Newsgroup: it.comp.reti.cisco
Titolo: Problema con VPN CLIENT 4.x e CISCO 1721

Salve,
non riesco a far fungere il client CISCO 4.x con il 1721 in modo da creare 
delle VPN per Agenti esterni alla sede.
Ho seguito passo passo le guide su 
cisco.com
 ma non riesco a capire dove 
sbaglio..
questo è lo sh run :
!
version 12.2
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname ROUTER
aaa new-model
!
!
aaa authentication login userauthen local
aaa authorization network groupauthor local
aaa session-id common
enable secret cisco
!
username cisco password 0 cisco
memory-size iomem 15
ip subnet-zero
!
!
ip name-server 151.99.125.2
!
ip inspect max-incomplete high 1100
...........
ip audit notify log
ip audit po max-events 100
!
!
crypto isakmp policy 3
 encr 3des
 authentication pre-share
 group 2
!
crypto isakmp client configuration group amministratori
 key cisco
 dns 10.10.0.5
 wins 10.10.0.5
 domain miodominio.local
 pool vpn_pool
!
!
crypto ipsec transform-set VPN-IPSEC esp-3des esp-md5-hmac
!
crypto dynamic-map dynmap 10
 set transform-set VPN-IPSEC
!
!
crypto map clientmap client authentication list userauthen
crypto map clientmap isakmp authorization list groupauthor
crypto map clientmap client configuration address respond
crypto map clientmap 10 ipsec-isakmp dynamic dynmap
!
!
!
!
interface Loopback0
 description PRIVATE LAN
 ip address MIOIPPUBBLCO 255.255.255.248
 crypto map clientmap
!
interface ATM0
 no ip address
 no atm ilmi-keepalive
 pvc 0/16 ilmi
 !
 dsl operating-mode auto
 no fair-queue
!
interface ATM0.1 point-to-point
 ip address IPPUNTOPUNTO 255.255.255.252
 ip nat outside
 ip inspect ATM_0_1 in
 pvc 8/35
  encapsulation aal5snap
 !
!
interface FastEthernet0
 description Rete LAN Subnet 
10.10.0.0/24
 ip address 10.10.0.1 255.255.255.0
 ip access-group 100 in
 ip nat inside
 ip inspect FastEthernet_0 in
 speed auto
!
ip local pool vpn_pool 14.1.1.100 14.1.1.120
ip nat pool NAVIGAZIONE-01 IP-ADDRESS-START IP-ADDRESS-STOP netmask 
255.255.255.248
ip nat inside source list 1 pool NAVIGAZIONE-01 overload
ip classless
ip route 0.0.0.0 0.0.0.0 ATM0.1
no ip http server
!
!
access-list 1 permit 10.10.0.0 0.0.0.255
access-list 2 permit 10.10.0.2
access-list 2 permit 10.10.0.5
access-list 2 permit ADMIN-IP1
access-list 2 permit ADMIN-IP2
access-list 100 permit udp any eq rip any eq rip
access-list 100 permit tcp 10.10.0.0 0.0.0.63 any eq www
access-list 100 permit ip 10.10.0.0 0.0.0.63 any
!
!
line con 0
line aux 0
line vty 0 4
 access-class 2 in
 password cisco
!
no scheduler allocate
!
Grazie a chiunque mi aiuterà.
Ciao a tutti 

  crypto map clientmap
Scusa tu riesci a raggiungere il router sull'interfaccia di loopback da fuori?
Perché non metti la crypto map sull'ATM?
Alex.

 ha scritto nel messaggio 
news:9B1Gf.165783$65.46...@twister1.libero.it...


Alex.
Si lo raggiungo solo da alcuni ip... access-list 2
Comunque prima ho anche provato a mettere su ATM0.1 ma nulla. 

 ha scritto nel messaggio 
news:_F6Gf.285$mL5...@tornado.fastwebnet.it...

Se provo a vedere sul router il debug vedo questo :
show crypto isakmp sa
dst             src                                         state 
conn-id    slot
ipATM    IP_CLIENTVPN       AG_INIT_EXCH          1       0
show crypto engine connections active
  ID Interface       IP-Address      State  Algorithm 
Encrypt  Decrypt
   1 AT0.1           IPATM        set    HMAC_SHA+3DES_56_C        0 
0