Newsgroup: it.comp.reti.cisco
Titolo: VPN lan-to-lan : Problemi

Ciao
ho pascolato per la rete alla ricerca di configurazioni già fatte da 
prendere spunto ma non sono stato buono.
Devo fare una cosa che per molti di voi è banale, per me è delirante perchè 
non ci riesco.
Sede A
C837 12.4(17)
ATM0.1 ip statico pubblico mettiamo 100.100.100.1
ETH0 192.168.1.254 LAN
Sede B:
C2611 12.3(24) IP FRW PLUS 3DES
ATM0.1 ip statico pubblico 200.200.200.1
ETH0/0 192.168.0.254 LAN
ETH0/1 public range /29
Io devo unire le due lan.
Dopo farò un post con un mio ragionamento sugli AIM vpn... ma per ora
vorrei limitarmi a farla in 3DES/SHA1 (l'837 la cifra via hw, il 2611 
potrebbe farlo con la AIM VPN aggiuntiva).
Ho seguito alcuni tutorial, ma poi mi sono anche incasinato con il route 
map.
questo l'ho trovato interessante ma non mi ha dato risultato:
http://www.linuxhomenetworking.com/cisco-hn/vpn-cisco.htm
Queste sono le config parziali:
C2611:
version 12.3
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service internal
service sequence-numbers
!
hostname xxxxxxxxxxxxxxx
!
boot-start-marker
boot-end-marker
!
security authentication failure rate 3 log
security passwords min-length 6
logging buffered 4096 notifications
no logging console
no logging monitor
enable password 7 xxxxxxxxxxxx
!
clock timezone CET 1
no aaa new-model
ip subnet-zero
no ip source-route
no ip gratuitous-arps
ip cef
!
!
!
ip domain round-robin
ip domain name 
kpnqwest.it
ip name-server 217.97.32.2
ip name-server 217.97.32.7
ip dhcp excluded-address 192.168.0.0 192.168.0.10
ip dhcp excluded-address 192.168.0.250 192.168.0.254
!
ip dhcp pool SANROMUALDO
network 192.168.0.0 255.255.255.0
default-router 192.168.0.254
dns-server 212.97.32.2 212.97.32.7
netbios-node-type h-node
domain-name network.local
!
no ip bootp server
ip inspect audit-trail
ip inspect max-incomplete low 300
ip inspect max-incomplete high 400
ip inspect one-minute low 500
ip inspect one-minute high 600
ip inspect udp idle-time 15
ip inspect tcp idle-time 1800
ip inspect tcp finwait-time 1
ip inspect tcp synwait-time 15
ip inspect tcp max-incomplete host 300 block-time 0
ip audit attack action alarm drop reset
ip audit po max-events 100
ip audit signature 2004 disable
ip audit name AUDIT info action alarm
ip audit name AUDIT attack action alarm drop reset
vpdn enable
!
vpdn-group 1
! Default PPTP VPDN group
accept-dialin
protocol pptp
virtual-template 1
!
ipv6 unicast-routing
ipv6 cef
!
!
!
!
!
!
!
!
!
!
!
!
memory sanity all
! login rimossi
!
!
ip tcp selective-ack
ip tcp synwait-time 10
ip ssh time-out 90
!
!
!
!
!
interface Null0
no ip unreachables
!
interface Tunnel0
no ip address
no ip redirects
no ip unreachables
ipv6 unnumbered Ethernet0/0
tunnel source ATM0/0.1
tunnel mode ipv6ip 6to4
!
interface ATM0/0
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
atm ilmi-keepalive
dsl operating-mode auto
hold-queue 224 in
!
interface ATM0/0.1 point-to-point
description ADSL
mtu 1500
bandwidth 640
ip address xxxxxx
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
no ip mroute-cache
pvc 8/35
encapsulation aal5snap
!
!
interface Ethernet0/0
description LAN Interface
ip address 192.168.0.254 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
no ip mroute-cache
full-duplex
no cdp enable
hold-queue 100 in
hold-queue 100 out
!
interface Ethernet0/1
description Public WAN Subnet /29
ip address xxxxxxxxxxxxxxx removed
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
no ip mroute-cache
shutdown
full-duplex
no cdp enable
hold-queue 100 in
hold-queue 100 out
!
interface Virtual-Template1
ip unnumbered Ethernet0/0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
peer default ip address dhcp-pool SANROMUALDO
ppp encrypt mppe auto required
ppp authentication ms-chap-v2
!
ip nat translation timeout 3600
ip nat translation tcp-timeout 1200
ip nat translation udp-timeout 100
ip nat translation finrst-timeout 15
ip nat translation syn-timeout 45
ip nat translation icmp-timeout 120
ip nat inside source list 102 interface ATM0/0.1 overload
no ip http server
no ip http secure-server
ip classless
ip route 0.0.0.0 0.0.0.0 ATM0/0.1
!
!
no logging trap
access-list 102 permit ip 192.168.0.0 0.0.0.255 any
no cdp run
ipv6 route 2002::/16 Tunnel0
ipv6 route ::/0 2002:C058:6301::1
!
snmp-server community public RO
snmp-server ifindex persist
snmp-server location S. Romualdo (RA) - ITALY
snmp-server contact 
ad...@spadhausen.com
!
!
!
!
banner login ^C
You are connected to $(hostname).$(domain) on line $(line).
If you are not authorized to access this system, disconnect now.
THIS IS FOR AUTHORIZED USE ONLY
Unauthorized or improper use of this system may result in
administrative disciplinary action and civil and criminal penalties.
By continuing to use this system you indicate your awareness of and consent
to these terms and conditions of use. LOG OFF IMMEDIATELY if you do not
agree to the conditions stated in this warning.
Network Administrator: 
ad...@spadhausen.com
^C
!
line con 0
login local
transport output telnet
stopbits 1
line aux 0
transport preferred none
transport output telnet
stopbits 1
line vty 0 4
login local
transport preferred ssh
transport input ssh
transport output all
flowcontrol software
!
scheduler max-task-time 5000
ntp clock-period 17208742
ntp server 192.43.244.18
ntp server 193.204.114.105
!
end
La config del 837 è la seguente:
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service internal
service sequence-numbers
!
hostname xxxxxxxxxxx
!
boot-start-marker
boot-end-marker
!
security authentication failure rate 3 log
security passwords min-length 6
logging buffered notifications
no logging console
no logging monitor
enable password 7 xxxxxxxxxxx
!
no aaa new-model
clock timezone CET 1
no ip source-route
no ip gratuitous-arps
!
!
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.1.249 192.168.1.254
ip dhcp excluded-address 192.168.1.0 192.168.1.99
!
ip dhcp pool SPADHAUSEN-MEZZANO
network 192.168.1.0 255.255.255.0
default-router 192.168.1.254
dns-server 212.97.32.2 212.97.32.7
netbios-node-type h-node
domain-name spadhausen.local
!
!
ip cef
ip domain round-robin
no ip domain lookup
ip domain name 
kpnqwest.it
ip name-server 217.97.32.2
ip name-server 217.97.32.7
no ip bootp server
ip multicast-routing
ip inspect log drop-pkt
ip inspect audit-trail
ip inspect max-incomplete low 300
ip inspect max-incomplete high 400
ip inspect one-minute low 500
ip inspect one-minute high 600
ip inspect udp idle-time 15
ip inspect tcp idle-time 1800
ip inspect tcp finwait-time 1
ip inspect tcp synwait-time 15
ip inspect tcp max-incomplete host 300 block-time 0
ip inspect name FRW-DMZ ftp audit-trail on
ip inspect name FRW-DMZ pop3 audit-trail on
ip inspect name FRW-DMZ icmp audit-trail on
ip inspect name FRW-DMZ esmtp audit-trail off
ip inspect name FRW-DMZ http
ip inspect name FRW ftp audit-trail on
ip inspect name FRW icmp audit-trail on
ip inspect name FRW ssh
ip inspect name FRW ftps
ip inspect name FRW fragment maximum 256 timeout 1
ip ips signature 2004 0 disable
ip ips signature 2001 0 disable
ip ips signature 2000 0 disable
ip ips name AUDIT
login block-for 120 attempts 5 within 60
login on-failure log
ipv6 unicast-routing
ipv6 general-prefix WAN 6to4 ATM0.35
ipv6 cef
!
crypto pki trustpoint TP-self-signed-1683529703
subject-name cn=IOS-Self-Signed-Certificate-1683529703
revocation-check none
rsakeypair TP-self-signed-1683529703
!
!
memory sanity all
!login rimossi!
!
ip tcp selective-ack
ip tcp synwait-time 10
ip ssh time-out 90
ip ssh version 2
!
!
!
!
interface Tunnel0
no ip address
no ip redirects
no ip unreachables
ipv6 unnumbered Ethernet0
tunnel source ATM0.35
tunnel mode ipv6ip 6to4
!
interface Null0
no ip unreachables
!
interface Ethernet0
description LAN FastEthernet Link
bandwidth 10000000
ip address 192.168.1.254 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip virtual-reassembly
no ip mroute-cache
ipv6 address WAN 0:0:0:1::/64 eui-64
no cdp enable
hold-queue 100 in
hold-queue 100 out
!
interface Ethernet2
description DMZ Link for Internet exposed Servers
ip address 172.16.0.254 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip inspect FRW-DMZ in
ip ips AUDIT in
ip virtual-reassembly
no ip mroute-cache
ipv6 address WAN 0:0:0:1::/64 eui-64
no cdp enable
hold-queue 100 in
hold-queue 100 out
!
interface ATM0
bandwidth 608
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
no ip mroute-cache
atm vc-per-vp 64
atm ilmi-keepalive
dsl operating-mode auto
hold-queue 224 in
!
interface ATM0.35 point-to-point
description Point to Point Uplink
bandwidth 1280
ip address xxxxxxxxxxx
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip inspect FRW in
ip ips AUDIT in
ip virtual-reassembly max-fragments 16 max-reassemblies 64
no ip mroute-cache
crypto map VPN-from-SanRomualdo
pvc 8/35
encapsulation aal5snap
!
!
interface FastEthernet1
duplex auto
speed auto
!
interface FastEthernet2
duplex auto
speed auto
!
interface FastEthernet3
duplex auto
speed auto
!
interface FastEthernet4
duplex auto
speed auto
!
no ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 ATM0.35
!
no ip http server
no ip http secure-server
!
ip nat translation timeout 3600
ip nat translation tcp-timeout 1200
ip nat translation udp-timeout 100
ip nat translation finrst-timeout 15
ip nat translation syn-timeout 45
ip nat translation icmp-timeout 120
ip nat inside source list 102 interface ATM0.35 overload
!
!
logging history debugging
logging trap debugging
logging facility syslog
logging source-interface Ethernet0
logging 192.168.1.2
access-list 102 permit ip 172.16.0.0 0.0.0.255 any
access-list 102 permit ip 192.168.1.0 0.0.0.255 any
snmp-server community public RO
snmp-server ifindex persist
snmp-server contact 
ad...@spadhausen.com
no cdp run
ipv6 route 2002::/16 Tunnel0
ipv6 route ::/0 2002:C058:6301::1
!
!
!
control-plane
!
banner login ^C
You are connected to $(hostname).$(domain) on line $(line).
If you are not authorized to access this system, disconnect now.
THIS IS FOR AUTHORIZED USE ONLY
Unauthorized or improper use of this system may result in
administrative disciplinary action and civil and criminal penalties.
By continuing to use this system you indicate your awareness of and consent
to these terms and conditions of use. LOG OFF IMMEDIATELY if you do not
agree to the conditions stated in this warning.
Network Administrator: 
ad...@spadhausen.com
^C
!
line con 0
login local
no modem enable
transport output telnet
stopbits 1
line aux 0
login local
transport preferred none
transport output telnet
stopbits 1
line vty 0 4
login local
transport preferred ssh
transport input ssh
transport output all
flowcontrol software
!
scheduler max-task-time 5000
sntp server 193.204.114.105
sntp server 192.43.244.18
end
-------------------
Ho aggiunto le seguenti righe:
SUL 2611:
crypto isakmp policy 1
encr 3des
authentication pre-share
group 5
crypto isakmp key PASSWORD address REMOTOIP
!
!
crypto ipsec transform-set VPN-3DES esp-3des esp-sha-hmac
!
crypto map VPN 1 ipsec-isakmp
set peer REMOTO IP
set transform-set VPN-3DES
match address 110
e sul 837:
crypto isakmp policy 1
encr 3des
authentication pre-share
group 5
crypto isakmp key PASSWORD address REMOTOIP
!
!
crypto ipsec transform-set VPN-3DES esp-3des esp-sha-hmac
!
crypto map VPN 1 ipsec-isakmp
set peer REMOTOIP
set transform-set VPN-3DES
match address 110
----------------
RISULTATO: dalla rete col 837 raggiungo le varie cosine sulla rete dove ci 
sta il 2611, ma non viceversa.
Abbandonando questa situazione, ho optato per il tunnel GRE+IPSEC
Rete con 2611:
crypto isakmp policy 1
 encr 3des
 authentication pre-share
 group 5
crypto isakmp key xxxxxx address IP WAN DEL 837
!
!
crypto ipsec transform-set VPN-3DES esp-3des esp-sha-hmac
!
crypto map VPN 1 ipsec-isakmp
 set peer IP WAN DEL 837
 set transform-set VPN-3DES
 match address 110
interface Tunnel1
 ip address 10.0.0.2 255.255.255.0
 ip mtu 1400
 keepalive 10 3
 tunnel source IP WAN DEL 2611
 tunnel destination IP WAN 837
 tunnel checksum
 crypto map VPN
C837:
crypto isakmp policy 1
 encr 3des
 authentication pre-share
 group 5
crypto isakmp key xxxxxxx IP WAN 2611
!
!
crypto ipsec transform-set VPN-3DES esp-3des esp-sha-hmac
!
crypto map VPN 1 ipsec-isakmp
 set peer IP WAN 2611
 set transform-set VPN-3DES
 match address 110
!
!
!
interface Tunnel1
 ip address 10.0.0.1 255.255.255.0 (ip virtuale del tunnel gre)
 ip mtu 1400
 keepalive 10 3
 tunnel source IP WAN 837 assegnato alla atm0.35 point to point
 tunnel destination IP WAN 2611
 tunnel checksum
 crypto map VPN
Ora tutto sembra andare perfettamente.
Le mie domande sono:
a) se io non avessi applicato la crypto map, io cmq raggiungevo la rete 
remota, ma stabilivo un semplice tunnel GRE non cifrato, giusto?
b) Applicando la crypto map all'interfaccia tunnel (funziona lo stesso se lo 
applico alle atm0.35 del 837 e ATM0/0.1 del 2611) e avendo la riga "match 
address 110" faccio in modo che il traffico che matcha l'access list 110 
entra nel tubo IPSEC, giusto?
c) Attualmente parliamo di IPSEC tunnel, non trasport, giusto?
Grazie a chi vorrà chiarirmi i miei dubbi.


ho dato solo una rapida occhiata e forse i miei consigli non ti
serviranno, ma
perche' non usi sdm? in due passaggi ti crei una vpn site-to-site
IPSEC/GRE.. e poi ti studi la configurazione.. inoltre ho visto che
hai configurato l 837 come server VPN per dial-in client in PPTP.. ma
ti funziona? riesci a collegarti ad esemio con un client windows?sull
interfaccia virtual-template hai un ip nat inside che poco mi
convince...
Ciao, sicuramente avrai risposte da persone piu' esperte di me..
MANOJ

 ha scritto nel messaggio 
news:e0577c76-cf08-4390...@60g2000hsy.googlegroups.com...
ho dato solo una rapida occhiata e forse i miei consigli non ti
serviranno, ma
perche' non usi sdm? in due passaggi ti crei una vpn site-to-site
IPSEC/GRE.. e poi ti studi la configurazione.. inoltre ho visto che
hai configurato l 837 come server VPN per dial-in client in PPTP.. ma
ti funziona? riesci a collegarti ad esemio con un client windows?sull
interfaccia virtual-template hai un ip nat inside che poco mi
convince...
Ciao, sicuramente avrai risposte da persone piu' esperte di me..
MANOJ
Ciao
Non uso SDM perchè sono un sostenitore della CLI :)
Ho fatto il dial-in dei client pptp, sul 2611 e funziona!!! direttamente da 
client windows in quanto uso il PPTP.
Il nat inside l'ho messo cosi posso uscire con l'ip del server vpn (il 
router remoto).

 router remoto)
ok.. ascolta.. te la faccio io una domanda se posso..
hai mai provato ad utilizzare Vista come client dial-in?se si.. una
normale condivisione cartella, ti funziona?
Ho istanziato una VPN simile ma dietro il mio router c'e' windows
2003.. riesco a comunicare ma non a condividere.. e dopo mesi di prove
sto realizzando che e' per via della versione 64bit.. quindi prima di
passare alla 32.. sto cercando qualcuno che abbia piu' o meno la mia
stessa configurazione.. Scusami se anziche' risponderti.. ti sto
facendo una domanda..
Ciao e grazie

Ciao
io le mie prove in pptp le ho sempre fatte con i client integrati, sia 
quello di XP 32bit che Win 2003 x64.
Per lo sfogliare le cartelle... dipende.
a quanto ho capito (ma ci ho capito poco) se uso un pool delle vpn che NON 
combacia con la lan remota, riesco a sfogliare le risorse di rete
se uso come ip pool (il pool remoto, se il router remoto fa da dhcp) e 
imposto il nat outside, esco in internet con l'ip del reouter remoto.



 imposto il nat outside, esco in internet con l'ip del reouter remoto.
Grazie per la risposta..
ho provato anch io con win 2003 64.. e funziona.. quindi suppongo sia
un problema di vista...
anche perche' mantenendo le stesse impostazioni su router e sulla
connessione integrata di windows..
il tutto funziona su win x.. mentre con vista riesco solo a pingare..
Spero che qualcuno provi questo tipo di configurazione e mi dia una
conferma..
ciao  e grazie

Soluzione trovata per VISTA come client VPN ;)
http://groups.google.it/group/microsoft.public.it.winserver/browse_thread/thread/389fb608b7e7044a/c0b6a5719cf6a505?hl=it#c0b6a5719cf6a505
ciao e grazie