Newsgroup: it.comp.reti.cisco
Titolo: problema pix - vpn client cisco

Ho configurato il mip pix 515 per stabilire vpn dall'esterno con i client
vpn cisco ver 4.6.
La configurazione l'ho presa da 
cisco.com
 dove ci sono vari esempi sia per
il pix che per i client.
La connessione non va perņ a buon fine, facendo un debug crypto isakmp vedo
l'errore:
"
ISAKMP : Checking IPSec proposal 1
ISAKMP: transform 1, ESP_AES
ISAKMP: attributes in transform:
ISAKMP: authenticator is HMAC-MD5
ISAKMP: key length is 256
ISAKMP: encaps is 1
ISAKMP: SA life type in seconds
ISAKMP: SA life duration (VPI) of 0x0 0x20 0xc4 0x9b
IPSEC(validate_proposal): invalid local address 193.204.89.58
ISAKMP (0): atts not acceptable. Next payload is 0
ISAKMP (0): skipping next ANDed proposal (1)
ISAKMP : Checking IPSec proposal 2"
Su 
cisco.com
 per questo errore dice:
"Invalid Local Address
This output is an example of the error message.
IPSEC(validate_proposal): invalid local address 12.2.6.2
ISAKMP (0:3): atts not acceptable. Next payload is 0
ISAKMP (0:3): SA not acceptable!
This error message is attributed to one of these two common problems:
The crypto map map-name local-address interface-id command causes the router
to use an incorrect address as the identity because it forces the router to
use a specified address.
Crypto map is applied to the wrong interface or is not applied at all. Check
the configuration in order to ensure that crypto map is applied to the
correct interface."
ma nel mio caso la crypto map č applicata sulla interface outside senza
specificare ip address come negli esempi:
PIX Version 6.3(4)
.
.
hostname pixfirewall
domain-name 
mydomain.it
.
.
access-list acl_natipsec permit ip 10.246.0.0 255.255.0.0 192.168.20.0
255.255.255.0
.
.
.
ip address outside xxx.xxx.xxx.xxx 255.255.255.0
ip address inside 10.246.0.1 255.255.0.0
.
.
.
ip local pool ippool 192.168.20.10-192.168.20.254
.
.
global (outside) 1 xxx.xxx.xxx.xxx
nat (inside) 0 access-list acl_natipsec
nat (inside) 1 10.246.1.0 255.255.255.0 0 0
nat (dmz1) 0 193.204.89.0 255.255.255.240 0 0
.
.
.
.
.
aaa-server radius-authport 1812
aaa-server radius-acctport 1813
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
aaa-server partnerauth protocol radius
aaa-server partnerauth max-failed-attempts 3
aaa-server partnerauth deadtime 10
aaa-server partnerauth (inside) host 10.246.1.80 **** timeout 5
.
.
sysopt connection permit-ipsec
crypto ipsec transform-set myset esp-des esp-md5-hmac
crypto dynamic-map dynmap 10 set transform-set myset
crypto map mymap 10 ipsec-isakmp dynamic dynmap
crypto map mymap client authentication partnerauth
crypto map mymap interface outside
isakmp enable outside
isakmp identity address
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
vpngroup mygroup address-pool ippool
vpngroup mygroup dns-server xxx.xxx.xxx.xxx
vpngroup mygroup default-domain 
mydomain.it
vpngroup mygroup idle-time 1800
vpngroup mygroup password ********
Qualcuno mi sa dire dove sbaglio?
--------------------------------
Inviato via 
http://arianna.libero.it/usenet/

 ma nel mio caso la crypto map è applicata sulla interface outside senza

Prova ad aggiungere:
isakmp key unapassword address 0.0.0.0 netmask 0.0.0.0
isakmp client configuration address-pool local ippool outside
l'ho confrontato con il mio e mancano queste due linee
saluti
mp