Newsgroup: it.comp.reti.cisco
Titolo: Cisco 1720 easy VPN Server

Salve a tutti
vorrei configurare un 1720 con WIC ADSL con la funzionalità di easy
VPN server.
il client si collega senza nessun problema e dalla rete interna riesco
a pingare il client remoto (pingo l'indirizzo ip assegnato dal router).
Il problema è che se lancio un ping dal client remoto verso un
indirizzo ip interno (PC dietro al 1720) mi risponde l'indirizzo ip
pubblico.
ho seguito questa guida:
http://www.cisco.com/warp/public/cc/so/neso/vpn/ns171/ns27/prodlit/csvzp_cg.pdf
avete un'altra guida da consigliarmi?
grazie a tutti.
Stefano
ecco la configurazione:
aaa authorization network STUDIOPIPPO local
aaa session-id common
ip subnet-zero
ip audit notify log
ip audit po max-events 100
ip ssh break-string
no ftp-server write-enable
crypto isakmp policy 1
 encr 3des
 authentication pre-share
 group 2
crypto isakmp client configuration address-pool local STUDIOPIPPOVPN
crypto isakmp client configuration group STUDIOPIPPO
 key PIPPO
 dns 213.140.2.43 151.99.125.2
 pool STUDIOPIPPOVPN
 acl 199
crypto ipsec transform-set VPNPIPPO esp-3des esp-md5-hmac
crypto dynamic-map VPN 1
 set transform-set VPNPIPPO
 reverse-route
crypto map VPN isakmp authorization list STUDIOPIPPO
crypto map VPN client configuration address respond
crypto map VPN 1 ipsec-isakmp dynamic VPN
interface ATM0
 no ip address
 ip directed-broadcast
 no atm ilmi-keepalive
 dsl operating-mode auto
 hold-queue 224 in
interface ATM0.1 point-to-point
 ip address X.Y.Z.W 255.255.255.252
 ip nat outside
 ip route-cache same-interface
  pvc 8/35
  protocol ip X.Y.Z.254 broadcast
  encapsulation aal5snap
  crypto map VPN
interface FastEthernet0
 ip address 192.168.10.19 255.255.255.0
 ip nat inside
 speed auto
 full-duplex
ip local pool STUDIOPIPPOVPN 192.168.10.1 192.168.10.4
ip nat inside source list 99 interface ATM0.1 overload
ip classless
ip route 0.0.0.0 0.0.0.0 ATM0.1
ip http server
no ip http secure-server
access-list 99 permit any
access-list 199 permit ip any any
snmp-server community public RO
snmp-server enable traps tty


salve a tutti,
sono riuscito a sistemare la config.
magari può servire a qualcuno.
ciao a tutti.
Ste
aaa authorization network STUDIOPIPPO local
aaa session-id common
ip subnet-zero
!
!
!ip audit notify log
ip audit po max-events 100
ip ssh break-string
no ftp-server write-enable
!
crypto isakmp policy 1
 encr 3des
 authentication pre-share
 group 2
crypto isakmp client configuration address-pool local STUDIOPIPPOVPN
!
crypto isakmp client configuration group STUDIOPIPPO
 key pippo
 dns 213.140.2.43 151.99.125.2
 pool STUDIOPIPPOVPN
 acl 199
!
!
crypto ipsec transform-set VPNPIPPO esp-3des esp-md5-hmac
!
crypto dynamic-map VPN 1
 set transform-set VPNPIPPO
 reverse-route
!
!
crypto map VPN isakmp authorization list STUDIOPIPPO
crypto map VPN client configuration address respond
crypto map VPN 1 ipsec-isakmp dynamic VPN
interface ATM0
 no ip address
 ip directed-broadcast
 no atm ilmi-keepalive
 dsl operating-mode auto
 hold-queue 224 in
!
interface ATM0.1 point-to-point
 ip address x.y.z.k 255.255.255.252
 ip nat outside
 ip route-cache same-interface
 pvc 8/35
  protocol ip x.y.z.k broadcast
  encapsulation aal5snap
 !
 crypto map VPN
!
interface FastEthernet0
 ip address 192.168.10.19 255.255.255.0
 ip nat inside
 speed auto
 full-duplex
!
ip local pool STUDIOPIPPOVPN 192.168.10.1 192.168.10.4
ip nat inside source list 101 interface ATM0.1 overload
ip classless
ip route 0.0.0.0 0.0.0.0 ATM0.1
ip http server
no ip http secure-server
access-list 101 deny   ip any 192.168.10.0 0.0.0.255
access-list 101 permit ip any any
access-list 199 permit ip 192.168.10.0 0.0.0.255 any
