Newsgroup: it.comp.reti.cisco
Titolo: problema pix con vpn client

Ho configurato il pix per connessioni dall'esterno con il client vpn cisco
versione 4.5.00.0045
come molti esempi su 
cisco.com
 riportavano, ma il client non si connette e
facendo un debug
mi esce un errore
"debug crypto isakmp
ISAKMP: transform 1, ESP_AES
ISAKMP: attributes in transform:
ISAKMP: authenticator is HMAC-MD5
ISAKMP: key length is 256
ISAKMP: encaps is 1
ISAKMP: SA life type in seconds
ISAKMP: SA life duration (VPI) of 0x0 0x20 0xc4 0x9b
IPSEC(validate_proposal): invalid local address 193.204.89.58
ISAKMP (0): atts not acceptable. Next payload is 0
ISAKMP (0): skipping next ANDed proposal (1)
ISAKMP : Checking IPSec proposal 2 "
su 
cisco.com
 a proposito di questo errore dice:
"Invalid Local Address
This output is an example of the error message.
IPSEC(validate_proposal): invalid local address 12.2.6.2
ISAKMP (0:3): atts not acceptable. Next payload is 0
ISAKMP (0:3): SA not acceptable!
This error message is attributed to one of these two common problems:
The crypto map map-name local-address interface-id command causes the router
to use an incorrect address as the identity because it forces the router to
use a specified address.
Crypto map is applied to the wrong interface or is not applied at all. Check
the configuration in order to ensure that crypto map is applied to the
correct interface."
ma non mi sembra il mio caso ... la crypto map l'ho abilitata sulla
interface outside senza specificare ip come da esempi, di seguito la mia
configurazione:
PIX Version 6.3(4)
.
.
hostname pixfirewall
domain-name 
mydomain.it
.
.
access-list acl_natipsec permit ip 10.246.0.0 255.255.0.0 192.168.20.0
255.255.255.0
.
.
.
ip address outside xxx.xxx.xxx.xxx 255.255.255.0
ip address inside 10.246.0.1 255.255.0.0
.
.
.
ip local pool ippool 192.168.20.10-192.168.20.254
.
.
global (outside) 1 xxx.xxx.xxx.xxx
nat (inside) 0 access-list acl_natipsec
nat (inside) 1 10.246.1.0 255.255.255.0 0 0
nat (dmz1) 0 193.204.89.0 255.255.255.240 0 0
.
.
.
.
.
aaa-server radius-authport 1812
aaa-server radius-acctport 1813
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
aaa-server partnerauth protocol radius
aaa-server partnerauth max-failed-attempts 3
aaa-server partnerauth deadtime 10
aaa-server partnerauth (inside) host 10.246.1.80 **** timeout 5
.
.
sysopt connection permit-ipsec
crypto ipsec transform-set myset esp-des esp-md5-hmac
crypto dynamic-map dynmap 10 set transform-set myset
crypto map mymap 10 ipsec-isakmp dynamic dynmap
crypto map mymap client authentication partnerauth
crypto map mymap interface outside
isakmp enable outside
isakmp identity address
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
vpngroup mygroup address-pool ippool
vpngroup mygroup dns-server xxx.xxx.xxx.xxx
vpngroup mygroup default-domain 
mydomain.it
vpngroup mygroup idle-time 1800
vpngroup mygroup password ********
qualcuno mi sa dire dove sbaglio?
--------------------------------
Inviato via 
http://arianna.libero.it/usenet/


La butto lì...
prova dirgli
crypto map mymap 10 set peer 0.0.0.0 invece che
crypto map mymap 10 ipsec-isakmp dynamic dynmap
Ciao Alex.


 
no ... 0.0.0.0 non č un peer valido ...
