Newsgroup: it.comp.reti.cisco
Titolo: 827-vpn-nat

Ciao a tutti,
ho un problema nel configurare la vpn su un 827 con ADSL di
interbusiness.
Ritengo che tutto dipenda dal fatto che il router ha un pool di ip
pubblici, ai quali debbo affiancare un pool di ip per la vpn.
Alla fine di molte prove, riuscivo a pingare via vpn i pc interni ma poi
non riuscivo a fare altro. Guardando con "show access-list" mi sono
accorto che la ACL messa sulla "crypto isakmp client..." non viene
usata. Usa sempre e solo le due ACL messe sulle interfaccie interna e
adsl. Credo che quindi vi sia un conflitto tra i due pool di IP.
Questa č la conf, la versione dell'IOS l'ho aggiornata all'ultima
possibile la "12.2(15)T17"
version 12.2
...
!
aaa authentication login userauthen local
aaa authorization network groupauthor local
aaa session-id common
ip subnet-zero
no ip source-route
no ip domain lookup
ip name-server 151.99.125.2
ip name-server 151.99.125.3
!
no ip bootp server
ip inspect name testrules tcp
...
!
!
crypto isakmp policy 1
 encr 3des
 authentication pre-share
 group 2
crypto isakmp nat keepalive 20
!
crypto isakmp client configuration group <gruppo>
 key <key>
 dns <dns-interno>
 wins <wins>
 domain <dom-interno>
 pool ippool
 acl 108
!
crypto ipsec transform-set newset esp-3des esp-sha-hmac
!
crypto dynamic-map dynmap 10
 set transform-set newset
 reverse-route
!
crypto map clientmap client authentication list userauthen
crypto map clientmap isakmp authorization list groupauthor
crypto map clientmap client configuration address respond
crypto map clientmap 10 ipsec-isakmp dynamic dynmap
!
interface Loopback1
 ip address 82.184.XXX.XXX 255.255.255.248
 ip nat outside
!
interface Ethernet0
 ip address 10.0.0.2 255.255.255.0
 ip access-group 101 in
 no ip redirects
 no ip unreachables
 ip accounting access-violations
 ip nat inside
 no ip mroute-cache
 no cdp enable
 hold-queue 100 out
!
interface ATM0
 no ip address
 no ip redirects
 no ip unreachables
 ip accounting access-violations
 ip nat outside
 no ip mroute-cache
 no atm ilmi-keepalive
 bundle-enable
 dsl operating-mode auto
 hold-queue 224 in
!
interface ATM0.35 point-to-point
 bandwidth 1280
 ip address 82.188.XX.XX 255.255.255.252
 ip access-group 105 in
 no ip redirects
 no ip unreachables
 ip accounting access-violations
 ip nat outside
 ip inspect testrules out
 no ip mroute-cache
 pvc 8/35
  encapsulation aal5snap
 !
 crypto map clientmap
!
ip local pool ippool 10.0.1.101 10.0.1.200
ip nat pool miopool 82.184.XXX.242 82.184.XXX.247 prefix-length 29
ip nat inside source list 102 pool miopool overload
ip nat inside source static tcp 10.0.0.4 80 82.184.XXX.244 80 extendable
ip nat inside source static tcp 10.0.0.124 80 82.184.XXX.242 8282
extendable
ip classless
ip route 0.0.0.0 0.0.0.0 ATM0.35
no ip http server
no ip http secure-server
!
!
logging facility local6
logging 10.0.0.100
access-list 101 permit ip any any
access-list 101 permit esp any any
access-list 101 permit ahp any any
access-list 101 permit udp any any eq isakmp
access-list 101 permit udp any any eq non500-isakmp
access-list 102 remark ----------------------------------------
access-list 102 deny   ip 10.0.0.0 0.0.0.255 10.0.1.0 0.0.0.255
access-list 102 permit ip any any
access-list 105 permit udp any any eq isakmp
access-list 105 permit udp any any eq non500-isakmp
access-list 105 permit esp any any
access-list 105 permit ahp any any
access-list 105 permit icmp host 82.188.XXX.XXX any
access-list 105 permit ip 10.0.1.0 0.0.0.255 any log
access-list 105 permit ip 10.0.0.0 0.0.0.255 10.0.1.0 0.0.0.255 log
access-list 105 permit ip host 82.188.XXX.XXX 10.0.1.0 0.0.0.255 log
access-list 105 permit tcp host xxx.xxx.xxx.xxx host 82.184.228.244 eq
www log
access-list 105 permit tcp host yyy.yyy.yyy.yyy host 82.184.228.242 eq
8282
access-list 105 permit tcp host 217.xxx.xxx.xxx any eq ident
access-list 105 deny   ip any any log
access-list 108 remark Split tunnel
access-list 108 permit ip 10.0.0.0 0.0.0.255 10.0.1.0 0.0.0.255
no cdp run
-- 
Posted via Mailgate.ORG Server - 
http://www.Mailgate.ORG

Ciao a tutti,




access-list 105 permit tcp host xxx.xxx.xxx.xxx host 82.184.XXX.244 eq
www log
access-list 105 permit tcp host yyy.yyy.yyy.yyy host 82.184.XXX.242 eq
8282
access-list 105 permit tcp host 217.xxx.xxx.xxx any eq ident
access-list 105 deny   ip any any log
access-list 108 remark Split tunnel
access-list 108 permit ip 10.0.0.0 0.0.0.255 10.0.1.0 0.0.0.255
no cdp run
-- 
EMondini 
------------------------------------------------------------------------
View this thread: 
http://www.itsistemi.net/viewtopic-715762.html
Inviato via 
http://www.itsistemi.net