Newsgroup: it.comp.reti.cisco
Titolo: tunnel ipsec

Ciao,
vorrei alcune delucidazioni - sono alle esperienze - circa una conf che poi
dovrei applicare ad una nuova installazione; di seguito posto la conf
esistente su uno dei router periferici.
Quello che non mi e' chiaro e':
a) l'utilizzo delle interfaccie loopback - girando sul sito cisco negli
esempi non sono utilizzate, c'e' qualche ragione particolare per utlizzarle?
b) i parametri che TI dovrebbe fornirmi sono un pool di indirizzi internet
da applicare al tunnel, il n as per eigrp ed un altro indirizzo (che in qs
caso e' stato assegnato alla s0/0.1)??
c) quella riportata secondo voi e' una conf valida?
di seguito la conf di un 1720, naturalmente mascherate chiavi e ip
pubblici.. ;-)
grazie sin d'ora a chi mi rispondera'
ciao
Robin
Current configuration : 3608 bytes
!
version 12.1
no service single-slot-reload-enable
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname pippo
!
logging rate-limit console 10 except errors
enable secret pluto
!
username user1 password
username user2 password
memory-size iomem 25
ip subnet-zero
no ip finger
ip tftp source-interface Loopback0
!
!
!
crypto isakmp policy 10
 hash md5
 authentication pre-share
 lifetime 14400
crypto isakmp key KEY1 address 217.a.b.c
!
crypto ipsec security-association lifetime seconds 14400
!
crypto ipsec transform-set KEY2 esp-des esp-md5-hmac
!
crypto map KEY2 local-address Loopback0
crypto map KEY2 1 ipsec-isakmp
 set peer 217.a.b.c
 set transform-set KEY2
 match address 102
!
cns event-service server
!
!
!
interface Loopback0
 description loop con indirizzi ufficiali per instaurare il CRYPTO
 ip address 217.a.b.d 255.255.255.255
!
interface Loopback1
 description loop di appoggio per tunnel 0
 ip address 192.168.250.1 255.255.255.255
!
interface Tunnel0
 description Interfaccia virtuale di communicazione fra le varie sedi.
 ip address 192.168.200.2 255.255.255.0
 ip mtu 1440
 tunnel source Loopback1
 tunnel destination 192.168.251.1
 crypto map KEY2
!
interface FastEthernet0
 ip address 192.168.2.254 255.255.255.0
 ip nat inside
 no keepalive
 speed auto
 half-duplex
!
interface Serial0
 no ip address
 encapsulation frame-relay IETF
 no ip mroute-cache
 no fair-queue
!
interface Serial0.1 point-to-point
 ip address e.f.g.h 255.255.255.252
 ip nat outside
 frame-relay interface-dlci xx
 crypto map KEY2
!
!
router eigrp yy
 network 192.168.2.0
 network 192.168.200.0
 no auto-summary
 no eigrp log-neighbor-changes
!
ip nat pool INTERNET 217.a.b.i 217.a.b.i netmask 255.255.255.252
ip nat inside source route-map NONAT pool INTERNET overload
ip kerberos source-interface any
ip classless
ip route 0.0.0.0 0.0.0.0 Serial0.1
no ip http server
!
access-list 102 permit gre host 192.168.250.1 host 192.168.251.1
access-list 104 deny   eigrp any any
access-list 104 deny   udp any any eq snmp
access-list 104 deny   udp any any eq snmptrap
access-list 104 deny   ip any host 255.255.255.255
access-list 104 deny   ip host 255.255.255.255 any
access-list 104 permit ip any any
access-list 195 permit ip 192.168.0.0 0.0.0.255 any
access-list 195 permit ip 192.168.1.0 0.0.0.255 any
access-list 199 deny   ip 192.168.2.0 0.0.0.255 192.168.0.0 0.0.0.255
access-list 199 deny   ip host 217.a.b.d host 217.a.b.c
access-list 199 permit ip 192.168.2.0 0.0.0.255 any
dialer-list 1 protocol ip list 104
route-map NONAT permit 10
 match ip address 199
!
!
line con 0
 transport input none
line aux 0
line vty 0 4
 access-class 195 in
 exec-timeout 0 0
 password password
 login
!
end
#sh ver
Cisco Internetwork Operating System Software
IOS (tm) C1700 Software (C1700-SY56I-M), Version 12.1(5)T12,  RELEASE
SOFTWARE (fc1)
TAC Support: 
http://www.cisco.com/tac
Copyright (c) 1986-2002 by cisco Systems, Inc.
Compiled Tue 05-Feb-02 05:12 by ccai
Image text-base: 0x800080E0, data-base: 0x809CADB0
ROM: System Bootstrap, Version 12.0(3)T, RELEASE SOFTWARE (fc1)
supermercato uptime is 7 weeks, 4 days, 15 hours, 31 minutes
System returned to ROM by power-on
System image file is "flash:c1700-sy56i-mz.121-5.T12.bin"
cisco 1720 (MPC860) processor (revision 0x501) with 24576K/8192K bytes of
memory.
Processor board ID JAD04370HB3 (266360952), with hardware revision 0000
M860 processor: part number 0, mask 32
Bridging software.
X.25 software, Version 3.0.0.
Basic Rate ISDN software, Version 1.1.
1 FastEthernet/IEEE 802.3 interface(s)
1 Serial(sync/async) network interface(s)
1 ISDN Basic Rate interface(s)
32K bytes of non-volatile configuration memory.
8192K bytes of processor board System flash (Read/Write)
Configuration register is 0x2102

 vorrei alcune delucidazioni - sono alle esperienze - circa una conf che
                                ^^
                                ehmm .. alle prime esperienze! :-))

 per utlizzarle?
Telecom non fa passare il traffico generato dalla interfaccia seriale per
cui se terminassi i tunnel su questa interfaccia non funzionerebbe.
E' necessario, quindi, terminare il tunnel sulle loopback.
Mau

 wrote in message
news:aos9la$mfj$1...@lacerta.tiscalinet.it...
