Newsgroup: it.comp.reti.cisco
Titolo: Crypto acl

Nel messaggio precedente, avevo illustrato la mia necessità di dover
utilizzare un ruter collegato all'interfaccia inside di un pix, come
gateway per una dataWan, dopo essermi autentificato in VPN mediante il
PIX 506e.
Mi è stato risposto di utilizzare le Crypto acl  come ????
io pensavo di fare:
route 192.168.2.1 255.255.255.255 192.168.1.240 1
dove 192.168.2.1 è la macchina che sta dall'altra parte della dataWan
e 192.168.1.240 è il roter incaricato di provvedere alla connessione
alla dataWan
l'indirizzo dell'interfaccia inside del Pix è 192.168.1.200 
Tutto il procedimento della vpn funziona benissimo, pingo
tranquillamente il 240 dopo essermi autentificato ma se cerco di
ccedere a 192.168.2.1  non usa il 240   Help Me !!!!!!!
Grazie.....


Perchč non posti la tua config cosě ci č un po' piů semplice darti una mano?
Ciao,
        Tosh.

...

Grazie per la mano .......  la mia config
: Written by enable_15 at 17:37:57.774 UTC Fri Jul 2 2004
PIX Version 6.2(2)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname pixfirewall
domain-name 
ciscopix.com
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
access-list 101 permit ip 192.168.200.0 255.255.255.0 host
192.168.200.90
access-list 101 permit ip 192.168.200.0 255.255.255.0 host
192.168.200.91
access-list 101 permit ip 192.168.200.0 255.255.255.0 host
192.168.200.92
access-list 101 permit ip 192.168.200.0 255.255.255.0 host
192.168.200.93
access-list 101 permit ip 192.168.200.0 255.255.255.0 host
192.168.200.94
access-list 101 permit ip 192.168.200.0 255.255.255.0 host
192.168.200.95
pager lines 24
logging on
logging standby
interface ethernet0 10full
interface ethernet1 10full
mtu outside 1500
mtu inside 1500
ip address outside 10.0.0.50 255.255.255.0
ip address inside 192.168.200.99 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool VPN_pool 192.168.1.120-192.168.1.140
ip local pool VPN_pool_IP 192.168.200.90-192.168.200.95
pdm location 66.71.191.112 255.255.255.255 outside
pdm location 192.168.200.90 255.255.255.255 outside
pdm location 192.168.200.91 255.255.255.255 outside
pdm location 192.168.200.92 255.255.255.255 outside
pdm location 192.168.200.93 255.255.255.255 outside
pdm location 192.168.200.94 255.255.255.255 outside
pdm location 192.168.200.95 255.255.255.255 outside
pdm location 82.88.52.153 255.255.255.255 inside
pdm location 66.71.191.112 255.255.255.255 inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list 101
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
route outside 0.0.0.0 0.0.0.0 10.0.0.1 1
route outside 66.71.191.112 255.255.255.255 192.168.200.240 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323
0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+ 
aaa-server RADIUS protocol radius 
aaa-server LOCAL protocol local 
url-server (inside) vendor websense host 66.71.191.112 timeout 30
protocol TCP version 1
http server enable
http 192.168.200.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-pptp
no sysopt route dnat
isakmp enable outside
telnet timeout 5
ssh timeout 5
vpdn group L2TP-VPDN-GROUP accept dialin pptp
vpdn group L2TP-VPDN-GROUP ppp authentication pap
vpdn group L2TP-VPDN-GROUP ppp authentication chap
vpdn group L2TP-VPDN-GROUP ppp authentication mschap
vpdn group L2TP-VPDN-GROUP ppp encryption mppe 40 required
vpdn group L2TP-VPDN-GROUP client configuration address local
VPN_pool_IP
vpdn group L2TP-VPDN-GROUP pptp echo 60
vpdn group L2TP-VPDN-GROUP client authentication local
vpdn username ******* password ********
vpdn username ******* password ********
vpdn enable outside
dhcpd lease 3600
dhcpd ping_timeout 750
terminal width 80
Cryptochecksum:257f5a4b188b20fce0fbb10b9ece00ad
La Vpn č stata configurata con il Wizard del Pdm  e le access-list
iniziali sono state create da me per fare in modo di escludere dal nat
gli ip che fanno parte del pool della vpn.
Grazie per la mano.


Mancano sulla acl 101 delle righe del tipo:
access-list 101 permit ip host 192.168.2.1 host 192.168.200.90
Manca la route verso la datawan, come avevi scritto:
route inside 192.168.2.1 255.255.255.255 192.168.1.240 1
Ciao,
         Tosh