Newsgroup: it.comp.reti.cisco
Titolo: Più interfaccie più vpn

Ciao a tutti,
Mi trovo nella seguente situazione:
Ufficio con due sedi nella prima ho un cisco 2600 con due ip pubblici (uno
sulla Fasteth e l'altro adsl) nella seconda ho un 2600 con ip pubblico solo
su di una ADSL. Il primo 2600 ha confgurato tutte sull'int Fasteth diverse
VPN con diversi clienti e anche la vpn con la seconda sede. Ho spostato la
vpn "aziendale" (sede uno con sede due) sull'int adsl del primo router in
modo da avere le vpn con i clienti sulla fasteth e quella aziendale
"dedicata" sul link adsl. Ho fatto la configurazione su entrambi i lati e se
faccio uno sh crypto session detail vedo la vpn UP-ACTIVE ma non riesco a
raggiungere le macchine remote. Le acl sono state configurate in maniera
corretta, puo' essere una questione di rotte?
Grazie,
Ginevra J.
--------------------------------
Inviato via 
http://arianna.libero.it/usenet/

 corretta, puo' essere una questione di rotte?
Probabile.
Oppure le acl della vpn hanno un'errore.
senza conf tutto e' ipotetico.
- --
==
"Vorrei solo sapere che sei morto.
Cosi', per stare un po meglio."
- -
Per scrivermi una email o avere la mia PGP Key, posta
un messaggio con il seguente soggetto:"REQUEST EMAIL HARTIGAN".
==
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (MingW32)
iD8DBQFFElbSuuxRXtjsR9sRA2NkAKDwvx5vLoC9v5zH9pr9QRFLCq9IPwCg7Ub2
fjqCPa+9r9V4WI7vYphIyfI=
=ZcOt
-----END PGP SIGNATURE-----

Per prima la conf del router con i due ip^
Current configuration : 9765 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname router
!
boot-start-marker
boot-end-marker
!
logging buffered 52000 debugging
enable secret 5 XXXXXXXXXXXXXXXXXXXXXX
enable password XXXXXXX
!
username user privilege 15 password 0 XXXXXXX
clock timezone PCTimeZone 1
clock summer-time PCTimeZone date Mar 30 2003 2:00 Oct 26 2003 3:00
no aaa new-model
ip subnet-zero
!
!
!
!
ip audit notify log
ip audit po max-events 100
clns routing
no ftp-server write-enable
!
!
!
!
!
!
!
!
!
!
!
!
!
!
crypto isakmp policy 15
 encr 3des
 hash md5
 authentication pre-share
 group 2
!
crypto isakmp policy 30
 encr 3des
 hash md5
 authentication pre-share
 group 2
!
crypto isakmp policy 32
 encr 3des
 hash md5
 authentication pre-share
 group 2
!
crypto isakmp policy 35
 hash md5
 authentication pre-share
 group 2
crypto isakmp key mcXXXXXXXXXXXXXn address XXX.XXX.XXX.XXX
crypto isakmp key 1XXXXXXXXXXXp address XXX.XXX.XXX.XXX
crypto isakmp key sXXXXXXXXXXXXj address XXX.XXX.XXX.XXX
crypto isakmp key AxXXXXXXXXXXXXX8 address XXX.XXX.XXX.XXX
crypto isakmp key mxXXXXXXXXXXXXXXXn address XXX.XXX.XXX.XXX
crypto isakmp key MXXXXXXXXXXXXXXXXXXM address XXX.XXX.XXX.XXX
crypto isakmp key NXXXXXXXXXXXXXXX@c address XXX.XXX.XXX.XXX
crypto isakmp key MXXXXXXXXXXXXXXXXXXl address XXX.XXX.XXX.XXX
crypto isakmp key AXXXXXXXXXXXXXXXXX8 address XXX.XXX.XXX.XXX
crypto isakmp key sXXXXXXXXXXXXXXXXXXXXXXXXXl address XXX.XXX.XXX.XXX
crypto isakmp key !XXXXXXXXXXXXXXXX! address XXX.XXX.XXX.XXX
!
crypto isakmp peer address XXX.XXX.XXX.XXX
 description CW
!
!
crypto ipsec transform-set 3des_md5 esp-3des esp-md5-hmac
crypto ipsec transform-set SDM_TRANSFORMSET_1 esp-3des esp-sha-hmac
crypto ipsec transform-set 3des_md5bis esp-3des esp-sha-hmac
crypto ipsec transform-set des_md5 esp-des esp-md5-hmac
!
crypto map XXXX 10 local-address FastEthernet0/0
crypto map XXXXX 10 ipsec-isakmp
 description
 set peer XXX.XXX.XXX.XXX
 set security-association lifetime seconds 10800
 set transform-set 3des_md5
 set pfs group2
 match address 140
crypto map XXXXX 11 ipsec-isakmp
 description
 set peer XXX.XXX.XXX.XXX
 set transform-set 3des_md5
 match address 101
crypto map XXXXX 20 ipsec-isakmp
 description
 set peer XXX.XXX.XXX.XXX
 set transform-set 3des_md5
 set pfs group2
 match address 120
crypto map XXXXX 30 ipsec-isakmp
 description
 set peer XXX.XXX.XXX.XXX
 set transform-set 3des_md5
 set pfs group2
 match address 130
crypto map XXXXx 40 ipsec-isakmp
 description
 set peer XXX.XXX.XXX.XXX
 set security-association lifetime seconds 28800
 set transform-set 3des_md5
 set pfs group2
 match address 160
crypto map XXXXX 50 ipsec-isakmp
 description
 set peer XXX.XXX.XXX.XXX
 set transform-set 3des_md5
 match address 180
crypto map XXXXX 51 ipsec-isakmp
 description
 set peer XXX.XXX.XXX.XXX
 set transform-set 3des_md5
 match address 190
crypto map XXXXX 55 ipsec-isakmp
 description
 set peer XXX.XXX.XXX.XXX
 set transform-set des_md5
 match address 195
crypto map XXXXX 57 ipsec-isakmp
 description
 set peer XXX.XXX.XXX.XXX
 set transform-set 3des_md5bis
 set pfs group2
 match address 196
!
crypto map link 1 ipsec-isakmp
 description
 set peer X.X.X.X
 set transform-set 3des_md5bis
 match address 197
!
!
!
!
!
!
interface Tunnel1
 ip address 192.168.252.5 255.255.255.252
 tunnel source 194.X.X.X
 tunnel destination XXX.XXX.XXX.XXX
 tunnel checksum
!
interface ATM0/0
 no ip address
 no ip mroute-cache
 no atm ilmi-keepalive
 dsl operating-mode auto
!
interface ATM0/0.1 point-to-point
 pvc 8/35
  encapsulation aal5mux ppp dialer
  dialer pool-member 1
 !
!
interface FastEthernet0/0
 description $FW_OUTSIDE$$ETH-WAN$Wan outside interface
 ip address XXX.XXX.XXX.XXX 255.255.255.0
 ip nat outside
 speed auto
 half-duplex
 no mop enabled
 crypto map mctel
!
interface FastEthernet0/1
 description $FW_INDISE$$ETH-LAN$LAN inside interface
 ip address 192.168.1.100 255.255.255.0
 no ip unreachables
 no ip proxy-arp
 ip nat inside
 speed auto
 full-duplex
!
interface Ethernet1/0
 no ip address
 shutdown
 half-duplex
!
interface Ethernet1/1
 description $ETH-LAN$Frame Relay
 ip address 192.168.5.2 255.255.255.0
 ip nat outside
 half-duplex
!
interface Ethernet1/2
 no ip address
 shutdown
 half-duplex
!
interface Ethernet1/3
 description $ETH-LAN$
 ip address 192.168.2.111 255.255.255.0
 ip nat outside
 half-duplex
!
interface Dialer1
 description link ADSL
 ip address XXX.XXX.XXX.XXX 255.255.255.0
 encapsulation ppp
 dialer pool 1
 dialer-group 1
 ppp authentication chap pap callin
 ppp chap hostname user@provider
 ppp chap password 0 passwd
 ppp pap sent-username user@provider password 0 passwd
!
ip nat inside source route-map SDM_RMAP_1 interface FastEthernet0/0 overload
ip nat inside source static tcp 192.168.1.250 XXX.XXX.XXX.XXX 80 extendable
ip nat inside source static tcp 192.168.1.93 10000 XXX.XXX.XXX.XXX 10000
extendable
ip nat inside source static tcp 192.168.1.93 10001 XXX.XXX.XXX.XXX 10001
extendable
ip nat inside source static tcp 192.168.1.93 11000 XXX.XXX.XXX.XXX 11000
extendable
ip nat inside source static tcp 192.168.1.93 11001 XXX.XXX.XXX.XXX 11001
extendable
ip classless
ip route 0.0.0.0 0.0.0.0 194.5.73.129 permanent
ip route 10.15.0.0 255.255.0.0 Tunnel1
ip route 10.16.0.0 255.255.0.0 Tunnel1
ip route XXX.XXX.XXX.XXX 255.255.255.255 XXX.XXX.XXX.XXX permanent
ip route XXX.XXX.XXX.XXX 255.255.255.255 XXX.XXX.XXX.XXX permanent
ip route XXX.XXX.XXX.XXX 255.255.255.255 XXX.XXX.XXX.XXX permanent
ip route XXX.XXX.XXX.XXX 255.255.254.0 XXX.XXX.XXX.XXX
ip route XXX.XXX.XXX.XXX 255.255.255.255 XXX.XXX.XXX.XXX permanent
ip route 192.168.0.0 255.255.255.0 192.168.1.250
ip route 192.168.1.0 255.255.255.0 FastEthernet0/1
ip route XXX.XXX.XXX.XXX 255.255.255.0 FastEthernet0/0
!
ip http server
ip http authentication local
ip http secure-server
!
!
access-list 100 remark SDM_ACL Category=4
access-list 100 remark IPSec Rule
access-list 100 permit ip 192.168.1.0 0.0.0.255 10.0.16.0 0.0.15.255
access-list 101 remark SDM_ACL Category=4
access-list 101 remark IPSec Rule
access-list 101 permit ip 192.168.1.0 0.0.0.255 host 10.0.17.22
access-list 101 permit icmp 192.168.1.0 0.0.0.255 host 10.0.17.22
access-list 101 permit ip 192.168.1.0 0.0.0.255 host 10.0.17.21
access-list 101 permit icmp 192.168.1.0 0.0.0.255 host 10.0.17.21
access-list 102 remark SDM_ACL Category=4
access-list 102 remark IPSec Rule
access-list 102 permit ip 192.168.1.0 0.0.0.255 XXX.XXX.XXX.XXX 0.0.1.255
access-list 102 permit ip host XXX.XXX.XXX.XXX host XXX.XXX.XXX.XXX
access-list 105 permit ip any any
access-list 120 permit ip host XXX.XXX.XXX.XXX XXX.XXX.XXX.XXX 0.0.0.15
access-list 120 permit ip host XXX.XXX.XXX.XXX host XXX.XXX.XXX.XXX
access-list 130 permit ip host XXX.XXX.XXX.XXX host XXX.XXX.XXX.XXX
access-list 130 permit ip host XXX.XXX.XXX.XXX host XXX.XXX.XXX.XXX
access-list 130 permit ip host XXX.XXX.XXX.XXX host XXX.XXX.XXX.XXX
access-list 140 permit ip host XXX.XXX.XXX.XXX host XXX.XXX.XXX.XXX
access-list 150 remark SDM_ACL Category=18
access-list 150 remark IPSec Rule
access-list 150 deny ip 192.168.1.0 0.0.0.255 host 10.0.17.22
access-list 150 deny ip any any
access-list 150 deny ip 192.168.1.0 0.0.0.255 10.0.16.0 0.0.15.255
access-list 150 deny ip 192.168.1.0 0.0.0.255 XXX.XXX.XXX.XXX 0.0.1.255
access-list 150 deny ip host XXX.XXX.XXX.XXX host 192.168.0.1
access-list 150 deny ip host XXX.XXX.XXX.XXX host XXX.XXX.XXX.XXX
access-list 150 deny ip host XXX.XXX.XXX.XXX host XXX.XXX.XXX.XXX
access-list 150 deny ip host XXX.XXX.XXX.XXX host XXX.XXX.XXX.XXX
access-list 150 deny ip host XXX.XXX.XXX.XXX host XXX.XXX.XXX.XXX
access-list 150 deny ip host XXX.XXX.XXX.XXX host XXX.XXX.XXX.XXX
access-list 150 deny ip host XXX.XXX.XXX.XXX XXX.XXX.XXX.XXX 0.0.0.15
access-list 150 deny ip host XXX.XXX.XXX.XXX host XXX.XXX.XXX.XXX
access-list 150 permit ip host 192.168.1.38 XXX.XXX.XXX.XXX 0.0.0.15
access-list 150 permit ip 192.168.1.0 0.0.0.255 any
access-list 150 permit tcp host 192.168.1.11 host XXX.XXX.XXX.XXX
access-list 150 permit tcp host 192.168.1.20 any
access-list 150 deny ip 192.168.1.0 0.0.0.255 XXX.XXX.XXX.XXX 0.0.0.15
access-list 150 deny tcp host 192.168.1.11 any
access-list 160 permit ip host XXX.XXX.XXX.XXX host XXX.XXX.XXX.XXX
access-list 160 permit ip host XXX.XXX.XXX.XXX host 192.168.0.1
access-list 170 permit ip host XXX.XXX.XXX.XXX host XXX.XXX.XXX.XXX
access-list 170 permit ip 192.168.1.0 0.0.0.255 host XXX.XXX.XXX.XXX
access-list 180 permit ip host 192.168.1.93 host 10.10.10.1
access-list 180 permit icmp host 192.168.1.93 host 10.10.10.1
access-list 180 permit ip host 192.168.1.85 host 10.10.10.1
access-list 180 permit icmp host 192.168.1.85 host 10.10.10.1
access-list 180 permit ip host 192.168.1.32 host 10.10.10.1
access-list 180 permit icmp host 192.168.1.32 host 10.10.10.1
access-list 190 permit ip host 192.168.1.93 host XXX.XXX.XXX.XXX
access-list 190 permit icmp host 192.168.1.93 host XXX.XXX.XXX.XXX
access-list 190 permit ip host 192.168.1.85 host XXX.XXX.XXX.XXX
access-list 190 permit icmp host 192.168.1.85 host XXX.XXX.XXX.XXX
access-list 190 permit ip host 192.168.1.32 host XXX.XXX.XXX.XXX
access-list 190 permit icmp host 192.168.1.32 host XXX.XXX.XXX.XXX
access-list 195 permit ip host 192.168.1.93 10.77.36.0 0.0.0.255
access-list 196 permit ip 192.168.1.0 0.0.0.255 10.0.10.0 0.0.0.255
access-list 196 permit ip 192.168.3.0 0.0.0.255 10.0.10.0 0.0.0.255
access-list 197 permit ip 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255
access-list 197 permit icmp 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255
dialer-list 1 protocol ip list 105
snmp-server community public RO
snmp-server enable traps tty
!
route-map SDM_RMAP_1 permit 1
 match ip address 150
!
!
!
control-plane
!
!
!
!
!
!
!
!
!
line con 0
line aux 0
line vty 0 4
 privilege level 15
 password XXXXXXXXXXXXXXXXX
 login local
 transport input telnet ssh
!
!
!
end
Per secondo il router con una adsl sola:
Building configuration...
Current configuration : 3743 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname CiscoPatio
!
boot-start-marker
boot-end-marker
!
logging buffered 4096 debugging
enable secret 5 $1$MjLZ$HYYP8h7zK.Q.cWLislzNk.
enable password xxx
!
username mctel privilege 15 password 0 xxxxx
clock summer-time PCTimeZone date Mar 30 2003 2:00 Oct 26 2003 3:00
no network-clock-participate slot 1
no network-clock-participate wic 0
no aaa new-model
ip subnet-zero
ip cef
!
!
no ip domain lookup
ip name-server 195.78.x.x
ip name-server 195.78.x.x
ip dhcp excluded-address 192.168.3.1 192.168.3.9
!
ip dhcp pool bureau
   network 192.168.3.0 255.255.255.0
   default-router 192.168.3.1
   dns-server 195.78.X.X 195.78.X.X
!
ip audit po max-events 100
no ftp-server write-enable
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
crypto isakmp policy 15
 encr 3des
 hash md5
 authentication pre-share
 group 2
!
crypto isakmp policy 30
 encr 3des
 hash md5
 authentication pre-share
 group 2
!
crypto isakmp policy 32
 encr 3des
 hash md5
 authentication pre-share
 group 2
!
crypto isakmp policy 35
 hash md5
 authentication pre-share
 group 2
crypto isakmp key xxxxxxxxxxxxx address X.X.X.X
!
!
crypto ipsec transform-set 3des_md5 esp-3des esp-md5-hmac
crypto ipsec transform-set SDM_TRANSFORMSET_1 esp-3des esp-sha-hmac
crypto ipsec transform-set 3des_md5bis esp-3des esp-sha-hmac
crypto ipsec transform-set des_md5 esp-des esp-md5-hmac
crypto ipsec df-bit clear
!
crypto map link 1 ipsec-isakmp
 description bd.Italie
 set peer X.X.X.X
 set transform-set 3des_md5bis
 match address 105
!
!
!
!
interface ATM0/0
 no ip address
 no ip mroute-cache
 ip policy route-map nonat
 no atm ilmi-keepalive
 dsl operating-mode auto
!
interface ATM0/0.1 point-to-point
 ip policy route-map nonat
 pvc 8/35
  encapsulation aal5mux ppp dialer
  dialer pool-member 1
 !
!
interface FastEthernet0/0
 description Production1
 no ip address
 ip nat inside
 shutdown
 speed auto
 half-duplex
!
interface FastEthernet0/1
 description Bureautique1
 ip address 192.168.3.1 255.255.255.0
 ip nat inside
 speed auto
 full-duplex
!
interface Serial0/1
 no ip address
 shutdown
!
interface Serial0/2
 no ip address
 shutdown
!
interface Ethernet1/0
 no ip address
 shutdown
 half-duplex
!
interface Ethernet1/1
 no ip address
 shutdown
 half-duplex
!
interface Ethernet1/2
 no ip address
 shutdown
 half-duplex
!
interface Ethernet1/3
 no ip address
 shutdown
 half-duplex
!
interface Dialer1
 description Outside
 ip address X.X.X.X 255.255.255.0
 ip nat outside
 encapsulation ppp
 ip policy route-map nonat
 dialer pool 1
 dialer-group 1
 ppp authentication chap pap callin
 ppp chap hostname username
 ppp chap password 0 passwd
 ppp pap sent-username username password 0 passwd
 crypto map link
!
ip nat inside source route-map nonat interface Dialer1 overload
no ip http server
no ip http secure-server
ip classless
ip route 0.0.0.0 0.0.0.0 Dialer1
!
!
access-list 1 permit 192.168.3.0 0.0.0.255
access-list 101 permit ip any any
access-list 105 permit ip 192.168.3.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 105 permit icmp 192.168.3.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 110 deny ip 192.168.3.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 110 deny ip 192.168.3.0 0.0.0.255 10.0.10.0 0.0.0.255
access-list 110 permit ip 192.168.3.0 0.0.0.255 any
dialer-list 1 protocol ip list 101
!
route-map nonat permit 10
 match ip address 110
 set ip df 0
!
snmp-server community public RO
snmp-server enable traps tty
!
!
!
!
!
!
!
line con 0
line aux 0
line vty 0 4
 privilege level 15
 password fuckisgood
 login local
 transport input telnet ssh
!
!
end
Grazie,
Ginevra J.

--------------------------------
Inviato via 
http://arianna.libero.it/usenet/

-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160
Ginevra J. wrote:
[Cut!]
Non vedo nella configurazione del primo router un modo per raggiungere
la 192.168.3.0...e trovo estremamente inutile la riga:
ip route 192.168.1.0 255.255.255.0 FastEthernet0/1....
Essendo una rete direttamente connessa non c'e' bisogno di mettere tale
route.
- --
==
"Vorrei solo sapere che sei morto.
Cosi', per stare un po meglio."
- -
Per scrivermi una email o avere la mia PGP Key, posta
un messaggio con il seguente soggetto:"REQUEST EMAIL HARTIGAN".
==
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (MingW32)
iD8DBQFFEmisuuxRXtjsR9sRA9z3AJwP+dwAkgq1UE++QMZN5PwME3rP+gCeJbG4
48NhewgbhgnTjjxpGO4ZqZA=
=GzoN
-----END PGP SIGNATURE-----

Allora:
aggiunto la rotta 192.168.3.0 255.255.255.0 dialer1
e rimossa la 192.168.1.0 255.255.255.0...ma purtorppo non funziona ancora.
Potrebbe essere qualcosa legato alla creazione di una nuova route-map da poi
associare all'int dialer1?
Ginevra J.

--------------------------------
Inviato via 
http://arianna.libero.it/usenet/

 associare all'int dialer1?
Uhmmm perche' sulla dialer1 ? dovresti mettere come next hop l'ip
pubblico dell'altro router... se no come ci arriva ? e come viene
agganciata la crypto map?
- --
==
"Vorrei solo sapere che sei morto.
Cosi', per stare un po meglio."
- -
Per scrivermi una email o avere la mia PGP Key, posta
un messaggio con il seguente soggetto:"REQUEST EMAIL HARTIGAN".
==
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (MingW32)
iD8DBQFFEoiluuxRXtjsR9sRAzhwAJ9dLtEGGrI/haPymUWY99JcLKYzAACghNIC
8PQn8qaJpbziokiYihOXjMc=
=BulE
-----END PGP SIGNATURE-----

-Ho provato a fare un trace dal mio pc all'interfaccia lan del router
remoto:ok
-faccio il trace da il mio pc verso un ip qualsiasi della la remota: si
perde
-Vado su di un server nell'altra sede( direttamente via ip pubblico) e
faccio un trace verso la lan de router dove sono io e non va; viene
instradato giustamente ma poi si perde...
se metto la route che hai detto tu non funziona niente neanche il primo
test!
Ginevra J.

--------------------------------
Inviato via 
http://arianna.libero.it/usenet/

 Inviato via 
http://arianna.libero.it/usenet/
- --
==
"Vorrei solo sapere che sei morto.
Cosi', per stare un po meglio."
- -
Per scrivermi una email o avere la mia PGP Key, posta
un messaggio con il seguente soggetto:"REQUEST EMAIL HARTIGAN".
==
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (MingW32)
iD8DBQFFEpV8uuxRXtjsR9sRA5UfAJwJcj56B+9iXao9WRQnZCGjkoM60gCfV2Oa
HkDaVqhJXj/JcDcotBjU6Ic=
=/R1j
-----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160
Ginevra J. wrote:
Ho riletto con attenzione la configurazione...
Sul primo router ti manca la cripto map...
Perche' mi viene la strana sensazione che sei un po'
a digiuno di ios e annessi ?
- --
==
"Vorrei solo sapere che sei morto.
Cosi', per stare un po meglio."
- -
Per scrivermi una email o avere la mia PGP Key, posta
un messaggio con il seguente soggetto:"REQUEST EMAIL HARTIGAN".
==
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (MingW32)
iD8DBQFFEphjuuxRXtjsR9sRA5JDAKCMtNsWwQkxg58k9yvd9SMpzr4fbQCgnSXh
+JHsb4czS2nVDejhAWPYg7Y=
=cQoI
-----END PGP SIGNATURE-----

 Niente sarebbe ? Chi e' l'ultimo hop che vedi ?
non funziona neanche il ping. Arrivo al mio default gateway
Io pingo l'interfaccia lan del router remoto


...rasentiamo la pazzia se lo lascio tranquillo 5-10 min e ping dal mio pc
il server remoto questo mi risponde una volta sola e poi basta per un po' di
tempo.....!!!!!!


 tempo.....!!!!!!
Quando si entrano in queste situazioni conviene ripartire da zero...
Prendi i pezzi di configurazione legati a queste connessione in vpn,
quindi le rotte statiche, le route map, le crypto, etc...
e te le copi su notepad(o chi per esso).
Riverifichi il senso partendo dal livello osi piu' basso.
Quindi, a parte il livello 1 e 2, dal tre in poi:
routing: i router sanno raggiungere le reti remote
vpn: le associazioni sono corrette
     le acl per le traformazioni descrivono il giusto flusso
     le pass-prase sono uguali
etc..etc..etc..
Fatti questo schemino.
Nel caso per distinguere tale comunicazione, potresti creare un tunnel
gre, su cui far ipsec verso tale router. Cosi' potresti verificare
in modo chiaro il flusso.
Usa il debug per capire se le trasformazioni sono corrette...
Le differenze tra le acl tra un router e un'altro non fanno funzionare
la vpn...
- --
==
"Vorrei solo sapere che sei morto.
Cosi', per stare un po meglio."
- -
Per scrivermi una email o avere la mia PGP Key, posta
un messaggio con il seguente soggetto:"REQUEST EMAIL HARTIGAN".
==
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (MingW32)
iD8DBQFFEraruuxRXtjsR9sRAwwrAKCi9+T1ytzUImUhg/yk07gn95ZQ+wCghyrw
NhKaaqNK54l5k2EcZp/Qsm8=
=/yQ5
-----END PGP SIGNATURE-----