Newsgroup: it.comp.reti.cisco
Titolo: Tunnel ipsec tra due 837

Ciao ragazzi,
vi chiedo la cortesia di aiutarmi a capire dove sto sbagliando. La
configurazione è semplice, due 837 con ios ip base/fw su cui devo
attivare un canale ipsec.
Non credo che l'errore sia sulla configurazione delle policy, sui
transformset o sulla crypto. Credo invece sia puro routing che non mi
sovviene.
non so se siano le sttaiche che mi creano problemi. successivamente vi
posto un po' di test eseguiti.
la cfg che ho eseguito su entrambi è la seguente:
Current configuration : 5540 bytes
!
version 12.3
no service pad
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname xxxxxxxxxxx
!
boot-start-marker
boot system flash c837-k9o3y6-mz.123-11.T2.bin
boot-end-marker
!
enable secret 5 xxxxxxxxxxxxxxxxxxxxx
!
username xxxxxxxx privilege 15 password 7 xxxxxxxxxxxxx
username xxxxxxxx password 7 xxxxxxxxxxxxxxx
clock timezone GMT+1 1
clock summer-time summertime recurring last Sun Mar 2:00 last Sun Oct
3:00
aaa new-model
!
!
aaa authentication login default local
aaa session-id common
ip subnet-zero
!
!
ip domain name xxxxxxxxxx
ip name-server xxxxxxxxxx
ip name-server xxxxxxxxxxx
ip inspect name FW cuseeme timeout 3600
ip inspect name FW ftp timeout 3600
ip inspect name FW rcmd timeout 3600
ip inspect name FW realaudio timeout 3600
ip inspect name FW sqlnet timeout 3600
ip inspect name FW streamworks timeout 3600
ip inspect name FW tcp timeout 3600
ip inspect name FW tftp timeout 30
ip inspect name FW udp timeout 30
ip inspect name FW icmp timeout 5
ip inspect name FW netshow timeout 3600
ip inspect name FW vdolive timeout 3600
ip inspect name FW esmtp timeout 3600
ip inspect name FW rtsp timeout 3600
ip ips po max-events 100
ip ssh rsa keypair-name xxxxxxxxxxxxxxxxxx
no ftp-server write-enable
!
!
!
!
!
crypto isakmp policy 1
 encr 3des
 authentication pre-share
 group 2
!
crypto isakmp policy 2
 encr 3des
 authentication pre-share
crypto isakmp key key1 address public_remoto
!
!
crypto ipsec transform-set tunnel esp-3des esp-md5-hmac
!
crypto map tunnelmap local-address Dialer0
crypto map tunnelmap 1 ipsec-isakmp
 set peer public_remoto
 set transform-set tunnel
 match address 130
!
!
!
!
interface Ethernet0
 description -----LAN INTERFACE-----
 ip address 192.168.2.254 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 hold-queue 100 out
!
interface ATM0
 no ip address
 no atm ilmi-keepalive
 dsl operating-mode auto
 crypto map tunnelmap
 pvc 8/35
  encapsulation aal5mux ppp dialer
  dialer pool-member 1
 !
!
interface FastEthernet1
 no ip address
 duplex auto
 speed auto
!
interface FastEthernet2
 no ip address
 duplex auto
 speed auto
!
interface FastEthernet3
 no ip address
 duplex auto
 speed auto
!
interface FastEthernet4
 no ip address
 duplex auto
 speed auto
!
interface Dialer0
 ip address negotiated
 ip nat outside
 ip inspect FW out
 ip virtual-reassembly
 encapsulation ppp
 no ip route-cache
 dialer pool 1
 ppp chap hostname xxxxxxxxxxxxxxx
 ppp chap password 7 xxxxxxxxxxxxxx
 ppp pap sent-username xxxxxxxxxxxxxxxxxxxxxxxxxx
 crypto map tunnelmap
!
ip classless
ip route 0.0.0.0 0.0.0.0 Dialer0
no ip http server
no ip http secure-server
!
ip nat inside source route-map nonat interface Dialer0 overload
!
access-list 1 permit 192.168.2.0 0.0.0.255
access-list 20 permit xxxxxxxxx
access-list 20 remark -----SNMP Connection-----
access-list 23 permit xxxxxxxxxx
access-list 23 permit xxxxxxxxxxxxx
access-list 23 permit 192.168.100.0 0.0.0.255
access-list 23 remark ------------ACCESS TO THE ROUTER-------------
access-list 23 permit xxxxxxxxxxxx
access-list 23 permit xxxxxxxxxxxxx
access-list 23 permit 192.168.1.0 0.0.0.255
access-list 23 permit 192.168.2.0 0.0.0.255
access-list 23 permit 192.168.3.0 0.0.0.255
access-list 23 permit 191.0.0.0 0.0.0.255
access-list 105 deny   ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 105 permit ip 192.168.2.0 0.0.0.255 any
access-list 105 remark ----------NAT----------
access-list 125 remark -----Tunnels-----
access-list 125 permit ip 192.168.2.0 0.0.0.255 any
access-list 125 permit ip 192.168.3.0 0.0.0.255 any
access-list 125 permit ip 192.168.1.0 0.0.0.255 any
access-list 125 permit ip xxxxxxxxxxxxxxxx
access-list 125 permit ip xxxxxxxxxxxxxxxxxxx
access-list 125 permit tcp any any gt 1023 established
access-list 125 permit udp any eq domain any gt 1023
access-list 125 permit tcp any eq domain any gt 1023
access-list 125 permit tcp any eq ftp-data any gt 1023
access-list 125 permit tcp any eq ftp any gt 1023
access-list 125 deny   icmp any any unreachable
access-list 125 deny   icmp any any redirect
access-list 125 permit icmp any any
access-list 125 permit ip host xxxxxxxxxxxxxx any
access-list 125 permit ip xxxxxxxxxxxxxxxx 0.0.0.7 any
access-list 125 deny   ip any any
access-list 130 remark -----Access to crypto map Tunnel1-----
access-list 130 permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
snmp-server community xxxxxxxxxxx RO 20
snmp-server packetsize 1024
snmp-server queue-length 128
snmp-server enable traps tty
snmp-server host xxxxxxxxxxx xxxxxxxxxxx
route-map nonat permit 1
 match ip address 105
!
!
control-plane
!
banner login ^CAccess non authorized is forbidden!^C
!
line con 0
 exec-timeout 0 0
 no modem enable
 transport preferred all
 transport output all
 stopbits 1
line aux 0
 transport preferred all
 transport output all
line vty 0 4
 access-class 23 in
 exec-timeout 0 0
 transport preferred all
 transport input telnet ssh
 transport output telnet ssh
!
no scheduler max-task-time
sntp server xxxxxxxxxxxxxxx
sntp broadcast client
end
Eccovi i test esguiti.
Il ping fallisce miseramente,
ma se eseguo un traceroute consorgente eth0 locale destinatario eth0
remoto fallisce ma ho un incremento di pacchetti nell'engine:
etlisind02#sh crypto engine conn ac
  ID Interface            IP-Address      State  Algorithm          
Encrypt  Decrypt
   1 Dialer0              xxxxxxxxxxxx set    HMAC_SHA+3DES_56_C      
 0        0
2001 Dialer0              xxxxxxxxxx   set    3DES+MD5                
 0       29
2002 Dialer0              xxxxxxxxxxxxxx  set    3DES+MD5             
   15        0
sull'altro però ho questo risultato
  ID Interface            IP-Address      State  Algorithm          
Encrypt  Decrypt
   1 Ethernet0            192.168.1.254   set    HMAC_SHA+3DES_56_C   
    0        0
2001 Ethernet0            pubbl_locale  set    3DES+MD5               
  0       15
2002 Ethernet0            pubblico_locale set    3DES+MD5             
   29        0
I pacchetti transitano sul canale, ma non arrivano a destinazione e
non vengono replicati sembra.
sui debug non compare nessun errore.
debug ip packet: tutti routed
debug crypto engine e isakmp nessun errore
se faccio sh crypto isakmp sa
dst             src             state          conn-id slot status
pub_remoto pub_locale  QM_IDLE              1    0 ACTIVE
Potete darmi un'indicazione se ci capite qualcosa da come ho esposto
il problema?
Ve ne sarei grato davvero tanto.
Ciao
Paolo

 Paolo
Ciao
Domanda semplice nonchč banale....
Il router remoto č configurato per fare vpn con qualsiasi ip di provenienza?
Avendo un 'ip negotiated' sull'if d0.....
Ciao
Carlo