Newsgroup: it.comp.reti.cisco
Titolo: vpn tra 2 hdsl monodirezionale o quasi [LUNGO]

Premetto che di IOS so molto poco...
Scenario:
LAN1->nat->FirewallLinux->cisco1---vpn---cisco2->nat->LAN2
Da lan2 a lan1 funziona perfettamente
Da lan1 a lan2 riesco solo a pingare gli host, ma non ad aprire connessioni
tcp
Stessa cosa se provo direttamente dal firewall linux, ma del resto ho anche
provato a fare un flush delle regole di iptables senza risultati e senza
niente nei log.
Pero' dal cisco1 con telnet RIESCO ad aprire connessioni tcp sulle macchine
della LAN2 (provato su varie porte: pop smtp rdp...). 
Purtroppo non conosco il modello dei due router (sempre se il problema sono
loro) ma allego show version e show run.
Io non so dove sbattere la capoccia, anche perchè non li ho configurati io 
(
CISCO1>show version
Cisco Internetwork Operating System Software
IOS (tm) C805 Software (C805-Y6-MW), Version 12.2(8)T10,  RELEASE SOFTWARE
(fc1)
TAC Support: 
http://www.cisco.com/tac
Copyright (c) 1986-2003 by cisco Systems, Inc.
Compiled Thu 29-May-03 21:49 by kellythw
Image text-base: 0x00180000, data-base: 0x007BA000
ROM: TinyROM version 1.4(1)
barberini uptime is 41 minutes
System returned to ROM by power-on
System image file is "flash:c805-y6-mw.122-8.T10.bin"
Cisco C805  (MPC850) processor (revision 0) with 48128K bytes of virtual
memory.
Processor board ID FOC072604WB (1868743136)
CPU part number 0x2101
Bridging software.
1 Ethernet/IEEE 802.3 interface(s)
1 Serial(sync/async) network interface(s)
8M bytes of physical memory (DRAM)
8K bytes of non-volatile configuration memory
4M bytes of flash on board
Configuration register is 0x2102
CISCO1>show run
Current configuration : 895 bytes
!
version 12.2
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname cisco1
!
enable password xxxxxxx
!
ip subnet-zero
!
!
!
!
interface Tunnel0
 ip address 192.168.254.1 255.255.255.252
 tunnel source Ethernet0
 tunnel destination 85.37.x.x
 tunnel mode nos
!
interface Ethernet0
 ip address 217.141.y.y 255.255.255.248
!
interface Serial0
 no ip address
 encapsulation frame-relay
 frame-relay lmi-type cisco
!
interface Serial0.1 point-to-point
 ip address 80.17.z.z 255.255.255.252
 frame-relay interface-dlci 401 IETF
!
ip classless
ip route 0.0.0.0 0.0.0.0 80.17.z.z
ip route 192.168.10.0 255.255.255.0 217.141.y.w !questo è il firewall linux
ip route 192.168.20.0 255.255.255.0 192.168.254.2
ip http server
ip pim bidir-enable
!
!
snmp-server community public RO
!
line con 0
 stopbits 1
line vty 0 4
 password xxxxxx
 login
!
end
CISCO2>show version 
Cisco Internetwork Operating System Software
IOS (tm) C805 Software (C805-Y6-MW), Version 12.2(8)T10,  RELEASE SOFTWARE
(fc1)
TAC Support: 
http://www.cisco.com/tac
Copyright (c) 1986-2003 by cisco Systems, Inc.
Compiled Thu 29-May-03 21:49 by kellythw
Image text-base: 0x00180000, data-base: 0x007BA000
ROM: TinyROM version 1.4(1)
barberini2 uptime is 38 minutes
System returned to ROM by power-on
System image file is "flash:c805-y6-mw.122-8.T10.bin"
Cisco C805  (MPC850) processor (revision 0) with 48128K bytes of virtual
memory.
Processor board ID FOC074814RF (1268063248)
CPU part number 0x2101
Bridging software.
1 Ethernet/IEEE 802.3 interface(s)
1 Serial(sync/async) network interface(s)
8M bytes of physical memory (DRAM)
8K bytes of non-volatile configuration memory
8M bytes of flash on board (4M from flash card)
Configuration register is 0x2102
CISCO2>show run
Current configuration : 1202 bytes
!
version 12.2
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname cisco2
!
enable password xxxxxxx
!
ip subnet-zero
!
ip name-server 195.120.225.6
!
!
!
interface Loopback0
 ip address 85.37.x.x 255.255.255.248
 ip nat outside
!
interface Tunnel0
 ip address 192.168.254.2 255.255.255.0
 tunnel source Loopback0
 tunnel destination 217.141.y.y
 tunnel mode nos
!
interface Ethernet0
 ip address 192.168.20.254 255.255.255.0
 ip nat inside
!
interface Serial0
 no ip address
 encapsulation frame-relay
 frame-relay lmi-type ansi
!
interface Serial0.1 point-to-point
 ip address 85.37.x.x 255.255.255.252
 ip nat outside
 frame-relay interface-dlci 166 IETF
!
ip nat inside source list 101 interface Loopback0 overload
ip nat inside source static tcp 192.168.3.1 23 85.37.z.z 23 extendable !???
ip classless
ip route 0.0.0.0 0.0.0.0 85.37.254.25
ip route 192.168.10.0 255.255.255.0 192.168.254.1
ip route 192.168.20.0 255.255.255.0 192.168.254.1
ip http server
ip pim bidir-enable
!
!
access-list 101 permit ip any any
snmp-server community public RO
!
line con 0
 stopbits 1
line vty 0 4
 password xxxxx
 login
!
end
Grazie a chi avra' la pazienza di leggersi sto papiro :p

Aggiornamento:
se tolgo il nat sulla lan2 con:
no access-list
tutto funziona perfettamente ma ovviamente i pc di lan2 non navigano :(
Appena la rimetto il router comincia a bloccarele connessioni tcp. Ho
dimenticato di dire che in queste condizioni l'unico sistema di accedere a
cisco2 è facendo un telnet da cisco1 sull'ip della vpn (192.168.254.2);
appena tolgo l'access-list comincia ad accettare connessioni.