Newsgroup: it.comp.reti.cisco
Titolo: Cisco VPN Client 4.x e Cisco 837-k9

Ciao
sto cercando di creare una VPN Client-to-Site tra un Cisco VPN Client
4.x  ed un CIsco 837-K9.
Dopo aver rinunciato ad usare il tool automatico di cisco che
"incasina" la configurazione del router ho iniziato a cercare in rete
documentazione passo-passo...ma nulla sull'837
Qualcuno sa indicarmi qualche link utile o postarmi una conf di
esempio?
Grazie per l'aiuto,
kAKOBAN


Ciao dai un'occhiata qua sotto e vedi se ti va bene.
Ho messo el cose essenziali.
Ciao Alex.
- - - - - - -
!
aaa new-model
!
!
aaa authentication login userauthen local
aaa authorization network groupauthor local
!
aaa session-id common
!
resource policy
!
ip domain name 
mydomain.com
ip ssh authentication-retries 5
ip ssh version 2
!
!
!
! da usare nella seconda fase dell'autenticazione del VPNclient
username miousername privilege 0 password 0 miapassword
!
!
!
crypto isakmp policy 10
  encr 3des
  authentication pre-share
  group 2
  lifetime 1200
!
crypto isakmp invalid-spi-recovery
!
crypto isakmp client configuration group MY-USERS
  key LaMiaPasswordDiGruppo
  domain 
mydomain.com
  pool VPNCLIENT-USERS
  acl 107
  netmask 255.255.255.0
!
crypto ipsec security-association lifetime seconds 1200
!
crypto ipsec transform-set 3DES-SHA esp-3des esp-sha-hmac
!
crypto dynamic-map mydynmap 10
  set transform-set 3DES-SHA
  set pfs group2
  reverse-route
!
!
crypto map vpnplusclient client authentication list userauthen
crypto map vpnplusclient isakmp authorization list groupauthor
crypto map vpnplusclient client configuration address respond
crypto map vpnplusclient 10 ipsec-isakmp dynamic mydynmap
!
interface Ethernet0
  description LAN
  ip address 192.168.0.254 255.255.255.0
  ip accounting output-packets
  ip nat inside
  ip virtual-reassembly
  hold-queue 100 out
!
!
interface Dialer0
  description DIALER
  ip address negotiated
  ip nat outside
  ip virtual-reassembly
  encapsulation ppp
  dialer pool 1
  no cdp enable
  ppp authentication chap pap callin
  ppp chap hostname myISPusername
  ppp chap password 7 myISPpassword
  ppp pap sent-username myISPusername password 0 myISPpassword
  crypto map vpnplusclient
!
ip local pool VPNCLIENT-USERS 192.168.20.1 192.168.20.254
ip nat translation max-entries 2000
ip nat inside source route-map NO_NAT interface Dialer0 overload
!
!
access-list 107 permit ip 192.168.0.0 0.0.0.255 192.168.20.0 0.0.0.255
access-list 130 remark serve per dire di crittografare i pacchetti tra le due reti
access-list 130 permit ip 192.168.0.0 0.0.0.255 192.168.20.0 0.0.0.255
access-list 130 deny   ip any any
access-list 131 remark espicita le eccezioni al NAT. I pacchetti diretti al VPNclient NON devono essere NATTATI
access-list 131 deny   ip 192.168.0.0 0.0.0.255 192.168.20.0 0.0.0.255
access-list 131 permit ip ip 192.168.0.0 0.0.0.255 any
route-map NO_NAT permit 10
  match ip address 131

Grazie per avermi postato una conf di esempio.
Durante il weekend ho lavorato sul Cisco e, adesso quello che ottengo
dai log del VPN Client è:
Cisco Systems VPN Client Version 4.6.02.0011
Copyright (C) 1998-2004 Cisco Systems, Inc. All Rights Reserved.
Client Type(s): Windows, WinNT
Running on: 5.1.2600 Service Pack 2
26     09:47:42.495  03/13/06  Sev=Info/6	IKE/0x6300003B
Attempting to establish a connection with xxx.xxx.xxx.xxx.
27     09:47:42.525  03/13/06  Sev=Info/4	IKE/0x63000013
SENDING >>> ISAKMP OAK AG (SA, KE, NON, ID, VID(Xauth), VID(dpd),
VID(Nat-T), VID(Frag), VID(Unity)) to xxx.xxx.xxx.xxx
28     09:47:42.625  03/13/06  Sev=Info/4	IPSEC/0x63700008
IPSec driver successfully started
29     09:47:42.635  03/13/06  Sev=Info/4	IPSEC/0x63700014
Deleted all keys
30     09:47:43.206  03/13/06  Sev=Info/5	IKE/0x6300002F
Received ISAKMP packet: peer = xxx.xxx.xxx.xxx
31     09:47:43.206  03/13/06  Sev=Info/4	IKE/0x63000014
RECEIVING <<< ISAKMP OAK AG (SA, VID(Unity), VID(dpd), VID(?),
VID(Xauth), VID(Nat-T), KE, ID, NON, HASH, NAT-D, NAT-D) from
xx.xxx.xxx.xxx
32     09:47:43.206  03/13/06  Sev=Info/5	IKE/0x63000001
Peer is a Cisco-Unity compliant peer
33     09:47:43.206  03/13/06  Sev=Info/5	IKE/0x63000001
Peer supports DPD
34     09:47:43.206  03/13/06  Sev=Info/5	IKE/0x63000001
Peer supports DWR Code Only
35     09:47:43.206  03/13/06  Sev=Info/5	IKE/0x63000001
Peer supports XAUTH
36     09:47:43.206  03/13/06  Sev=Info/5	IKE/0x63000001
Peer supports NAT-T
37     09:47:43.236  03/13/06  Sev=Warning/3	IKE/0xE3000056
The received HASH payload cannot be verified
38     09:47:43.236  03/13/06  Sev=Warning/2	IKE/0xE300007D
Hash verification failed... may be configured with invalid group
password.
39     09:47:43.236  03/13/06  Sev=Warning/2	IKE/0xE3000099
Failed to authenticate peer (Navigator:904)
40     09:47:43.236  03/13/06  Sev=Info/4	IKE/0x63000013
SENDING >>> ISAKMP OAK INFO (NOTIFY:INVALID_HASH_INFO) to
xxx.xxx.xxx.xxx
41     09:47:43.246  03/13/06  Sev=Info/4	IKE/0x63000013
SENDING >>> ISAKMP OAK INFO (NOTIFY:AUTH_FAILED) to xxx.xxx.xx.xx
42     09:47:43.246  03/13/06  Sev=Warning/2	IKE/0xE30000A5
Unexpected SW error occurred while processing Aggressive Mode
negotiator:(Navigator:2202)
43     09:47:43.246  03/13/06  Sev=Info/4	IKE/0x63000017
Marking IKE SA for deletion  (I_Cookie=0A55EC6AD8B9898F
R_Cookie=6A8B5F9DF36A9367) reason = DEL_REASON_IKE_NEG_FAILED
44     09:47:44.127  03/13/06  Sev=Info/4	IKE/0x6300004B
Discarding IKE SA negotiation (I_Cookie=0A55EC6AD8B9898F
R_Cookie=6A8B5F9DF36A9367) reason = DEL_REASON_IKE_NEG_FAILED
45     09:47:44.157  03/13/06  Sev=Info/4	IKE/0x63000001
IKE received signal to terminate VPN connection
46     09:47:44.257  03/13/06  Sev=Info/4	IKE/0x63000086
Microsoft IPSec Policy Agent service started successfully
47     09:47:44.267  03/13/06  Sev=Info/4	IPSEC/0x63700014
Deleted all keys
48     09:47:44.267  03/13/06  Sev=Info/4	IPSEC/0x63700014
Deleted all keys
49     09:47:44.267  03/13/06  Sev=Info/4	IPSEC/0x63700014
Deleted all keys
50     09:47:44.267  03/13/06  Sev=Info/4	IPSEC/0x6370000A
IPSec driver successfully stopped
Mi aiuti a decifrare la situazione? (ho controllato tutti i parametri
di autenticazione...)
Grazie.
kAKOBAN

 di autenticazione...)
Mi sembra di capire che fallisca la fase 1. IL client VPN usa la modalità "aggressive" (cioè prova tutte le combinazioni 
tra tipo di encryption e hash, olter che il DH group). Ho supposto che il client possa usare sia 3DES che SHA che group 
2. proprio per etst prova ad usare des e md5 senza DH group (è la più debole delle autenticazioni). Non te la consiglio 
da tenere come definitiva.
cioè
crypto isakmp policy 10
  encr des
   hash md5
  authentication pre-share
  lifetime 1200
Ciao Alex.

Grazie mille!!
dopo un pò di tentativi e qualche nottata in bianco sono riuscito
nell'operazione.
Alla prossima!