VPN e share di rete

[teclan77]

Ciao ragazzi, vorrei un po' di aiuto su questa conf che non riesco a far funzionare correttamente, il router e' un 827-4V , ho due reti private:

192.168.2.0 -> NAT -> 80.87.x.x ( router 827)
192.168.1.0 -> NAT -> 80.87.x.x ( router USR ) + Cisco VPN Client

su un host delle rete 192.168.1.0 ho installato il VPN Client Cisco , il tunnel va su correttamente e , seguendo le indicazioni del forum, ho configurato il router per fare il DE-NAT, il risultato e' che il pc con
il cisco Client fa il ping a tutte le macchine della rete 192.168.2.0 ma non riesce a fare una share di rete ( es. \\192.168.2.2\condivisione) viceversa i pc dietro al router Cisco riescono a pingare e aprire share sul pc dove
e' installato il Cisco Client, perchè ? cosa mi manca per completare correttamente la mia config? Grazie

sh run
Building configuration...

Current configuration : 7235 bytes
!
version 12.3
no service pad
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname ROUTER
!
boot-start-marker
boot-end-marker
!
enable secret 5 XXXXXXXXX
enable password 7 XXXXXXXXXX
!
username XXXXXXXXX password 7 XXXXXXXXXXXXXXXXXXX
username XXXXXXXXX password 7 XXXXXXXXXXXXXXXXXXX
aaa new-model
!
!
aaa authentication login LISTA-UTENTI-VPN local
aaa authorization network GRUPPO-UTENTI-VPN local
aaa session-id common
ip subnet-zero
no ip source-route
!
!
ip name-server 80.87.16.1
ip name-server 80.87.16.2
!
!
!
!
!
crypto isakmp policy 10
encr 3des
authentication pre-share
group 5
!
crypto isakmp policy 20
encr 3des
authentication pre-share
group 2
crypto isakmp client configuration address-pool local VPN-CLIENT-POOL
!
crypto isakmp client configuration group MYUSER
key XXXXXXXXXXXXXX
dns 80.87.16.1 80.87.16.2
pool VPN-CLIENT-POOL
acl 199
include-local-lan
netmask 255.255.255.0
!
!
crypto ipsec transform-set myset esp-des esp-md5-hmac
crypto ipsec transform-set myset1 esp-3des esp-md5-hmac
!
crypto ipsec profile CRYPTO-VPN
!
!
!
crypto dynamic-map VPNDYNAMIC 1
set transform-set myset
reverse-route
!
!
crypto map CRYPTO-VPN client authentication list LISTA-UTENTI-VPN
crypto map CRYPTO-VPN isakmp authorization list GRUPPO-UTENTI-VPN
crypto map CRYPTO-VPN client configuration address respond
crypto map CRYPTO-VPN 1 ipsec-isakmp dynamic VPNDYNAMIC
!
!
!
!
interface Tunnel0
no ip address
shutdown
!
interface Ethernet0
ip address 192.168.2.1 255.255.255.0
ip nat inside
ip virtual-reassembly
crypto map CRYPTO-VPN
hold-queue 100 out
!
interface ATM0
bandwidth 320
no ip address
ip nat outside
ip virtual-reassembly
atm ilmi-keepalive
bundle-enable
dsl operating-mode auto
pvc 8/35
encapsulation aal5mux ppp dialer
dialer pool-member 1
!
!
interface Dialer0
bandwidth 12000
ip address negotiated
ip access-group 102 in
ip nat outside
ip virtual-reassembly
encapsulation ppp
dialer pool 1
ppp authentication chap pap callin
ppp chap hostname XXXXXXXXXX
ppp chap password 7 XXXXXXXXXXXX
ppp pap sent-username XXXXXXXXX password 7 XXXXXXX
!
ip local pool VPN-CLIENT-POOL 192.168.2.4
ip classless
ip route 0.0.0.0 0.0.0.0 Dialer0
ip route 192.168.2.4 255.255.255.255 Dialer0
no ip http server
no ip http secure-server
ip nat inside source list 199 interface Dialer0 overload
ip nat inside source static tcp 192.168.2.2 4662 interface Dialer0 4662
ip nat inside source static udp 192.168.2.2 4672 interface Dialer0 4672
!
!
access-list 199 deny ip 192.168.2.0 0.0.0.255 host 192.168.2.4
access-list 199 permit ip 192.168.2.0 0.0.0.255 any
dialer-list 1 protocol ip permit
!
!
control-plane
!
!
line con 0
transport preferred all
transport output all
stopbits 1
line vty 0 4
transport preferred none
transport input all
transport output all
!
scheduler max-task-time 5000
end

[Wizard]

Sembra che manchi la crypto ACL...rifai così:

crypto isakmp client configuration group ****
key ***
pool ***
acl 151

access-list 151 rem *** ACL PER SPLIT-TUNNEL DA VPN-CLIENT ***
access-list 151 permit ip 192.168.2.0 0.0.0.255 host 192.168.2.4

[teclan77]

grazie per i consigli,
dal client VPN il ping va verso tutta la rete 192.168.2.0,
dalla rete 192.168.2.0 riesco a pingare il client correttamente
connesso, pero' il pc remoto NON appare nell'elenco dei
pc del mio WORKGROUP

chiarisco la mia situazione:
192.168.2.2 HOST_A ( rete connessa al router Cisco 192.168.2.0)
192.168.2.4 HOST_VPN ( Cisco VPN Client da rete 192.168.1.0)
WORKGROUP = MYLAN

penso piu' ad un problema di SO ( tutti Windows XP) nell'elezione
del Master Browser , le porte che usa Microsoft dei PC sono correttamente in ascolto e raggiungibili ma il PC non appare nella stessa rete,
lo scanner di rete sull'host VPN 192.168.2.4 mi dice
SAME NETWORK SEGMENT

qualche consiglio per risolvere questo problema?

[teclan77]

Aggiornamento:

VPN's do not forward broadcasts, see if you can setup the GRE tunnel inside the VPN tunnel


questo e' riferito ad una site-to-site con 2 router, ma come realizzare questa cosa con una Router e un client software?