
Non so se hai voluto mascherare apposta, ma se per le loopback ed i peers
vpn utilizzi degli indirizzi privati non potrà mai funzionare nulla.
Ciao,
        Tosh

 wrote in 
news:2imbefF...@uni-berlin.de
:

scusa il ritardo, ma ho avuto problemi alla connessione internet.
Quindi l'unico modo x far funzionare la cosa e' dare ip publici alle int di 
loopback, giusto ?
Supponiamo che vada giu' l'HDSL/ADSL, il watch dialer tira su la ISDN, le 
int di loop continueranno ad avere l'ip publico assegnatomi da Telecom per 
la connessione HDSL/ADSL, puo creare problemi questo ?
Sulla connessione ISDN devo avere un ip publico fisso o anche dinamico ?
Con ip dinamico si puo' fare lo stesso la VPN ( dinamico da entrambi i lati 
della VPN ? 
In generale quali sono le condizioni migliori in termini di indirizzi ip 
per il link ISDN ? Va bene anche un collegamentoo dialup free ?
Grazie
Ciao

 della VPN ?
No.
Ciao,
        Toshh.