VPN Cisco 1721

[f4kinup]

Cambia così:

crypto isakmp client configuration group home_vpn
key X.X.X.X
dns 1.253.128.10
domain local
pool vpn_pool
acl SPLIT

ip access-list extended SPLIT
permit ip 192.168.1.0 0.0.0.255 any

fatto ma non va ancora..
ma nella SPLIT devo mettere la LAN o la VPN ??

grazie!!

[[email protected]]

la LAN

[f4kinup]

ok fatto ma non va...
non riesco ad'avviare ne VNC ne ftp sul 192.168.1.200

[paolo563]

Hai risolto ?
Se no fai attenzione a una cosa che per distrazione mi è successa a me .......

Rete locale lato Router Cisco VPN 192.168.1.0

Rete Locale Lato Client che si connette in VPN 192.168.1.0

NON FUNZIONERA' MAI !!!!!!

La rete del Client deve essere diversa dalla rete del Terget VPN !!!!

Forse avrò detto una cosa banale .... ma a volte sono proprio le cose banali a mandarci in tilt; pensiamo a chissa che cosa e poi la soluzione è molto più banale del previsto.

[f4kinup]

Ciao, sisi LAN 192.168.1.0 Client VPN 192.168.0.0,
riesco a connettermi e vedere gli HD di rete senza problemi ma non riesco ad'avviare l'ftp ne tantomeno avviare una sessione vnc sulla macchina della lan.
ho notato un altra cosa quando avvio una sessione e provo a lanciare un film che sta sul disco remoto l'uso del processore del router va a 99%
provocando una visione non fluida del video e un rallentamento notevole del router.


ciao.

[[email protected]]

sh run... magari hai qualche acl che ti blocca

[f4kinup]

eccolo...

Building configuration...

Current configuration : 4200 bytes
!
! Last configuration change at 00:06:13 MET Sat Jul 28 2007 by XXXXXXX
! NVRAM config last updated at 18:27:26 MET Fri Jul 27 2007 by XXXXXXX
!
version 12.3
no parser cache
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname Homer
!
boot-start-marker
boot system flash:c1700-k9o3sy7-mz.123-21.bin
boot-end-marker
!
logging buffered 4096 debugging
enable secret 5 XXXXXXXXXXXXXXXXXXXXX
!
memory-size iomem 25
clock timezone MET 1
clock summer-time MET recurring
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
aaa new-model
!
!
aaa authentication login home_vpn local
aaa authorization network vpn_group local
aaa session-id common
ip subnet-zero
no ip source-route
!
!
no ip domain lookup
ip domain name open1
ip dhcp excluded-address 192.168.1.240 192.168.1.254
!
ip dhcp pool Open1
network 192.168.1.0 255.255.255.0
domain-name Open1
dns-server 213.140.2.43 213.140.2.49
default-router 192.168.1.254
!
ip cef
ip audit po max-events 100
!
!
username XXXXXXX password 0 XXXXXXX
username XXXXXXX password 0 XXXXXXX
!
!
!
crypto isakmp policy 3
encr 3des
authentication pre-share
group 2
!
crypto isakmp client configuration group home_vpn
key XXXXXXX
dns 1.253.128.10
domain local
pool vpn_pool
acl 108
!
!
crypto ipsec transform-set vpn_home esp-3des esp-md5-hmac
!
crypto dynamic-map dynmap 10
set transform-set vpn_home
reverse-route
!
!
crypto map clientmap client authentication list home_vpn
crypto map clientmap isakmp authorization list vpn_group
crypto map clientmap client configuration address respond
crypto map clientmap 10 ipsec-isakmp dynamic dynmap
!
!
!
interface Ethernet0
description #### Collegamento WAN ####
ip address X.X.X.X 255.255.255.0
ip nat outside
half-duplex
crypto map clientmap
!
interface FastEthernet0
description #### Collegamento Switch ####
ip address 192.168.1.254 255.255.255.0
ip nat inside
speed 100
full-duplex
!
router rip
passive-interface default
no passive-interface Ethernet0
no passive-interface FastEthernet0
network 192.168.1.0
no auto-summary
!
ip local pool vpn_pool 192.168.0.1 192.168.0.14 group vpn_group
ip nat translation timeout 10
ip nat translation tcp-timeout 300
ip nat translation udp-timeout 301
ip nat translation dns-timeout 10
ip nat translation icmp-timeout 10
ip nat translation port-timeout udp 4673 10
ip nat translation port-timeout tcp 4663 10
ip nat translation port-timeout tcp 20 1000
ip nat translation port-timeout tcp 21 1000
ip nat translation port-timeout udp 20 1000
ip nat translation port-timeout udp 21 1000
ip nat inside source list 108 interface Ethernet0 overload
ip nat inside source route-map vpn_map interface Ethernet0 overload
ip nat inside source static tcp 192.168.1.200 139 X.X.X.X 139 extendable
ip nat inside source static tcp 192.168.1.200 5900 X.X.X.X 8000 extendable
ip nat inside source static tcp 192.168.1.200 4663 X.X.X.X 4663 extendable
ip nat inside source static udp 192.168.1.200 4673 X.X.X.X 4673 extendable
ip nat inside source static tcp 192.168.1.200 21 X.X.X.X 21 extendable
ip nat inside source static tcp 192.168.1.100 3724 X.X.X.X 3724 extendable
ip nat inside source static tcp 192.168.1.100 6881 X.X.X.X 6881 extendable
ip nat inside source static tcp 192.168.1.100 6112 X.X.X.X 6112 extendable
ip nat inside source static tcp 192.168.1.106 3724 X.X.X.X 3724 extendable
ip nat inside source static tcp 192.168.1.106 6881 X.X.X.X 6881 extendable
ip nat inside source static tcp 192.168.1.106 6112 X.X.X.X 6112 extendable
ip nat inside source static tcp 192.168.1.200 80 X.X.X.X 80 extendable
ip classless
ip route 0.0.0.0 0.0.0.0 X.X.X.X
no ip http server
no ip http secure-server
!
!
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 108 deny ip 192.168.1.0 0.0.0.255 192.168.0.0 0.0.0.255
access-list 108 permit ip 192.168.1.0 0.0.0.255 any
!
tftp-server flash:c1700-k9o3sy7-mz.123-21.bin
snmp-server community home RO 1
!
!
line con 0
line aux 0
line vty 0 4
exec-timeout 5 0
transport input telnet ssh
!
sntp server 1.41.0.1
sntp server 1.41.0.2
sntp server 1.41.0.3
ntp clock-period 17180041
end

Homer#


Ciao.

[[email protected]]

Non hai acl che ti bloccano. Non è che hai qualche firewall sul pc che ti blocca?

[f4kinup]

niente di niente... lo stesso pc quando collegato in lan o se provo ad'accedere in ftp senza VPN funziona correttamente.