Newsgroup: it.comp.reti.cisco
Titolo: VPN pacchetti persi?

Salve,
ho finalmente fatto un passo avanti sulla configurazione della VPN su
mio cisco 857.
Connettendomi con un client Cisco tutto sembra funzionare
perfettamente. Posso fare dei ping su tutta la rete interna, posso
connetermi in ssh sui vari server etc. Il fatto è che se provo ad
accedere su pagine del webserver o provo a fare un ls di una directory
con più di 20 elementi si blocca tutto, ovvero non arrivano più i
pacchetti. Questa è la mia configurazione e non riesco a capire perchè
si blocca il flusso dei dati dopo i primi pacchetti.
Grazie per i suggerimenti
!This is the running config of the router: 192.168.10.254
!----------------------------------------------------------------------------
!version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime localtime show-timezone
service timestamps log datetime localtime show-timezone
no service password-encryption
!
hostname gruppo4_adsl
!
boot-start-marker
boot system flash:c850-advsecurityk9-mz.124-11.T2.bin
boot system flash
boot-end-marker
!
logging buffered 4096
enable secret 5 xxxxxxxxxxxxxxxxx
!
aaa new-model
!
!
aaa group server radius rad_eap
!
aaa group server radius rad_mac
!
aaa group server radius rad_acct
!
aaa group server radius rad_admin
!
aaa group server tacacs+ tac_admin
!
aaa group server radius rad_pmip
!
aaa group server radius dummy
!
aaa authentication login default local
aaa authentication login sdm_vpn_xauth_ml_1 local
aaa authentication login eap_methods group rad_eap
aaa authentication login mac_methods local
aaa authentication login sdm_vpn_xauth_ml_2 local
aaa authentication login sdm_vpn_xauth_ml_3 local
aaa authentication login sdm_vpn_xauth_ml_4 local
aaa authentication login sdm_vpn_xauth_ml_5 local
aaa authentication login sdm_vpn_xauth_ml_6 local
aaa authentication login sdm_vpn_xauth_ml_7 local
aaa authentication login sdm_vpn_xauth_ml_8 local
aaa authentication login sdm_vpn_xauth_ml_9 local
aaa authentication login sdm_vpn_xauth_ml_10 local
aaa authentication login sdm_vpn_xauth_ml_11 local
aaa authorization exec default local
aaa authorization ipmobile default group rad_pmip
aaa authorization network sdm_vpn_group_ml_1 local
aaa authorization network sdm_vpn_group_ml_2 local
aaa authorization network sdm_vpn_group_ml_3 local
aaa authorization network sdm_vpn_group_ml_4 local
aaa authorization network sdm_vpn_group_ml_5 local
aaa authorization network sdm_vpn_group_ml_6 local
aaa authorization network sdm_vpn_group_ml_7 local
aaa authorization network sdm_vpn_group_ml_8 local
aaa authorization network sdm_vpn_group_ml_9 local
aaa authorization network sdm_vpn_group_ml_10 local
aaa authorization network sdm_vpn_group_ml_11 local
aaa accounting network acct_methods start-stop group rad_acct
!
!
aaa session-id common
clock timezone MET 1
clock summer-time MET-DST recurring last Sun Mar 2:00 last Sun Oct
3:00
no ip source-route
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.10.1 192.168.10.99
ip dhcp excluded-address 192.168.10.200 192.168.10.254
!
ip dhcp pool g4pool
   import all
   network 192.168.10.0 255.255.255.0
   default-router 192.168.10.254
   domain-name 
gruppo4.com
   dns-server 192.168.10.11
   lease infinite
!
!
ip cef
ip domain name 
gruppo4.it
ip name-server 194.20.0.24
ip name-server 194.244.116.226
ip name-server 62.196.2.70
ip name-server 213.205.32.70
!
!
crypto pki trustpoint TP-self-signed-505814874
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-505814874
 revocation-check none
 rsakeypair TP-self-signed-505814874
!
username root privilege 15 view root secret 5
xxxxxxxxxxxxxxxxxxxxxxxxx
username aldo secret 5 $1$eYFX$5K8U6g4NwYVMP3hbkl/Ed0
username franco privilege 15 view root secret 5 xxxxxxxxxxxxxxxxxxxxx
!
crypto isakmp policy 1
 encr 3des
 authentication pre-share
 group 2
!
crypto isakmp client configuration group gruppo4
 key test
 pool SDM_POOL_1
 acl 100
 split-dns 192.168.10.11
crypto isakmp profile sdm-ike-profile-1
   match identity group gruppo4
   client authentication list sdm_vpn_xauth_ml_11
   isakmp authorization list sdm_vpn_group_ml_11
   client configuration address initiate
   client configuration address respond
   virtual-template 1
!
!
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-SHA1 ah-sha-hmac esp-3des esp-sha-
hmac
crypto ipsec transform-set ESP-3DES-SHA2 esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-SHA3 esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-SHA4 esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-SHA5 esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-SHA6 esp-3des esp-sha-hmac
!
crypto ipsec profile SDM_Profile1
 set transform-set ESP-3DES-SHA2 ESP-3DES-SHA ESP-3DES-SHA1
 set isakmp-profile sdm-ike-profile-1
!
interface ATM0
 description ** ADSL Tiscali **
 no ip address
 ip virtual-reassembly
 load-interval 30
 atm ilmi-keepalive
 atm ilmi-pvc-discovery
 dsl operating-mode itu-dmt
!
interface ATM0.3 point-to-point
 description *** Gruppo 4 Tiscali ***
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 no snmp trap link-status
 pvc 8/35
  encapsulation aal5mux ppp dialer
  dialer pool-member 1
 !
!
interface FastEthernet0
 description **To GRUPPO4 LAN**
 load-interval 30
 no cdp enable
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface Virtual-Template1 type tunnel
 ip unnumbered Dialer1
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile SDM_Profile1
!
interface Dot11Radio0
 description g4-wireless
 no ip address
 load-interval 30
 shutdown
 speed basic-1.0 basic-2.0 basic-5.5 basic-6.0 basic-9.0 basic-11.0
basic-12.0 basic-18.0 basic-24.0 basic-36.0 basic-48.0 basic-54.0
 station-role root
 no dot11 extension aironet
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 spanning-disabled
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
!
interface Dot11Radio0.1
 encapsulation dot1Q 1 native
 ip address 10.10.10.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 no cdp enable
!
interface Vlan1
 description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$FW_INSIDE$
 ip address 192.168.10.254 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat inside
 ip virtual-reassembly
 ip tcp adjust-mss 1452
!
interface Dialer1
 ip address negotiated
 ip nat outside
 ip virtual-reassembly
 encapsulation ppp
 dialer pool 1
 dialer-group 1
 no cdp enable
 ppp authentication chap pap callin
 ppp chap hostname 
xxx...@tiscali.it
 ppp chap password 0 123456
 ppp pap sent-username 
xxx...@tiscali.it
 password 0 xxxxxxxx
!
ip local pool SDM_POOL_1 192.168.20.100 192.168.20.110
ip route 0.0.0.0 0.0.0.0 Dialer1
ip route 192.168.10.0 255.255.255.0 Dialer1
!
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 5 life 86400 requests 10000
ip nat source list 110 interface Dialer1
ip nat inside source list 2 interface Dialer1 overload
ip nat inside source static tcp 192.168.10.7 25 interface Dialer1 25
ip nat inside source static tcp 192.168.10.7 443 interface Dialer1 443
ip nat inside source static tcp 192.168.10.7 5222 interface Dialer1
5222
ip nat inside source static tcp 192.168.10.7 5223 interface Dialer1
5223
ip nat inside source static tcp 192.168.10.7 5061 interface Dialer1
5061
ip nat inside source static udp 192.168.10.7 5061 interface Dialer1
5061
ip nat inside source static tcp 192.168.10.7 143 interface Dialer1 143
ip nat inside source static tcp 192.168.10.7 5060 interface Dialer1
5060
ip nat inside source static udp 192.168.10.7 5060 interface Dialer1
5060
ip nat inside source static tcp 192.168.10.7 60000 interface Dialer1
60000
ip nat inside source static tcp 192.168.10.7 60001 interface Dialer1
60001
ip nat inside source static udp 192.168.10.7 60001 interface Dialer1
60001
ip nat inside source static udp 192.168.10.7 60000 interface Dialer1
60000
ip nat inside source static tcp 192.168.10.7 22 interface Dialer1 22
!
access-list 1 permit 192.168.0.0 0.0.0.255
access-list 2 remark SDM_ACL Category=18
access-list 2 deny   192.168.20.0 0.0.0.255
access-list 2 permit 192.168.10.0 0.0.0.255
access-list 100 remark SDM_ACL Category=4
access-list 100 permit ip 192.168.10.0 0.0.0.255 any
access-list 100 permit ip 192.168.20.0 0.0.0.255 any
access-list 110 remark SDM_ACL Category=18
access-list 110 permit ip 192.168.10.0 0.0.0.255 any
access-list 170 remark SDM_ACL Category=17
access-list 170 permit ip 192.168.0.0 0.0.255.255 any
dialer-list 1 protocol ip permit
no cdp run
radius-server local
!
radius-server attribute 32 include-in-access-req format %h
radius-server vsa send accounting
!
control-plane
!
!
line con 0
 no modem enable
line aux 0
line vty 0 4
 access-class 170 in
 privilege level 15
 transport input telnet ssh
!
scheduler max-task-time 5000
sntp server 193.204.114.105
end

  ppp pap sent-username 
xxxx...@tiscali.it
 password 0 xxxxxxxx


già sono daccordo, appena avrò tempo lo riscrivo da zero.
comunque per ora sono di corsa e quindi ho fatto un po di prove e mi
blocco a  173 bytes.
A parte questo ho provato a vedere di fare qualcosa con il comando che
mi hai suggerito  (anche se in sealtà sul router il comando non l'ho
trovato esattamente cosi ma ip tcp mss) ma per ora senza successo!!
cosa ne dici??
ciao


Ciao ancora,
 ho giocato ancora un po con l' ip tcp adjust-mss che mi hai suggerito
e portandolo a 1380 sembra funzionare. Quindi per ora grazie del
suggerimento
ciao
