Newsgroup: it.comp.reti.cisco
Titolo: troubleshooting Pix VPN connection

Scusatemi se il msg e' troppo lungo.
Ho configurato una VPN tra un PIX 515E e un Cisco 1721.
Intanto sul router con connessione ADSL il router telecom blocca tutti 
i pacchetti che hanno come ip source quello pubblico del Cisco 1721 e 
invece fa passare quelli che vengono dagli IP pubblici aggiuntivi ( 8 
in tutto ). Questo ha detto telecom e' la loro politica. Allora ho 
conf la VPN tra l'int outside del PIX e la FastEth 0 del router che ha 
appunto un IP pubblico aggiuntivo che telecom fa passare.
Il problema e' che la VPN non da' segni di vita.
sh crypto isakmp sa : niente
sh crypto ipsec sa : niente
le conf sono queste :
PIX ( sede centrale )
PIX Version 6.3(1)
interface ethernet0 100full
interface ethernet1 100full
interface ethernet2 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security50
enable password xxxxxxxxxx encrypted
passwd xxxxxxxxx encrypted
hostname pix
domain-name 
domain.it
clock timezone CEST 1
clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
names
access-list acl_out permit icmp any any
access-list acl_out permit tcp any host 111.111.111.180 eq www
access-list acl_out permit tcp any host 111.111.111.181 eq www
access-list acl_out permit tcp any host 111.111.111.180 eq smtp
access-list acl_out permit tcp any host 111.111.111.181 eq smtp
access-list acl_out permit tcp any host 111.111.111.181 eq https
access-list acl_out permit tcp any host 111.111.111.180 eq https
access-list acl_out permit gre any host 111.111.111.180
access-list acl_out permit tcp any host 111.111.111.180 eq pptp
access-list vpn_traffic permit ip 192.168.16.0 255.255.254.0 10.0.0.0 
255.255.0.0
access-list nonat permit ip 192.168.16.0 255.255.254.0 10.0.0.0 
255.255.0.0
pager lines 24
logging on
logging timestamp
logging buffered debugging
icmp permit any echo-reply outside
icmp permit any echo outside
icmp permit any unreachable outside
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip address outside 111.111.111.178 255.255.255.240
ip address inside 192.168.16.1 255.255.255.0
ip address dmz 172.16.0.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm logging debugging 100
no pdm history enable
arp timeout 14400
global (outside) 1 111.111.111.182-111.111.111.190 netmask 
255.255.255.240
global (outside) 1 111.111.111.179 netmask 255.255.255.240
nat (inside) 1 192.168.16.0 255.255.255.0 0 0
static (inside,outside) 111.111.111.180 192.168.16.2 netmask 
255.255.255.255 0 0
static (inside,outside) 111.111.111.181 192.168.16.3 netmask 
255.255.255.255 0 0
access-group acl_out in interface outside
route outside 0.0.0.0 0.0.0.0 111.111.111.177 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 
1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
aaa authentication ssh console LOCAL
aaa authentication telnet console LOCAL
aaa authentication serial console LOCAL
http server enable
http 192.168.16.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set myset ah-sha-hmac esp-3des esp-md5-hmac
crypto map trademap 1 ipsec-isakmp
crypto map trademap 1 match address vpn_traffic
crypto map trademap 1 set peer 222.222.222.233
crypto map trademap 1 set transform-set myset
crypto map trademap interface outside
isakmp enable outside
isakmp key ******** address 222.222.222.233 netmask 255.255.255.255
isakmp policy 1 authentication pre-share
isakmp policy 1 encryption 3des
isakmp policy 1 hash sha
isakmp policy 1 group 2
isakmp policy 1 lifetime 3600
telnet 192.168.16.0 255.255.255.0 inside
telnet timeout 60
ssh timeout 15
console timeout 0
username user password xxxxxxxx encrypted privilege 2
terminal width 132
Cryptochecksum:9760abf8ddfb722a0ad5ec4d35149370
: end
router :
version 12.2
service timestamps debug datetime localtime
service timestamps log datetime localtime
service password-encryption
!
hostname router
!
logging count
logging buffered 4096 debugging
enable secret 5 xxxxxxxxxxxxx
!
username user password 7 xxxxxxxxx
clock timezone CEST 2
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
ip subnet-zero
!
!
ip dhcp excluded-address 10.0.0.1 10.0.0.63
!
ip dhcp pool lan
   network 10.0.0.0 255.255.0.0
   default-router 10.0.0.1
   dns-server 151.99.125.1 151.99.0.100
!
ip audit notify log
ip audit po max-events 100
!
crypto isakmp policy 1
 encr 3des
 authentication pre-share
 group 2
 lifetime 3600
crypto isakmp key ******* address 111.111.111.178
!
!
crypto ipsec transform-set myset ah-sha-hmac esp-3des esp-md5-hmac
!
crypto map vpn 1 ipsec-isakmp
 set peer 111.111.111.178
 set transform-set myset
 match address 120
!
!
!
!
interface Loopback0
 no ip address
!
interface ATM0
 no ip address
 no atm ilmi-keepalive
 dsl operating-mode auto
 no fair-queue
!
interface ATM0.1 point-to-point
 description ADSL Provider Telecom Italia
 mtu 1500
 ip address x.x.x.54 255.255.255.252
 ip nat outside
 pvc 8/35
  encapsulation aal5snap
 !
!
interface FastEthernet0
 ip address 10.0.0.1 255.255.0.0 secondary
 ip address 222.222.222.233 255.255.255.248
 ip nat inside
 speed auto
 crypto map vpn
!
interface Serial0
 no ip address
 shutdown
!
ip nat pool nat1 222.222.222.233 222.222.222.233 prefix-length 29
ip nat inside source route-map Nat-loop pool nat1 overload
ip classless
ip route 0.0.0.0 0.0.0.0 ATM0.1
no ip http server
ip pim bidir-enable
!
!
access-list 10 permit 10.0.0.0 0.0.255.255
access-list 101 deny   ip 10.0.0.0 0.0.255.255 192.168.16.0 0.0.1.255
access-list 101 permit ip 10.0.0.0 0.0.255.255 any
access-list 101 permit ip any 10.0.0.0 0.0.255.255
access-list 120 permit ip 10.0.0.0 0.0.255.255 192.168.16.0 0.0.1.255
!
route-map Nat-loop permit 10
 match ip address 101
 set ip next-hop 222.222.222.233
!
!
line con 0
 login local
line aux 0
 login local
line vty 0 4
 login local
!
end

 nat (inside) 1 192.168.16.0 255.255.255.0 0 0
la nat 0 la ho scordata ( nat (inside) 0 access-list nonat )
adesso con sh cry isa sa e sh cry ips sa vedo la SA, ma se dal PIX 
pingo la int fe0 del router ( 10.0.0.1 ) mi va in timeout e viceversa 
se pingo dal router la in inside del PIX uguale.
Qualke suggerimento?
Grazie
Ciao
Partisan