Newsgroup: it.comp.reti.cisco
Titolo: VPN TRA DUE 827: HELP!

ciao a tutti sto provando a creare la mia prima VPN tra due Cisco 827 con
Ios 12.3.7.T1 applicando una crypto-map in Des su un Tunnel GRE già
esistente tra le due sedi. La configurazione della Vpn è tratta da vari
link che mi sono studiato sul sito Cisco, ma evidentemente sbaglio
qualcosa...
posto le configurazioni, tenete conto che quella dell'altro è speculare,
spero possiate aiutarmi sono abbastanza disperato :-(
Current configuration : 5453 bytes
!
version 12.3
no service pad
service tcp-keepalives-in
service timestamps debug uptime
service timestamps log uptime
service password-encryption
no service dhcp
!
hostname GW-********
!
boot-start-marker
boot-end-marker
!
logging buffered 10000 informational
no logging console
enable secret ****************
!
username ***** password ***********************
no aaa new-model
ip subnet-zero
no ip domain lookup
ip domain name ***********
ip name-server 151.99.125.2
ip name-server 212.110.0.162
!
!
ip inspect name FW cuseeme timeout 3600
ip inspect name FW ftp timeout 3600
ip inspect name FW rcmd timeout 3600
ip inspect name FW realaudio timeout 3600
ip inspect name FW sqlnet timeout 3600
ip inspect name FW streamworks timeout 3600
ip inspect name FW tcp timeout 3600
ip inspect name FW tftp timeout 30
ip inspect name FW udp timeout 30
ip inspect name FW icmp timeout 5
ip inspect name FW netshow timeout 3600
ip inspect name FW vdolive timeout 3600
ip inspect name FW esmtp timeout 3600
ip inspect name FW rtsp timeout 3600
ip ssh rsa keypair-name *****
!
!
!
!
!
crypto isakmp policy 1
 authentication pre-share
crypto isakmp key ********** address 81.72.158.xxx
!
!
crypto ipsec transform-set vpn esp-des esp-md5-hmac
!
crypto map vpnmap local-address Ethernet0
crypto map vpnmap 1 ipsec-isakmp
 set peer 81.72.158.xxx
 set transform-set vpn
 match address 129
!
!
!
interface Tunnel1
 ip address 172.16.0.1 255.255.255.252
 ip mtu 1400
 ip nat inside
 tunnel source 81.72.230.xxx
 tunnel destination 81.72.158.xxx
 tunnel key 1
 crypto map vpnmap
!
interface Ethernet0
 ip address 81.72.230.xxx 255.255.255.248 secondary
 ip address 192.168.4.100 255.255.255.0
 no ip proxy-arp
 ip nat inside
 no ip mroute-cache
 no cdp enable
 crypto map vpnmap
 hold-queue 100 out
!
interface ATM0
 no ip address
 no ip route-cache
 no atm ilmi-keepalive
 dsl operating-mode auto
 hold-queue 224 in
!
interface ATM0.1 point-to-point
 ip address 81.72.230.xxx 255.255.255.252
 ip access-group 125 in
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat outside
 ip inspect FW out
 no ip route-cache
 no ip mroute-cache
 crypto map vpnmap
 pvc 8/35
  encapsulation aal5snap
 !
!
ip classless
ip route 0.0.0.0 0.0.0.0 ATM0.1
ip route 10.0.0.0 255.255.255.0 Tunnel1 permanent
no ip http server
no ip http secure-server
ip nat inside source list 10 interface ATM0.1 overload
ip nat inside source static tcp 192.168.4.100 22 81.72.230.xxx 22
extendable
!
!
access-list 5 remark *** ACCESSO REMOTO ***
access-list 5 permit *********
access-list 5 permit *********
access-list 5 permit 212.90.24.0 0.0.0.31
access-list 5 permit 192.168.4.0 0.0.0.255
access-list 10 remark *** RETE LOCALE ***
access-list 10 permit 192.168.4.0 0.0.0.255
access-list 125 remark *** TUNNEL ***
access-list 125 permit ip 10.0.0.0 0.0.0.255 any
access-list 125 permit ip host 172.16.0.2 any
access-list 125 permit ip host 81.72.158.xxx any
access-list 125 permit ip 81.72.158.xxx 0.0.0.7 any
access-list 125 remark *** FILTRI ANTI-SPOOFING ***
access-list 125 deny   ip 127.0.0.0 0.255.255.255 any
access-list 125 deny   ip 10.0.0.0 0.255.255.255 any
access-list 125 deny   ip 172.16.0.0 0.15.255.255 any
access-list 125 deny   ip 192.168.0.0 0.0.255.255 any
access-list 125 deny   ip 224.0.0.0 0.255.255.255 any
access-list 125 deny   ip host 0.0.0.0 any
access-list 125 deny   ip host 255.255.255.255 any
access-list 125 remark *** ACCESSO ***** ***
access-list 125 permit ip ************* any
access-list 125 permit ip host *************** any
access-list 125 permit ip host *************** any
access-list 125 remark *** ICMP ***
access-list 125 deny   icmp any any unreachable
access-list 125 deny   icmp any any redirect
access-list 125 permit icmp any any
access-list 125 remark *** FINE ACL ***
access-list 129 permit ip 192.168.4.0 0.0.0.255 10.0.0.0 0.0.0.255
no cdp run
!
!
control-plane
!
banner motd ^C
^C
!
line con 0
 exec-timeout 15 0
 login local
 transport preferred all
 transport output all
 stopbits 1
line vty 0 4
 access-class 5 in
 exec-timeout 15 0
 login local
 transport preferred ssh
 transport input ssh
 transport output ssh
!
scheduler max-task-time 5000
scheduler interval 500
!
end
Current configuration : 5846 bytes
!
version 12.3
no parser cache
no service pad
service timestamps debug uptime
service timestamps log uptime
service password-encryption
no service dhcp
!
hostname GW-*****
boot-start-marker
boot-end-marker
!
logging buffered 10000 informational
no logging rate-limit
no logging console
enable secret ***********
!
username **************** password ************
ip subnet-zero
ip tftp source-interface Ethernet0
no ip domain lookup
!
!
ip inspect name FW cuseeme timeout 3600
ip inspect name FW ftp timeout 3600
ip inspect name FW rcmd timeout 3600
ip inspect name FW realaudio timeout 3600
ip inspect name FW sqlnet timeout 3600
ip inspect name FW streamworks timeout 3600
ip inspect name FW tcp timeout 3600
ip inspect name FW tftp timeout 30
ip inspect name FW udp timeout 30
ip inspect name FW icmp timeout 5
ip inspect name FW netshow timeout 3600
ip inspect name FW vdolive timeout 3600
ip inspect name FW esmtp timeout 3600
ip inspect name FW rtsp timeout 3600
!
!
!
!
!
crypto isakmp policy 1
 authentication pre-share
crypto isakmp key ************ address *************
!
!
crypto ipsec transform-set vpn esp-des esp-md5-hmac
!
crypto map vpnmap local-address Ethernet0
crypto map vpnmap 1 ipsec-isakmp
 set peer 81.72.230.xxx
 set transform-set vpn
 match address 129
!
!
!
interface Tunnel1
 ip address 172.16.0.2 255.255.255.252
 ip mtu 1400
 ip nat inside
 tunnel source 81.72.158.xxx
 tunnel destination 81.72.230.xxx
 tunnel key 1
 crypto map vpnmap
!
interface Ethernet0
 ip address 10.0.0.254 255.255.255.0
 ip nat inside
 no cdp enable
 crypto map vpnmap
 hold-queue 32 in
 hold-queue 100 out
!
interface ATM0
 no ip address
 no ip route-cache
 no ip mroute-cache
 no atm ilmi-keepalive
 bundle-enable
 dsl operating-mode auto
 hold-queue 224 in
 pvc 0/16 ilmi
 !
!
interface ATM0.1 point-to-point
 ip address 81.72.158.xxx 255.255.255.252
 ip access-group 125 in
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat outside
 ip inspect FW out
 no ip route-cache
 no ip mroute-cache
 crypto map vpnmap
 pvc 8/35
  vbr-nrt 640 640
  encapsulation aal5snap
 !
!
ip classless
ip route 0.0.0.0 0.0.0.0 ATM0.1
ip route 192.168.4.0 255.255.255.0 Tunnel1 permanent
no ip http server
no ip http secure-server
ip nat pool CLIENT 81.72.158.xxx 81.72.158.xxx netmask 255.255.255.248
ip nat inside source list 110 pool CLIENT overload
ip nat inside source static 10.0.0.254 81.72.158.xxx
ip nat inside source static 10.0.0.250 81.72.158.xxx
!
!
access-list 5 remark *** ACCESS-CLASS TELNET ***
access-list 5 permit *********
access-list 5 permit ********
access-list 5 permit *********
access-list 5 permit 212.90.24.0 0.0.0.31
access-list 5 permit 10.0.0.0 0.0.0.255
access-list 5 permit **************
access-list 110 permit ip 10.0.0.0 0.0.0.255 any
access-list 125 remark *** TUNNEL ***
access-list 125 permit ip 192.168.4.0 0.0.0.255 any
access-list 125 permit ip host 172.16.0.1 any
access-list 125 permit ip host 81.72.230.xxx any
access-list 125 permit ip 81.72.230.xxx 0.0.0.7 any
access-list 125 remark *** FILTRI ANTI-SPOOFING ***
access-list 125 deny   ip host 0.0.0.0 any
access-list 125 deny   ip host 255.255.255.255 any
access-list 125 deny   ip 127.0.0.0 0.255.255.255 any
access-list 125 deny   ip 10.0.0.0 0.255.255.255 any
access-list 125 deny   ip 172.16.0.0 0.15.255.255 any
access-list 125 deny   ip 192.168.0.0 0.0.255.255 any
access-list 125 deny   ip 224.0.0.0 31.255.255.255 any
access-list 125 remark *** FILTRI ACCESSO DA ********** ***
access-list 125 permit ip ********** any
access-list 125 permit ip host ********** any
access-list 125 permit ip host ********** any
access-list 125 remark *** FILTRI NAVIGAZIONE ***
access-list 125 permit tcp any any gt 1023 established
access-list 125 permit udp any eq domain any gt 1023
access-list 125 permit tcp any eq ftp-data any gt 1023
access-list 125 permit tcp any eq ftp any gt 1023
access-list 125 remark *** FILTRO ICMP ***
access-list 125 deny   icmp any any unreachable
access-list 125 deny   icmp any any redirect
access-list 125 permit icmp any any
access-list 125 remark *** FINE ACCESS-LIST ***
access-list 129 permit ip 10.0.0.0 0.0.0.255 192.168.4.0 0.0.0.255
no cdp run
!
!
control-plane
!
banner motd ^CC
^C
!
line con 0
 exec-timeout 0 0
 login local
 transport preferred all
 transport output all
 stopbits 1
line vty 0 4
 access-class 5 in
 exec-timeout 15 0
 login local
 transport preferred ssh
 transport input ssh
 transport output ssh
!
scheduler max-task-time 5000
scheduler interval 500
!
end
facendo debug crypto engine ottengo questo:
03:55:41: %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Quick mode failed
with peer at 81.72.230.xxx
04:00:11: CryptoEngine0: generating alg parameter for connid 1
04:00:11: CRYPTO_ENGINE: Dh phase 1 status: 0
04:00:11: CRYPTO_ENGINE: Dh phase 1 status: OK
04:00:12: CryptoEngine0: generating alg parameter for connid 0
04:00:12: CryptoEngine0: calculate pkey hmac for conn id 1
04:00:12: CryptoEngine0: create ISAKMP SKEYID for conn id 1
04:00:12: CryptoEngine0: generate hmac context for conn id 1
04:00:41: CryptoEngine0: generating alg parameter for connid 2
04:00:41: CRYPTO_ENGINE: Dh phase 1 status: 0
04:00:41: CRYPTO_ENGINE: Dh phase 1 status: OK
04:00:42: CryptoEngine0: generating alg parameter for connid 0
04:00:42: CryptoEngine0: calculate pkey hmac for conn id 2
04:00:42: CryptoEngine0: create ISAKMP SKEYID for conn id 2
04:00:42: CryptoEngine0: generate hmac context for conn id 2
-- 
questo articolo e` stato inviato via web dal servizio gratuito 
http://www.newsland.it/news
 segnala gli abusi ad 
ab...@newsland.it

 access-list 125 permit tcp any eq ftp any gt 1023
ah queste righe appartengono alla configurazione del secondo router,
tenete conto che le ho levate (essendo installato sulla macchina uno Ios
con Firewall).
grazie di nuovo


Ho risolto: fondamentalmente era il fatto che dichiaravo crypto "map
vpnmap local-address Ethernet0" quando avrebbe dovuto essere "crypto map
vpnmap local-address atm0.1"


Ho risolto: fondamentalmente era il fatto che dichiaravo crypto "map
vpnmap local-address Ethernet0" quando avrebbe dovuto essere "crypto map
vpnmap local-address atm0.1"
-- 
