Newsgroup: it.comp.reti.cisco
Titolo: Vpn con pix501: il client non naviga

Salve a tutti
ho configurato un pix501 dietro un router alice gate Plus di telecom,
con indirizzo 192.168.1.1.
Per come ho configurato la VPN, mi collego, inserisco le credenziali
locali dell'utente TEST ed il collegamento va up e mi assegna
l'indirizzo IP perň: 
- non navigo 
- non pingo il resto dalla lan_in e tantomeno lan_out 
- il gateway risulta lo stesso dell'indirizzo negoziato (nella conf ho
inserito quelli del router) 
Ho provato a seguire lo script di Wizard "Script config VPN Client
IPsec su PIX 6.3.x" modificando qualcosa...ma non č filato tutto
liscio 
Grazie ancora per l'aiuto.
pix501# sh conf 
: Saved 
: Written by enable_15 at 23:56:48.368 UTC Sat Aug 14 2010 
PIX Version 6.3(5) 
interface ethernet0 auto 
interface ethernet1 100full 
nameif ethernet0 outside security0 
nameif ethernet1 inside security100 
enable password XXXXXXXXX encrypted 
passwd XXXXXX encrypted 
hostname pix501 
domain-name 
mydomain.com
 
fixup protocol dns maximum-length 512 
fixup protocol ftp 21 
fixup protocol h323 h225 1720 
fixup protocol h323 ras 1718-1719 
fixup protocol http 80 
fixup protocol rsh 514 
fixup protocol rtsp 554 
fixup protocol sip 5060 
fixup protocol sip udp 5060 
fixup protocol skinny 2000 
fixup protocol smtp 25 
fixup protocol sqlnet 1521 
fixup protocol tftp 69 
names 
access-list ping_acl permit icmp any any 
access-list 101 permit ip 10.0.0.0 255.255.255.0 host 192.168.1.180 
access-list 101 permit ip 10.0.0.0 255.255.255.0 host 192.168.1.181 
access-list 101 permit ip 10.0.0.0 255.255.255.0 host 192.168.1.182 
access-list 101 permit ip 10.0.0.0 255.255.255.0 host 192.168.1.183 
pager lines 24 
mtu outside 1500 
mtu inside 1500 
ip address outside dhcp setroute 
ip address inside 10.0.0.254 255.255.255.0 
ip audit info action alarm 
ip audit attack action alarm 
ip local pool poolVPN_Home 192.168.1.180-192.168.1.183 
pdm history enable 
arp timeout 14400 
global (outside) 1 interface 
nat (inside) 0 access-list 101 
nat (inside) 1 0.0.0.0 0.0.0.0 0 0 
access-group ping_acl in interface outside 
route outside 0.0.0.0 0.0.0.0 192.168.1.1 1 
timeout xlate 3:00:00 
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225
1:00:00 
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 
timeout sip-disconnect 0:02:00 sip-invite 0:03:00 
timeout uauth 0:05:00 absolute 
aaa-server TACACS+ protocol tacacs+ 
aaa-server TACACS+ max-failed-attempts 3 
aaa-server TACACS+ deadtime 10 
aaa-server RADIUS protocol radius 
aaa-server RADIUS max-failed-attempts 3 
aaa-server RADIUS deadtime 10 
aaa-server LOCAL protocol local 
http server enable 
http 10.0.0.100 255.255.255.255 inside 
http 10.0.0.101 255.255.255.255 inside 
no snmp-server location 
no snmp-server contact 
snmp-server community public 
no snmp-server enable traps 
floodguard enable 
sysopt connection permit-ipsec 
crypto ipsec transform-set setVPN_Home esp-3des esp-md5-hmac 
crypto dynamic-map mapDinVPN_Home 10 set transform-set setVPN_Home 
crypto map mapVPN_Home 10 ipsec-isakmp dynamic mapDinVPN_Home 
crypto map mapVPN_Home client configuration address initiate 
crypto map mapVPN_Home client configuration address respond 
crypto map mapVPN_Home client authentication LOCAL 
crypto map mapVPN_Home interface outside 
isakmp enable outside 
isakmp key XXXXX address 0.0.0.0 netmask 0.0.0.0 
isakmp identity address 
isakmp client configuration address-pool local poolVPN_Home outside 
isakmp policy 20 authentication pre-share 
isakmp policy 20 encryption 3des 
isakmp policy 20 hash md5 
isakmp policy 20 group 2 
isakmp policy 20 lifetime 86400 
vpngroup gruppoVPN_Home address-pool poolVPN_Home 
vpngroup gruppoVPN_Home dns-server 192.168.1.1 
vpngroup gruppoVPN_Home wins-server 192.168.1.1 
vpngroup gruppoVPN_Home default-domain intranet 
vpngroup gruppoVPN_Home idle-time 1800 
vpngroup gruppoVPN_Home password XXXXXXX 
telnet 10.0.0.0 255.255.255.0 inside 
telnet timeout 5 
ssh timeout 5 
console timeout 0 
dhcpd address 10.0.0.100-10.0.0.110 inside 
dhcpd lease 3600 
dhcpd ping_timeout 750 
dhcpd auto_config outside 
dhcpd enable inside 
username test password XXXXX encrypted privilege 3 
terminal width 80 
Cryptochecksum:XXXXXX 


CUT

Così ad occhio manca lo split-tunnel. Dei indicare al cliente per
quali reti utilizzare la VPN, altrimenti tutto il traffico generato
verrà rediretto al firewall.
Devi creare un acl tipo la 101 che hai già fatto:
access-list VPNSplit permit ip 10.0.0.0 255.255.255.0 host
192.168.1.180
access-list VPNSplit permit ip 10.0.0.0 255.255.255.0 host
192.168.1.181
access-list VPNSplit permit ip 10.0.0.0 255.255.255.0 host
192.168.1.182
access-list VPNSplit permit ip 10.0.0.0 255.255.255.0 host
192.168.1.183
e poi associarla al comando:
vpngroup gruppoVPN_Home split-tunnel VPNSplit
Per il resto mi sembra abbastanza ok. Il nat0 l'hai messo, il traffico
vpn è permesso dal "sysopt connection permit-ipsec". Controlla il
routing delle macchine sulla 
10.0.0.0/24
, se hanno com GW il PIX non
c' è problema, altrimenti devono avere una rotta per i client vpn a
cui assegni IP sulla 192.168.1.x (potresti assegnarli anche IP sulla
10.0.0.0/24
)
Ciao

 wrote:
CUT
Ciao Geppo
grazie mille per l'aiuto
Ho apportato quanto mi hai suggerito alla configurazione (premetto di
aver modificato l'indirizzo dei client)
pix501# sh conf
: Saved
: Written by enable_15 at 18:50:06.236 CEDT Sun Sep 5 2010
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password XXXXXXXXXXXXXX encrypted
passwd XXXXXXXXXXXXXX encrypted
hostname pix501
domain-name 
mydomain.com
clock timezone CEST 1
clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list ping_acl permit icmp any any
access-list VPNSplit permit ip 10.0.0.0 255.255.255.0 host 10.1.1.100
access-list VPNSplit permit ip 10.0.0.0 255.255.255.0 host 10.1.1.101
access-list VPNSplit permit ip 10.0.0.0 255.255.255.0 host 10.1.1.102
access-list 101 permit ip 10.0.0.0 255.255.255.0 host 10.1.1.100
access-list 101 permit ip 10.0.0.0 255.255.255.0 host 10.1.1.101
access-list 101 permit ip 10.0.0.0 255.255.255.0 host 10.1.1.102
access-list 101 permit ip 10.0.0.0 255.255.255.0 host 10.1.1.103
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 192.168.1.254 255.255.255.0
ip address inside 10.0.0.254 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool poolVPN_Home 10.1.1.100-10.1.1.200 mask 255.255.255.0
pdm location 10.0.0.100 255.255.255.255 inside
pdm location 0.0.0.0 255.255.255.0 outside
pdm location 10.1.1.0 255.255.255.0 outside
pdm location 10.0.0.102 255.255.255.255 inside
pdm location 10.0.0.101 255.255.255.255 inside
pdm location 10.0.0.107 255.255.255.255 inside
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list 101
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-group ping_acl in interface outside
route outside 0.0.0.0 0.0.0.0 192.168.1.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225
1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 192.168.1.0 255.255.255.0 outside
http 10.0.0.100 255.255.255.255 inside
http 10.0.0.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
auth-prompt prompt Prompt
auth-prompt accept Accepted
auth-prompt reject Reject
crypto ipsec transform-set setVPN_Home esp-3des esp-sha-hmac
crypto dynamic-map mapDinVPN_Home 4 set transform-set setVPN_Home
crypto map mapVPN_Home 20 ipsec-isakmp dynamic mapDinVPN_Home
crypto map mapVPN_Home client configuration address initiate
crypto map mapVPN_Home client configuration address respond
crypto map mapVPN_Home client authentication LOCAL
crypto map mapVPN_Home interface outside
isakmp enable outside
isakmp key XXXXXXXXXXXXXX address 0.0.0.0 netmask 0.0.0.0
isakmp policy 8 authentication pre-share
isakmp policy 8 encryption 3des
isakmp policy 8 hash md5
isakmp policy 8 group 2
isakmp policy 8 lifetime 86400
vpngroup gruppoVPN_Home address-pool poolVPN_Home
vpngroup gruppoVPN_Home dns-server 8.8.8.8
vpngroup gruppoVPN_Home wins-server 192.168.1.1
vpngroup gruppoVPN_Home default-domain 
mydomain.com
vpngroup gruppoVPN_Home split-tunnel VPNSplit
vpngroup gruppoVPN_Home idle-time 1800
vpngroup gruppoVPN_Home password XXXXXXXXXXXXXX
telnet 192.168.1.0 255.255.255.0 outside
telnet 10.0.0.0 255.255.255.0 inside
telnet timeout 20
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 20
console timeout 0
dhcpd address 10.0.0.100-10.0.0.200 inside
dhcpd dns 192.168.1.1 193.205.245.5
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd enable inside
username test password XXXXXXXXXXXXXX encrypted privilege 3
username diego password XXXXXXXXXXXXXX encrypted privilege 15
terminal width 80
banner exec Session Banner
banner login Login Banner
Cryptochecksum:XXXXXXXXXXXXXX
Nonostante le modifiche non riesco a raggiungere gli host della VPN,
sia quelli outside che inside, e cmq esco su internet con l'ip del
client e non di quello della rete della VPN.
In aggiunta, quanto al client viene negoziato l'ip, il gateway non
c'č....
Garzie ancora mille!!!

che non vedi un gateway nella conf IP è normale.
per verificare se lo split tunnel funziona bene, vai nelle statistiche
del client VPN una volta che ti sei connesso. Dovresti trovare la
entry per la rete 10.0.0.0 255.255.255.0
per il resto la conf mi sembra corretta ma puoi fare una prova di
questo tipo... prova a usare IP sulla 
10.0.0.0/24
 da assegnare ai
client VPN invece che IP esterni 10.1.1.xxx
è cmq una soluzione pulita e se hai qualche problemino di routing
interno dovresti risolvere