Newsgroup: it.comp.reti.cisco
Titolo: Gateway-to-Gateway with L2TP/IPSEC and Win2K

If this is not the right group please advise where I should post.
We have a Win2K gateway-to-gateway environment using certificate based
L2TP/IPSEC tunnels over the Internet. We need to introduce some Cisco
devices at business units. We have successfully created pure-IPSec tunnels
using pre-shared keys between the Cisco devices and the Win2K server.
However, the customer wishes to use L2TP/IPSEC pre-shared key
gateway-to-gateway tunnels between the Win2K and Cisco devices. Our Cisco
engineer has not been able to get this to work, although it is supposed to
be a supported configuration. The Win2K side of things is easy. We are
having difficulties in configuring the Cisco side. I had a look at the Cisco
site, but could not find anything that clearly indicated how to implement
this solution. Could anyone point me in the right direction?



Hi Tim,
I have tested the following configuration, in order to form an
IPSec tunnel with pre-shared keys to join 2 private networks: a private
network (192.168.1.X) inside a Cisco 3640 and a private network
(192.168.30.X) inside the Microsoft 2K Server. 
3640 Configuration:
!
version 12.1
no service single-slot-reload-enable
service timestamps
debug uptime
service timestamps log uptime
no service password-encryption
!
hostname 3640_ipsec
!
logging rate-limit console 10 except errors
!
ip subnet-zero
!
no ip finger
!
ip audit notify log
ip audit po max-
events 100
!
crypto isakmp policy 1
!--- The following are IOS defaults
so they do not appear:
!--- IKE encryption method
encryption des
!---
IKE hashing
hash sha
!--- Diffie-Hellman group
group 1
!---
Authentication method
authentication pre-share
!--- IKE lifetime
lifetime 28800
!--- encryption peer
crypto isakmp key cisco123 address
'win2k connected to 3640'
!
!--- The following is the IOS default so it
does not appear:
!--- IPSec lifetime
crypto ipsec security-association
lifetime seconds 3600
!
!--- IPSec transforms
crypto ipsec transform-set
rtpset esp-des esp-md5-hmac 
!
crypto map rtp 1 ipsec-isakmp 
!---
Encryption peer
set peer 'win2k connected to 3640'
set transform-set
rtpset 
!--- Source/Destination networks defined
match address 115
!
call rsvp-sync
!
interface Ethernet0/0
ip address 192.168.1.1
255.255.255.0
ip nat inside
half-duplex
!
interface Ethernet0/1
ip
address '3640 connected to win2k' 255.255.255.240
ip nat outside
half-
duplex
crypto map rtp
!
ip nat pool INTERNET '3640 connected to win2k'
'3640 connected to win2k' netmask 255.255.255.240
ip nat inside source
route-map nonat pool INTERNET
ip classless
ip route 0.0.0.0 0.0.0.0
'win2k connected to 3640' 
no ip http server
!
access-list 101 deny ip
192.168.1.0 0.0.0.255 192.168.30.0 0.0.0.255
access-list 101 permit ip
192.168.1.0 0.0.0.255 any
!--- Source/Destination networks defined
access-list 115 permit ip 192.168.1.0 0.0.0.255 192.168.30.0 0.0.0.255
access-list 115 deny ip 192.168.1.0 0.0.0.255 any
route-map nonat permit
10
match ip address 101
!
line con 0
transport input none
line aux 0
line vty 0 4
!
end
You can find a good tutorial for configuring the
Win2k Server at:
http://support.microsoft.com/support/kb/articles/Q252/7/35.ASP
I hope
that info it is useful for your work.
Cheers
Faby
--------------------------------
Inviato via 
http://usenet.iol.it
 

 wrote in message
news:192Z106Z52Z2Y1...@usenet.iol.it...
