Newsgroup: it.comp.reti.cisco
Titolo: Problema con Site-to-Site VPN

Salve,
ho un problema con una vpn site-to-site con un PIX 506E.
Funziona tutto.
l'unica cosa che non capisco � perch� non mi passa il PING e tutto il
traffico ICMP.
Se io da un pc di SEDE A pingo un PC di SEDE B mi da richiesta scaduta e
vicerversa uguale.
Se invece utilizzo un qualsiasi protocollo tipo RDC,DNS,SMTP o altro sia TCP
che UDP tutto funziona.
Solo i pacchetti ICMP non passano.
La configurazione � :
access-list inside_outbound_nat0_acl permit ip SEDE_LAN 255.255.255.0
SERVER_FARM_LAN 255.255.255.0
access-list outside_cryptomap_20 permit ip SEDE_LAN 255.255.255.0
SERVER_FARM_LAN 255.255.255.0
Dove sbaglio?
Grazie mille a chi mi illuminer�! :-)
--------------------------------
Inviato via 
http://arianna.libero.it/usenet/


Le due righe che hai postato SEMBRANO corrette - prova a postare la
configurazione completa

:
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
!
hostname pixfw
!
access-list inside_access_in permit tcp SEDE_LAN 255.255.255.0 any log
access-list inside_access_in permit udp SEDE_LAN 255.255.255.0 any log
access-list outside_access_in permit tcp any host BACKFRAME_PUB eq www log
access-list outside_access_in permit tcp any host BACKFRAME_PUB eq smtp log
access-list outside_access_in permit tcp any host BACKFRAME_PUB range
ftp-data ftp log
access-list outside_access_in permit tcp any host BACKFRAME_PUB eq 32000 log
access-list inside_nat0_outbound permit ip SEDE_LAN 255.255.255.0
SERVER_FARM_LAN 255.255.255.0
access-list outside_cryptomap_20 permit ip SEDE_LAN 255.255.255.0
SERVER_FARM_LAN 255.255.255.0
pager lines 24
logging on
logging timestamp
logging standby
logging trap informational
logging history informational
logging device-id hostname
icmp permit SERVER_FARM_LAN 255.255.255.0 outside
icmp permit SEDE_LAN 255.255.255.0 inside
!
ip audit info action alarm
ip audit attack action alarm
pdm location BACKFRAME 255.255.255.255 inside
pdm location SEDE_LAN 255.255.255.0 inside
pdm location BACKFRAME_PUB 255.255.255.255 outside
pdm location SERVER_FARM_LAN 255.255.255.0 outside
pdm logging warnings 100
pdm history enable
arp timeout 14400
global (outside) 1 151.11.100.115
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 SEDE_LAN 255.255.255.0 0 0
static (inside,outside) BACKFRAME_PUB BACKFRAME netmask 255.255.255.255 0 0
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 151.11.100.113 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225
1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
aaa authentication http console LOCAL
aaa authentication ssh console LOCAL
aaa authentication telnet console LOCAL
http server enable
http SERVER_FARM_LAN 255.255.255.0 outside
http SEDE_LAN 255.255.255.0 inside
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto map outside_map 20 ipsec-isakmp
crypto map outside_map 20 match address outside_cryptomap_20
crypto map outside_map 20 set peer XXX.XXX.XXX.XXX
crypto map outside_map 20 set transform-set ESP-DES-SHA
crypto map outside_map interface outside
isakmp enable outside
isakmp key ******** address XXX.XXX.XXX.XXX netmask 255.255.255.255 no-xauth
no-config-mode
isakmp identity address
isakmp nat-traversal 20
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption des
isakmp policy 20 hash sha
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
telnet SERVER_FARM_LAN 255.255.255.0 outside
telnet SEDE_LAN 255.255.255.0 inside
management-access inside
!
!

--------------------------------
Inviato via 
http://arianna.libero.it/usenet/

Mipare che vada aggiunta una riga di ACL
access-list outside_access_in permit icmp any any echo-reply


--------------------------------
Inviato via 
http://arianna.libero.it/usenet/

ICMP e IP son due cose un bel po' diverse... 


--------------------------------
Inviato via 
http://arianna.libero.it/usenet/

 
Se permetti l'ip passa anche icmp . Ho queste regole sul mio fw e non ho 
blocchi su icmp.
Ci sono altri apparati tra src e dst che possono bloccare l'icmp?
Kate