Newsgroup: it.comp.reti.cisco
Titolo: [REPOST] vpn tra 2 hdsl monodirezionale

ci riprovo che magari ho piu fortuna
Scenario:
LAN1->nat->FirewallLinux->cisco1---vpn---cisco2->nat->LAN2
Da lan2 a lan1 funziona perfettamente
Da lan1 a lan2 riesco solo a pingare gli host, ma non ad aprire connessioni
tcp
Stessa cosa se provo direttamente dal firewall linux, ma del resto ho anche
provato a fare un flush delle regole di iptables senza risultati e senza
niente nei log.
Pero' dal cisco1 con telnet RIESCO ad aprire connessioni tcp sulle macchine
della LAN2 (provato su varie porte: pop smtp rdp...).
Purtroppo non conosco il modello dei due router (sempre se il problema sono
loro) ma allego show version e show run.
Io non so dove sbattere la capoccia, anche perchč non li ho configurati io
(
CISCO1>show version
Cisco Internetwork Operating System Software
IOS (tm) C805 Software (C805-Y6-MW), Version 12.2(8)T10,  RELEASE SOFTWARE
(fc1)
TAC Support: 
http://www.cisco.com/tac
Copyright (c) 1986-2003 by cisco Systems, Inc.
Compiled Thu 29-May-03 21:49 by kellythw
Image text-base: 0x00180000, data-base: 0x007BA000
ROM: TinyROM version 1.4(1)
barberini uptime is 41 minutes
System returned to ROM by power-on
System image file is "flash:c805-y6-mw.122-8.T10.bin"
Cisco C805  (MPC850) processor (revision 0) with 48128K bytes of virtual
memory.
Processor board ID FOC072604WB (1868743136)
CPU part number 0x2101
Bridging software.
1 Ethernet/IEEE 802.3 interface(s)
1 Serial(sync/async) network interface(s)
8M bytes of physical memory (DRAM)
8K bytes of non-volatile configuration memory
4M bytes of flash on board
Configuration register is 0x2102
CISCO1>show run
Current configuration : 895 bytes
!
version 12.2
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname cisco1
!
enable password xxxxxxx
!
ip subnet-zero
!
!
!
!
interface Tunnel0
  ip address 192.168.254.1 255.255.255.252
  tunnel source Ethernet0
  tunnel destination 85.37.x.x
  tunnel mode nos
!
interface Ethernet0
  ip address 217.141.y.y 255.255.255.248
!
interface Serial0
  no ip address
  encapsulation frame-relay
  frame-relay lmi-type cisco
!
interface Serial0.1 point-to-point
  ip address 80.17.z.z 255.255.255.252
  frame-relay interface-dlci 401 IETF
!
ip classless
ip route 0.0.0.0 0.0.0.0 80.17.z.z
ip route 192.168.10.0 255.255.255.0 217.141.y.w !questo č il firewall linux
ip route 192.168.20.0 255.255.255.0 192.168.254.2
ip http server
ip pim bidir-enable
!
!
snmp-server community public RO
!
line con 0
  stopbits 1
line vty 0 4
  password xxxxxx
  login
!
end
CISCO2>show version
Cisco Internetwork Operating System Software
IOS (tm) C805 Software (C805-Y6-MW), Version 12.2(8)T10,  RELEASE SOFTWARE
(fc1)
TAC Support: 
http://www.cisco.com/tac
Copyright (c) 1986-2003 by cisco Systems, Inc.
Compiled Thu 29-May-03 21:49 by kellythw
Image text-base: 0x00180000, data-base: 0x007BA000
ROM: TinyROM version 1.4(1)
barberini2 uptime is 38 minutes
System returned to ROM by power-on
System image file is "flash:c805-y6-mw.122-8.T10.bin"
Cisco C805  (MPC850) processor (revision 0) with 48128K bytes of virtual
memory.
Processor board ID FOC074814RF (1268063248)
CPU part number 0x2101
Bridging software.
1 Ethernet/IEEE 802.3 interface(s)
1 Serial(sync/async) network interface(s)
8M bytes of physical memory (DRAM)
8K bytes of non-volatile configuration memory
8M bytes of flash on board (4M from flash card)
Configuration register is 0x2102
CISCO2>show run
Current configuration : 1202 bytes
!
version 12.2
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname cisco2
!
enable password xxxxxxx
!
ip subnet-zero
!
ip name-server 195.120.225.6
!
!
!
interface Loopback0
  ip address 85.37.x.x 255.255.255.248
  ip nat outside
!
interface Tunnel0
  ip address 192.168.254.2 255.255.255.0
  tunnel source Loopback0
  tunnel destination 217.141.y.y
  tunnel mode nos
!
interface Ethernet0
  ip address 192.168.20.254 255.255.255.0
  ip nat inside
!
interface Serial0
  no ip address
  encapsulation frame-relay
  frame-relay lmi-type ansi
!
interface Serial0.1 point-to-point
  ip address 85.37.x.x 255.255.255.252
  ip nat outside
  frame-relay interface-dlci 166 IETF
!
ip nat inside source list 101 interface Loopback0 overload
ip nat inside source static tcp 192.168.3.1 23 85.37.z.z 23 extendable !???
ip classless
ip route 0.0.0.0 0.0.0.0 85.37.254.25
ip route 192.168.10.0 255.255.255.0 192.168.254.1
ip route 192.168.20.0 255.255.255.0 192.168.254.1
ip http server
ip pim bidir-enable
!
!
access-list 101 permit ip any any
snmp-server community public RO
!
line con 0
  stopbits 1
line vty 0 4
  password xxxxx
  login
!
end
se tolgo il nat sulla lan2 con:
no access-list
tutto funziona perfettamente ma ovviamente i pc di lan2 non navigano :(
Appena la rimetto il router comincia a bloccarele connessioni tcp. Ho
dimenticato di dire che in queste condizioni l'unico sistema di accedere a
cisco2 č facendo un telnet da cisco1 sull'ip della vpn (192.168.254.2);
appena tolgo l'access-list comincia ad accettare connessioni.

 cisco2 c facendo un telnet da cisco1 sull'ip della vpn (192.168.254.2);


 
Magari ho capito male, ma quello che ottengo è questo:
ip nat inside source list 101 interface Loopback0 overload
ip classless
ip route 0.0.0.0 0.0.0.0 85.37.x.x
ip route 192.168.10.0 255.255.255.0 192.168.254.1
ip route 192.168.20.0 255.255.255.0 85.37.x.x
ip route 192.168.20.0 255.255.255.0 192.168.254.1
ip http server
ip pim bidir-enable
!
!
access-list 101 deny   ip 192.168.254.0 0.0.0.3 192.168.254.0 0.0.0.3
access-list 101 deny   ip 192.168.20.0 0.0.0.255 192.168.10.0 0.0.0.255
access-list 101 permit ip 192.168.20.0 0.0.0.255 any
Il routing mi sembra tutto meno che corretto e gli ho dato un'aggiustata 
cosi':
ip nat inside source list 101 interface Loopback0 overload
ip classless
ip route 0.0.0.0 0.0.0.0 85.37.x.x
ip route 192.168.10.0 255.255.255.0 192.168.254.1
ip http server
ip pim bidir-enable
Ma in entrambi i casa la solfa non cambia: ping ok, tcp kaput
PING 192.168.20.1 (192.168.20.1) 56(84) bytes of data.
64 bytes from 85.37.x.x: icmp_seq=1 ttl=121 time=61.6 ms
64 bytes from 85.37.x.x: icmp_seq=2 ttl=121 time=59.0 ms
mail:/home/sengo# telnet  192.168.20.1 3389
Trying 192.168.20.1...
:(