Newsgroup: it.comp.reti.cisco
Titolo: VPN - configurazione non funzionante

Salve a tutti,
sto cercando di implementare (con un po di fatica) una VPN tra la sede 
centrale (Router cisco 837) e dei portatili di colleghi fuori sede (VPN 
Client 5.0).
tra documenti letti, esempi on line e smanettamenti vari sono arrivato a 
questa configurazione che perň non funziona.
PS.
Le prove le sto facendo da un computer della rete che esce in internet 
tramite il router su cui sto configurando la VPN. č possibile che sia questo 
il problena?
!This is the running config of the router: 192.168.0.18
!----------------------------------------------------------------------------
!version 12.3
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
no logging buffered
enable secret 5 $1$pV9i$lRIc.lTWyoYW4TefzIdYO.
enable password 7 13061E010803
!
username Admin privilege 15 secret 5 $1$q6ya$3/s2WXFLXp6RCQT.OPLHs0
clock timezone PCTime 1
clock summer-time PCTime date Mar 30 2003 2:00 Oct 26 2003 3:00
aaa new-model
!
!
aaa authentication login userlist local
aaa authorization network grouplist local
aaa session-id common
ip subnet-zero
!
!
ip name-server 151.99.5.1
ip name-server 151.99.0.100
ip inspect tcp idle-time 1800
ip inspect tcp finwait-time 10
ip inspect name cbac-name tcp timeout 3600
ip inspect name cbac-name udp timeout 50
ip audit attack action alarm drop reset
ip audit notify log
ip audit po max-events 20
ip audit smtp spam 50
ip audit name ids-name info action alarm
ip audit name ids-name attack action alarm drop reset
ip ssh time-out 30
ip ssh authentication-retries 1
no ftp-server write-enable
no scripting tcl init
no scripting tcl encdir
!
!
!
!
crypto isakmp policy 1
 encr 3des
 authentication pre-share
 group 2
crypto isakmp keepalive 40 5
crypto isakmp nat keepalive 20
!
crypto isakmp client configuration group cisco
 key cisco
 pool vpn_pool
 acl 120
!
!
crypto ipsec transform-set ipsec_vpn esp-3des esp-sha-hmac
!
crypto dynamic-map dynmap 1
 set transform-set ipsec_vpn
!
!
crypto map vpn_map client authentication list userlist
crypto map vpn_map isakmp authorization list grouplist
crypto map vpn_map client configuration address respond
crypto map vpn_map 20 ipsec-isakmp dynamic dynmap
!
!
!
!
interface Ethernet0
 ip address 192.168.0.18 255.255.255.0 secondary
 ip address 88.49.x.x 255.255.255.248
 ip nat inside
 hold-queue 100 out
!
interface ATM0
 no ip address
 no atm ilmi-keepalive
 dsl operating-mode auto
!
interface ATM0.1 point-to-point
 ip address 88.45.y.y 255.255.255.252
 ip nat outside
 ip audit ids-name in
 pvc 8/35
  encapsulation aal5snap
 !
 crypto map vpn_map
!
interface FastEthernet1
 no ip address
 duplex auto
 speed auto
!
interface FastEthernet2
 no ip address
 duplex auto
 speed auto
!
interface FastEthernet3
 no ip address
 duplex auto
 speed auto
!
interface FastEthernet4
 no ip address
 duplex auto
 speed auto
!
ip local pool vpn_pool 192.168.2.1 192.168.2.10
ip nat pool net-ibs 88.49.x.x 88.49.x.x netmask 255.255.255.248
ip nat inside source list 1 pool net-ibs overload
ip nat inside source route-map nonat interface ATM0.1 overload
ip classless
ip route 0.0.0.0 0.0.0.0 ATM0.1
ip http server
ip http secure-server
!
!
access-list 1 permit 192.168.0.0 0.0.0.255
access-list 101 permit tcp 192.168.0.0 0.0.0.255 any
access-list 101 permit udp 192.168.0.0 0.0.0.255 any
access-list 101 permit icmp 192.168.0.0 0.0.0.255 any
access-list 101 deny   ip any any log
access-list 103 permit esp any any
access-list 103 permit udp any any eq isakmp
access-list 103 permit udp any any eq non500-isakmp
access-list 103 permit ip 192.168.2.0 0.0.0.255 192.168.0.0 0.0.0.255
access-list 103 permit icmp any 88.45.y.y 0.0.0.3 unreachable
access-list 103 permit icmp any 88.45.y.y 0.0.0.3 echo-reply
access-list 103 permit icmp any 88.45.y.y 0.0.0.3 packet-too-big
access-list 103 permit icmp any 88.45.y.y 0.0.0.3 time-exceeded
access-list 103 permit icmp any 88.45.y.y 0.0.0.3 traceroute
access-list 103 permit icmp any 88.45.y.y 0.0.0.3 
administratively-prohibited
access-list 103 permit icmp any 88.45.y.y 0.0.0.3 echo
access-list 103 deny   ip any any log
access-list 120 permit ip 192.168.0.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 150 deny   ip 192.168.2.0 0.0.0.255 192.168.0.0 0.0.0.255
access-list 150 deny   ip 192.168.0.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 150 permit ip 192.168.11.168 0.0.0.7 any
route-map nonat permit 10
 match ip address 150
!
!
control-plane
!
!
line con 0
 no modem enable
 transport preferred all
 transport output all
line aux 0
 transport preferred all
 transport output all
line vty 0 4
 exec-timeout 120 0
 password 7 05080F1C2243
 length 0
 transport preferred all
 transport input all
 transport output all
!
scheduler max-task-time 5000
!
end
Grazie a tutti per la pazienza 

Mi sono dimenticato di chiedervi un'altra cosa, la username e la password 
per stabilire le connessioni (tunnel) sono diverse da quelle per accedere al 
file server (windows 2003) della rete locale?
"Waran" <waran@libero_No.Spam_.it> ha scritto nel messaggio 
news:4822cce9$1...@newsgate.x-privat.org...
