VPN con NAT attive

[zele20]

Salve,
sono riuscito a configurare correttamente easy server VPN, l'utente riesce ad entrare correttamente dall'indirizzo ip pubblico (interfaccia Dialer0) e prende correttamente l'indirizzo del local pool (10.4.0.0).
Tutti i client che non hanno un nat (192.168.1.0) vengono raggiunti correttamente ma due server che hanno nat verso l'esterno (per il servizio di posta e il voip) si possono pingare ma non si può accedere in rdp o in ssh . Tra l'altro una volta connesso il client non riesce a navigare verso l'esterno.
Leggendo qua e là sono riuscito a capire che il pool della vpn dovrebbe avere un no-nat ma non sono riuscito ad applicarlo.
Mi potete dare una mano??

[Rizio]

Non sono riuscito ad identificare benen il tuo problema ma se pensi che con l'acl nonat si risolva ti basta inserire la rete che ti interessa in una acl chiamata appunto nonat e applicarla poi con il comando nat all'interfaccia desiderata (nel tuo caso mi sembra di aver capito l'interfaccia Dialer0).
Es:
access-list nonat extended permit ip host 172.31.1.250 192.168.1.0 255.255.255.0
access-list nonat extended permit ip host 172.31.1.249 192.168.1.0 255.255.255.0
access-list nonat extended permit ip host 172.31.1.248 192.168.1.0 255.255.255.0
access-list nonat extended permit ip host 172.30.1.50 192.168.1.0 255.255.255.0
access-list nonat extended permit ip host 172.31.1.50 192.168.1.0 255.255.255.0
nat (inside) 0 access-list nonat

(in questo caso -un ASA- degli IP della lan non vengono nattati quando entrano nella rete 192.168.1.0 e l'access-l viene applicata all'interfaccia inside)

Rizio

[zele20]

Quando provo a dare un access-list nonat mi dà errore di sintassi, questa è la configurazione attiva sul router 1841:

Codice: Seleziona tutto

!This is the running config of the router: 192.168.1.1
!----------------------------------------------------------------------------
!version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!

!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
logging buffered 16386
logging rate-limit 100 except warnings

!
aaa new-model
!
!
aaa authentication login default local
aaa authentication login VPN-USERS local
aaa authorization network VPN-GROUP local 
!
!
aaa session-id common
dot11 syslog
ip source-route
!
!
!
ip dhcp pool LOCAL
   network 192.168.1.0 255.255.255.0
   default-router 192.168.1.1 

!
!
ip cef
ip name-server 87.xxx.xxx.xx
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
username admin privilege 15 secret 5 54fggsdfgs
username user1 password 0 3434242
username user2 password 0 rwrerwrwe
archive
 log config
  hidekeys
! 
!
crypto isakmp policy 10
 encr 3des
 authentication pre-share
 group 2
 lifetime 36000
crypto isakmp keepalive 10 periodic
!
crypto isakmp client configuration group VPN-GROUP
 key dfdfsfsdcccbbb
 pool VPNPOOL
 save-password
!
!
crypto ipsec transform-set VPNSET esp-aes esp-sha-hmac 
!
crypto dynamic-map VPN-DYNAMIC 10
 set transform-set VPNSET 
 reverse-route
!
!
crypto map VPN-STATIC client authentication list VPN-USERS
crypto map VPN-STATIC isakmp authorization list VPN-GROUP
crypto map VPN-STATIC client configuration address respond
crypto map VPN-STATIC 20 ipsec-isakmp dynamic VPN-DYNAMIC 
!
crypto ctcp 
!
!
!
!
!
interface Loopback0
 ip address 10.4.0.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
!
interface FastEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 duplex auto
 speed auto
!
interface FastEthernet0/1
 no ip address
 shutdown
 duplex auto
 speed auto
!
interface ATM0/0/0
 no ip address
 no atm ilmi-keepalive
 pvc 8/35 
  encapsulation aal5mux ppp dialer
  dialer pool-member 1
 !
!
interface Virtual-Template1 type tunnel
 no ip address
!
interface Dialer0
 ip address negotiated
 ip nat outside
 ip virtual-reassembly
 encapsulation ppp
 dialer pool 1
 dialer-group 1
 ppp pap sent-username dsdadsa password 0 fafsafas
 ppp multilink
 crypto map VPN-STATIC
!
ip local pool VPNPOOL 10.4.0.1 10.4.0.5
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Dialer0
ip http server
no ip http secure-server
!
!
ip dns server
ip nat inside source static tcp 192.168.1.10 8080 interface Dialer0 8080
ip nat inside source static tcp 192.168.1.10 8060 interface Dialer0 8060
ip nat inside source static tcp 192.168.1.10 9675 interface Dialer0 9675
ip nat inside source static tcp 192.168.1.55 7777 interface Dialer0 7777
ip nat inside source static udp 192.168.1.55 7777 interface Dialer0 7777
ip nat inside source static tcp 192.168.1.53 5555 interface Dialer0 5555
ip nat inside source static udp 192.168.1.53 5555 interface Dialer0 5555
ip nat inside source static tcp 192.168.1.52 5080 interface Dialer0 5080
ip nat inside source static udp 192.168.1.52 5080 interface Dialer0 5080
ip nat inside source static udp 192.168.1.39 4444 interface Dialer0 4444
ip nat inside source static tcp 192.168.1.39 4444 interface Dialer0 4444
ip nat inside source static udp 192.168.1.14 1027 interface Dialer0 1027
ip nat inside source static tcp 192.168.1.14 1027 interface Dialer0 1027
ip nat inside source static udp 192.168.1.13 1026 interface Dialer0 1026
ip nat inside source static tcp 192.168.1.13 1026 interface Dialer0 1026
ip nat inside source static udp 192.168.1.12 1024 interface Dialer0 1024
ip nat inside source static tcp 192.168.1.12 1024 interface Dialer0 1024
ip nat inside source static udp 192.168.1.10 3389 interface Dialer0 3389
ip nat inside source static tcp 192.168.1.10 25 interface Dialer0 25
ip nat inside source static tcp 192.168.1.10 110 interface Dialer0 110
ip nat inside source static tcp 192.168.1.10 143 interface Dialer0 143
ip nat inside source static tcp 192.168.1.10 2111 interface Dialer0 2111
ip nat inside source static udp 192.168.1.10 2111 interface Dialer0 2111
ip nat inside source static tcp 192.168.1.10 8282 interface Dialer0 8282
ip nat inside source static udp 192.168.1.10 8282 interface Dialer0 8282
ip nat inside source static tcp 192.168.1.10 5060 interface Dialer0 5060
ip nat inside source static udp 192.168.1.10 9000 interface Dialer0 9000
ip nat inside source static tcp 192.168.1.10 9000 interface Dialer0 9000
ip nat inside source static tcp 192.168.1.10 8888 interface Dialer0 8888
ip nat inside source static udp 192.168.1.10 8888 interface Dialer0 8888
ip nat inside source static udp 192.168.1.10 7000 interface Dialer0 7000
ip nat inside source static tcp 192.168.1.10 7000 interface Dialer0 7000
ip nat inside source static tcp 192.168.1.10 8181 interface Dialer0 8181
ip nat inside source static tcp 192.168.1.10 8088 interface Dialer0 8088
ip nat inside source static udp 192.168.1.10 3306 interface Dialer0 3306
ip nat inside source static tcp 192.168.1.10 3306 interface Dialer0 3306
ip nat inside source static udp 192.168.1.10 25 interface Dialer0 25
ip nat inside source static udp 192.168.1.20 5481 interface Dialer0 5481
ip nat inside source static udp 192.168.1.4 3260 interface Dialer0 3260
ip nat inside source static tcp 192.168.1.4 3260 interface Dialer0 3260
ip nat inside source static udp 192.168.1.132 3390 interface Dialer0 3359
ip nat inside source static tcp 192.168.1.132 3390 interface Dialer0 3359
ip nat inside source static tcp 192.168.1.110 5602 interface Dialer0 5602
ip nat inside source static udp 192.168.1.10 8088 interface Dialer0 8088
ip nat inside source static udp 192.168.1.10 23560 interface Dialer0 23560
ip nat inside source static tcp 192.168.1.10 23560 interface Dialer0 23560
ip nat inside source static tcp 192.168.1.20 5481 interface Dialer0 5481
ip nat inside source static tcp 192.168.1.4 2121 interface Dialer0 2121
ip nat inside source static udp 192.168.1.4 2121 interface Dialer0 2121
ip nat inside source static tcp 192.168.1.4 9191 interface Dialer0 9191
ip nat inside source static udp 192.168.1.4 9191 interface Dialer0 9191
ip nat inside source static udp 192.168.1.4 30000 interface Dialer0 30000
ip nat inside source static tcp 192.168.1.4 30000 interface Dialer0 30000
ip nat inside source static tcp 192.168.1.4 137 interface Dialer0 137
ip nat inside source static udp 192.168.1.4 137 interface Dialer0 137
ip nat inside source static udp 192.168.1.4 138 interface Dialer0 138
ip nat inside source static tcp 192.168.1.4 138 interface Dialer0 138
ip nat inside source static udp 192.168.1.4 139 interface Dialer0 139
ip nat inside source static tcp 192.168.1.4 139 interface Dialer0 139
ip nat inside source static tcp 192.168.1.4 5005 interface Dialer0 5005
ip nat inside source static udp 192.168.1.4 5005 interface Dialer0 5005
ip nat inside source static tcp 192.168.1.4 2049 interface Dialer0 2049
ip nat inside source static udp 192.168.1.4 2049 interface Dialer0 2049
ip nat inside source static udp 192.168.1.99 443 interface Dialer0 443
ip nat inside source static tcp 192.168.1.99 443 interface Dialer0 443
ip nat inside source static udp 192.168.1.99 901 interface Dialer0 901
ip nat inside source static tcp 192.168.1.99 901 interface Dialer0 901
ip nat inside source static udp 192.168.1.110 5602 interface Dialer0 5602
ip nat inside source static udp 192.168.1.4 1723 interface Dialer0 1723
ip nat inside source static tcp 192.168.1.4 1723 interface Dialer0 1723
ip nat inside source static udp 192.168.1.4 1194 interface Dialer0 1194
ip nat inside source static tcp 192.168.1.4 1194 interface Dialer0 1194
ip nat inside source static udp 192.168.1.15 1030 interface Dialer0 1030
ip nat inside source static tcp 192.168.1.15 1030 interface Dialer0 1030
ip nat inside source static tcp 192.168.1.10 3389 interface Dialer0 3389
ip nat inside source static udp 192.168.1.4 5599 interface Dialer0 5599
ip nat inside source static tcp 192.168.1.4 5599 interface Dialer0 5599
ip nat inside source static udp 192.168.1.20 8001 interface Dialer0 8001
ip nat inside source static tcp 192.168.1.20 8001 interface Dialer0 8001
ip nat inside source static udp 192.168.1.99 902 interface Dialer0 902
ip nat inside source static tcp 192.168.1.99 902 interface Dialer0 902
ip nat inside source static udp 192.168.1.99 903 interface Dialer0 903
ip nat inside source static tcp 192.168.1.99 903 interface Dialer0 903
ip nat inside source static udp 192.168.1.99 123 interface Dialer0 123
ip nat inside source static tcp 192.168.1.99 123 interface Dialer0 123
ip nat inside source static udp 192.168.1.99 514 interface Dialer0 514
ip nat inside source static tcp 192.168.1.99 514 interface Dialer0 514
ip nat inside source list 1 interface Dialer0 overload
ip nat inside source list 100 interface Dialer0 overload
ip nat inside source static tcp 192.168.1.4 5006 interface Dialer0 5006
ip nat inside source static udp 192.168.1.4 5006 interface Dialer0 5006
ip nat inside source static udp 192.168.1.10 8080 interface Dialer0 8080
ip nat inside source static udp 192.168.1.10 5060 interface Dialer0 5060
ip nat inside source static udp 192.168.1.10 6060 interface Dialer0 6060
ip nat inside source static tcp 192.168.1.10 6060 interface Dialer0 6060
!
ip access-list extended vpn_office
 permit ip 192.168.1.0 0.0.0.255 10.4.0.0 0.0.0.255
!
no logging trap
logging 192.168.1.20
logging 87.xxx.xxx.xx
access-list 1 remark SDM_ACL Category=16
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 1 permit 10.4.0.0 0.0.0.255
access-list 100 deny   ip 192.168.1.0 0.0.0.255 10.4.0.0 0.0.0.7
access-list 101 remark auto generated by SDM firewall configuration
access-list 101 remark SDM_ACL Category=1
access-list 101 permit tcp any any eq 1028
access-list 101 permit udp any any eq 1028
access-list 101 permit tcp any any eq 1025
access-list 101 permit udp any any eq 1025
access-list 101 permit udp any any eq 8070
access-list 101 permit tcp any any eq 8070
access-list 101 permit tcp any any eq 8090
access-list 101 permit udp any any eq 8090
access-list 101 permit udp any any eq 3478
access-list 101 permit tcp any any eq 3478
access-list 101 permit tcp any any eq 7777
access-list 101 permit udp any any eq 7777
access-list 101 permit tcp any any eq 5555
access-list 101 permit udp any any eq 5555
access-list 101 permit tcp any any eq 5080
access-list 101 permit udp any any eq 5080
access-list 101 permit udp any any eq 4444
access-list 101 permit tcp any any eq 4444
access-list 101 permit udp any any eq 1027
access-list 101 permit tcp any any eq 1027
access-list 101 permit udp any any eq 1026
access-list 101 permit tcp any any eq 1026
access-list 101 permit udp any any eq 1024
access-list 101 permit tcp any any eq 1024
access-list 101 permit udp any any eq 3389
access-list 101 permit tcp any any eq smtp
access-list 101 permit tcp any any eq pop3
access-list 101 permit tcp any any eq 143
access-list 101 permit tcp any any eq 2111
access-list 101 permit udp any any eq 2111
access-list 101 permit tcp any any eq 8282
access-list 101 permit udp any any eq 8282
access-list 101 permit udp any any eq 5061
access-list 101 permit tcp any any eq 5061
access-list 101 permit tcp any any eq 5060
access-list 101 permit udp any any eq 5060
access-list 101 permit udp any any eq 9000
access-list 101 permit tcp any any eq 9000
access-list 101 permit tcp any any eq 8888
access-list 101 permit udp any any eq 8888
access-list 101 permit tcp any any eq 8080
access-list 101 permit udp any any eq 7000
access-list 101 permit tcp any any eq 7000
access-list 101 permit tcp any any eq 8181
access-list 101 permit udp any any eq 8181
access-list 101 permit udp any any eq 8088
access-list 101 permit udp any any eq 23560
access-list 101 permit tcp any any eq 23560
access-list 101 permit tcp any any eq 8088
access-list 101 permit udp any any eq 3306
access-list 101 permit tcp any any eq 3306
access-list 101 permit udp any any eq 25
access-list 101 permit udp any any eq 5481
access-list 101 permit tcp any any eq 5481
access-list 101 permit udp any any eq 5000
access-list 101 permit tcp any any eq 5000
access-list 101 permit tcp any any eq 2121
access-list 101 permit udp any any eq 2121
access-list 101 permit tcp any any eq 9191
access-list 101 permit udp any any eq 9191
access-list 101 permit udp any any eq 30000
access-list 101 permit tcp any any eq 30000
access-list 101 permit tcp any any eq 137
access-list 101 permit udp any any eq netbios-ns
access-list 101 permit udp any any eq netbios-dgm
access-list 101 permit tcp any any eq 138
access-list 101 permit udp any any eq netbios-ss
access-list 101 permit tcp any any eq 139
access-list 101 permit tcp any any eq 3389
access-list 101 permit udp host 85.xx.xx.x eq domain any
access-list 101 permit udp host 85.xx.xx.xx eq domain any
access-list 101 permit ip 192.168.1.0 0.0.0.255 any
access-list 101 permit icmp any any echo-reply
access-list 101 permit icmp any any time-exceeded
access-list 101 permit icmp any any unreachable
access-list 101 deny   ip 10.0.0.0 0.255.255.255 any
access-list 101 deny   ip 172.16.0.0 0.15.255.255 any
access-list 101 deny   ip 192.168.0.0 0.0.255.255 any
access-list 101 deny   ip 127.0.0.0 0.255.255.255 any
access-list 101 deny   ip host 255.255.255.255 any
access-list 101 deny   ip host 0.0.0.0 any
access-list 101 deny   ip any any
access-list 101 remark auto generated by SDM firewall configuration
access-list 101 remark SDM_ACL Category=1
access-list 101 permit udp any any eq 5599
access-list 101 permit tcp any any eq 5599
access-list 101 permit ip 10.4.0.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 101 permit udp any any eq isakmp
access-list 101 remark No NAT for VPN traffic
access-list 101 permit ip 192.168.1.0 0.0.0.255 10.4.0.0 0.0.0.255
access-list 102 remark SDM_ACL Category=4
access-list 102 permit ip 192.168.1.0 0.0.0.255 any
access-list 103 remark SDM_ACL Category=4
access-list 103 permit ip 192.168.1.0 0.0.0.255 any
access-list 110 remark --------------- voip -------------
access-list 110 permit udp any host 88.xxx.xxx.xx eq 5060
access-list 110 permit tcp any host 88.xxx.xxx.xx eq 5060
access-list 110 permit udp any host 88.xxx.xxx.xx eq 5080
access-list 110 permit tcp any host 88.xxx.xxx.xx eq 5080
access-list 110 permit tcp any host 88.xxx.xxx.xx eq 5061
access-list 110 permit udp any host 88.xxx.xxx.xx eq 5061
access-list 110 remark --------------- telefoni ---------
access-list 110 permit udp any host 88.xxx.xxx.xx eq 7777
access-list 110 permit tcp any host 88.xxx.xxx.xx eq 7777
access-list 110 permit tcp any host 88.xxx.xxx.xx eq 4444
access-list 110 permit udp any host 88.xxx.xxx.xx eq 4444
access-list 110 permit udp any host 88.xxx.xxx.xx eq 5555
access-list 110 permit tcp any host 88.xxx.xxx.xx eq 5555
access-list 110 permit tcp any any established
access-list 110 remark --------------- Filtro ICMP ------
access-list 110 deny   icmp any any echo
access-list 110 permit icmp any any echo-reply
access-list 110 remark --------------- Other ------------
access-list 110 permit udp any eq ntp host 88.xxx.xxx.xx
access-list 110 permit udp any eq domain host 88.xxx.xxx.xx
access-list 110 permit tcp any host 88.xxx.xxx.xx eq smtp
access-list 110 permit tcp any host 88.xxx.xxx.xx eq pop3
access-list 110 permit tcp any host 88.xxx.xxx.xx eq 1026
access-list 110 permit tcp any host 88.xxx.xxx.xx eq 1027
access-list 110 permit udp any host 88.xxx.xxx.xx eq 1026
access-list 110 permit udp any host 88.xxx.xxx.xx eq 1027
access-list 110 permit udp any host 88.xxx.xxx.xx eq 8090
access-list 110 permit tcp any host 88.xxx.xxx.xx eq 8090
access-list 110 permit tcp any host 88.xxx.xxx.xx eq 8070
access-list 110 permit udp any host 88.xxx.xxx.xx eq 8070
access-list 110 permit udp any host 88.xxx.xxx.xx eq 1025
access-list 110 permit tcp any host 88.xxx.xxx.xx eq 1025
access-list 110 permit tcp any host 88.xxx.xxx.xx eq 3306
access-list 110 permit udp any host 88.xxx.xxx.xx eq 3306
access-list 110 permit tcp any host 88.xxx.xxx.xx eq 139
access-list 110 permit udp any host 88.xxx.xxx.xx eq netbios-ss
access-list 110 permit tcp any host 88.xxx.xxx.xx eq 138
access-list 110 permit udp any host 88.xxx.xxx.xx eq netbios-dgm
access-list 110 permit udp any host 88.xxx.xxx.xx eq netbios-ns
access-list 110 permit tcp any host 88.xxx.xxx.xx eq 137
access-list 110 permit tcp any host 88.xxx.xxx.xx eq 135
access-list 110 permit tcp any host 88.xxx.xxx.xx eq 143
access-list 110 permit udp any host 88.xxx.xxx.xx eq 143
access-list 110 permit tcp any host 88.xxx.xxx.xx eq 5481
access-list 110 permit udp any host 88.xxx.xxx.xx eq 5481
access-list 110 permit tcp any host 88.xxx.xxx.xx eq 30000
access-list 110 permit udp any host 88.xxx.xxx.xx eq 30000
access-list 110 permit udp any host 88.xxx.xxx.xx eq 9191
access-list 110 permit tcp any host 88.xxx.xxx.xx eq 9191
access-list 110 permit tcp any host 88.xxx.xxx.xx eq 3478
access-list 110 permit udp any host 88.xxx.xxx.xx eq 3478
access-list 110 permit udp any host 88.xxx.xxx.xx eq 1028
access-list 110 permit tcp any host 88.xxx.xxx.xx eq 1028
access-list 110 permit tcp any host 88.xxx.xxx.xx eq 8088
access-list 110 permit udp any host 88.xxx.xxx.xx eq 8088
access-list 110 permit tcp any host 88.xxx.xxx.xx eq 23560
access-list 110 permit udp any host 88.xxx.xxx.xx eq 23560
access-list 110 permit udp any host 88.xxx.xxx.xx eq 8181
access-list 110 permit tcp any host 88.xxx.xxx.xx eq 8181
access-list 110 permit tcp any host 88.xxx.xxx.xx eq 7000
access-list 110 permit udp any host 88.xxx.xxx.xx eq 7000
access-list 110 permit tcp any host 88.xxx.xxx.xx eq 5000
access-list 110 permit udp any host 88.xxx.xxx.xx eq 5000
access-list 110 permit udp any host 88.xxx.xxx.xx eq 8888
access-list 110 permit tcp any host 88.xxx.xxx.xx eq 8888
access-list 110 permit tcp any host 88.xxx.xxx.xx range 9000 9020
access-list 110 permit udp any host 88.xxx.xxx.xx range 9000 9020
access-list 110 permit udp any host 88.xxx.xxx.xx eq 8282
access-list 110 permit tcp any host 88.xxx.xxx.xx eq 8282
access-list 110 permit tcp any host 88.xxx.xxx.xx eq 1024
access-list 110 permit udp any host 88.xxx.xxx.xx eq 1024
access-list 110 permit udp any host 88.xxx.xxx.xx eq 2121
access-list 110 permit tcp any host 88.xxx.xxx.xx eq 2121
access-list 110 permit tcp any host 88.xxx.xxx.xx eq 3389
access-list 110 permit udp any host 88.xxx.xxx.xx eq 3389
access-list 110 permit tcp any host 88.xxx.xxx.xx eq 2111
access-list 110 permit udp any host 88.xxx.xxx.xx eq 2111
access-list 110 permit tcp any host 88.xxx.xxx.xx eq 445
access-list 110 permit udp any host 88.xxx.xxx.xx eq 2947
access-list 110 permit tcp any host 88.xxx.xxx.xx eq 22
access-list 110 deny   ip any host 88.xxx.xxx.xx log
access-list 110 permit ip any any log
dialer-list 1 protocol ip permit
no cdp run

!
!
!
!
!
!
control-plane
!
!
!

end

[Rizio]

Purtroppo alzo le mani, con una configurazione così... "piena" non mi sento di consigliarti di fare esperimenti e, considerando che non l'ho mai implementata su un router ma solo sui firewall, sarebbe un esperimento.
Al posto tuo cercherei di mettere su un ambiente di test, magari con GNS, e la proverei lì, nei limiti del possibile.
Se proprio non ti piace lavorare lì e ti và di essere invitato dal tuo capo a cambiare posto di lavoro potresti provare a creare un'access list avente comesorgente gli IP che NON vuoi nattare e creare un nat statico (ip nat inside) dell'access-l nella direzione che ti interessa dandogli la stessa classe che ha come sorgente..... non sò, io cercherei di fare così, ma in una configurazione di test o comunque non con il router in produzione.
Il problema, per quanto mi riguarda è capire che non ci siano implicazioni nelle altre 2000 regole che hai su quello che vuoi fare.

Rizio

P.S. Toglietemi una curiosità, gli object-group sul 1841 non si possono mettere?!?!?! Miiiinchia!!!

[zele20]

Effettivamente dovrei partire almeno da una configurazione pulita e poi aggiungere di volta in volta i nat anche perchè la configurazione è stata un po' sporcata da tutti i test che ho fatto!

[zot]

Il pool di indirizzi VPNPOOL overlappa con quello della loopback0, le ACL 101 e 110 non le vedo applicate da nessuna parte, hai 2 PAT sulla Dialer0 con relative ACL......
Avrai capito che questa conf mi sembra proprio un gran bel bordello, se usi SDM sara' sempre cosi'.
Per il tuo problema dovresti risolvere con route-map e relative ACL sia sul PAT (overload) che sulla crypto map VPN-STATIC .

[Rizio]

Il pool di indirizzi VPNPOOL overlappa con quello della loopback0, le ACL 101 e 110 non le vedo applicate da nessuna parte, hai 2 PAT sulla Dialer0 con relative ACL......
Avrai capito che questa conf mi sembra proprio un gran bel bordello, se usi SDM sara' sempre cosi'.
Per il tuo problema dovresti risolvere con route-map e relative ACL sia sul PAT (overload) che sulla crypto map VPN-STATIC .

E qui ti sei meritato l'applauso


Rizio

[zele20]

Diciamo che la configurazione è un casino anche per via delle mille prove che sono state fatte, adesso vorrei ripristinare (senza VPN) e ricominciare con la configurazione.
L'interfaccia di loopback0 infatti era stata creata da una configurazione trovata su una guida.
Ho un'altra interfaccia di rete libera sul router potrei associare questa interfaccia per l'accesso alla vpn in modo tale da non andare in conflitto con quella privata dove sono configurati i NAT ?

Scusate le domande e la poca chiarezza ma sono da poco entranto nel mondo Cisco (forse non era nemmeno necessario dirlo :p)

Grazie a tutti per l'interessamento.

[zot]

Non ti serve nessuna interfaccia in piu', le VPN la farai terminare su quella pubblica.
Per NAT, lo devi applicare con delle route-map.
Ti consiglio di leggere i topic messi in evidenza su questa sezione.