Premetto dicendo che conosco molto poco i router cisco, ma mi sono trovato a dover configurare una vpn tra due rt gemelli 857.
PANICO
il primo approcio con la GUI sdm è stto (e lo è ancora) disastroso.
Ho provato in 1000 modi a rifare la configurazione del tunnel, ma mi da sempre un sacco di problemi!!
Sbaglierò io ... bhe direi sicuramente.
Qualcuno mi saprebbe dire i comandi da usare via ssh o da console per far funzionare questa benedetta VPN?
grazie
Di seguito inserisco la configurazione di uno dei 2 router, ma vi avviso che non è molto chiara e ci sono un sacco di impostazioni che no riesco arimuovere, come le access-list doppie ...
HELP !
[/quote]!This is the running config of the router: 85.xx.xxx.185
!----------------------------------------------------------------------------
!version 12.3
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname yourname
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 debugging
logging console critical
enable secret 5 $1$7N65$G8p9K90eX0sp.pNeGPuDd0
!
username admin privilege 15 secret 5 $1$FpBP$6aUnu12X9Zr.8qTYntUUe1
clock timezone PCTime 1
clock summer-time PCTime date Mar 30 2003 2:00 Oct 26 2003 3:00
aaa new-model
!
!
aaa authentication login rt-remote local
aaa authorization network rt-remote local
aaa session-id common
ip subnet-zero
no ip source-route
ip dhcp excluded-address 85.xx.xxx.185
ip dhcp excluded-address 85.xx.xxx.190
ip dhcp excluded-address xxx.xxx.78.1 xxx.xxx.78.199
ip dhcp excluded-address xxx.xxx.78.211 xxx.xxx.78.254
ip dhcp excluded-address xxx.xxx.80.1 xxx.xxx.80.199
ip dhcp excluded-address xxx.xxx.80.221 xxx.xxx.80.254
!
ip dhcp pool sdm-pool1
import all
network xxx.xxx.80.0 255.255.255.0
dns-server 212.17.192.216 212.17.192.56
default-router xxx.xxx.80.2
!
!
ip cef
ip inspect name default esmtp
ip inspect name default tcp
ip inspect name default udp
ip inspect name default cuseeme
ip inspect name default realaudio
ip inspect name default rtsp
ip inspect name default streamworks
ip inspect name default vdolive
ip tcp synwait-time 10
no ip bootp server
ip domain name yourdomain.com
ip name-server 212.17.192.216
ip name-server 212.17.192.56
ip ssh time-out 60
ip ssh authentication-retries 2
no ftp-server write-enable
!
!
!
!
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key assizorzi address 85.xx.xxx.209
!
crypto ipsec security-association lifetime seconds 86400
!
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
!
crypto ipsec client ezvpn ezvpnclient
connect auto
group ezvpnclient key 6 superzorzi
mode client
peer xx.xxx.5.2
peer xx.xxx.5.254
peer xx.xxx.5.245
xauth userid mode interactive
!
!
crypto dynamic-map dynmap 1
reverse-route
!
!
crypto map SDM_CMAP_1 1 ipsec-isakmp
description Tunnel to85.xx.xxx.209
set peer 85.xx.xxx.209
set security-association lifetime seconds 3600
set transform-set ESP-3DES-SHA
match address 100
!
crypto map static-map 1 ipsec-isakmp dynamic dynmap
!
!
!
interface Loopback0
ip address 85.xx.xxx.185 255.255.255.248
!
interface ATM0
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip route-cache flow
no atm ilmi-keepalive
dsl operating-mode auto
!
interface ATM0.1 point-to-point
description $ES_WAN$$FW_OUTSIDE$
pvc 8/35
encapsulation aal5mux ppp dialer
dialer pool-member 1
!
!
interface FastEthernet0
no ip address
no cdp enable
!
interface FastEthernet1
no ip address
no cdp enable
!
interface FastEthernet2
no ip address
no cdp enable
!
interface FastEthernet3
no ip address
no cdp enable
crypto map static-map
crypto ipsec client ezvpn ezvpnclient
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$ES_LAN$$FW_INSIDE$
ip address xxx.xxx.80.2 255.255.255.0
ip access-group sdm_vlan1_in in
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip virtual-reassembly
ip route-cache flow
ip tcp adjust-mss 1452
!
interface Dialer0
ip address negotiated
ip access-group sdm_dialer0_in in
no ip redirects
no ip unreachables
no ip proxy-arp
ip inspect default out
ip nat outside
ip virtual-reassembly
encapsulation ppp
ip route-cache flow
dialer pool 1
dialer-group 1
no cdp enable
ppp authentication chap callin
ppp chap hostname xxxxxxxxxx@albadsl
ppp chap password 7 xxxxxxxxxxxxxx
crypto map SDM_CMAP_1
!
router rip
network 10.0.0.0
no auto-summary
!
ip local pool dynpool xxx.xxx.80.1
ip classless
ip route 0.0.0.0 0.0.0.0 Dialer0
!
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 5 life 86400 requests 10000
ip nat inside source route-map SDM_RMAP_1 interface Dialer0 overload
!
ip access-list extended sdm_dialer0_in
remark SDM_ACL Category=1
permit udp host 85.xx.xxx.209 any eq non500-isakmp
permit udp host 85.xx.xxx.209 any eq isakmp
permit esp host 85.xx.xxx.209 any
permit ahp host 85.xx.xxx.209 any
permit udp any any eq non500-isakmp
permit udp any any eq isakmp
permit esp any any
permit ahp any any
remark IPSec Rule
permit ip xxx.xxx.80.0 0.0.0.255 xxx.xxx.80.0 0.0.0.255
remark treviso
permit ip host 85.xx.xxx.209 any
remark me2
permit ip host xxx.xxx.xxx.xxx any
permit ip xx.xxx.5.0 0.0.0.255 xxx.xxx.80.0 0.0.0.255
permit udp any eq non500-isakmp any
permit udp any eq isakmp any
remark support me
permit ip host xxx.xxx.xxx.xxx any
remark me
permit ip host xxx.xxx.xxx.xxx any
permit udp any eq domain any
permit udp host 212.216.112.112 eq domain any
permit udp host 194.20.8.1 eq domain any
deny ip xxx.xxx.80.0 0.0.0.255 any
permit icmp any any echo-reply
permit icmp any any time-exceeded
permit icmp any any unreachable
deny ip 10.0.0.0 0.255.255.255 any
deny ip 172.16.0.0 0.15.255.255 any
deny ip 192.168.0.0 0.0.255.255 any
deny ip 127.0.0.0 0.255.255.255 any
deny ip host 255.255.255.255 any
deny ip host 0.0.0.0 any
deny ip any any
remark IPSec Rule
ip access-list extended sdm_vlan1_in
remark SDM_ACL Category=1
permit udp host 85.xx.xxx.209 host xxx.xxx.80.2 eq non500-isakmp
permit udp host 85.xx.xxx.209 host xxx.xxx.80.2 eq isakmp
permit esp host 85.xx.xxx.209 host xxx.xxx.80.2
permit ahp host 85.xx.xxx.209 host xxx.xxx.80.2
deny ip host 255.255.255.255 any
deny ip 127.0.0.0 0.255.255.255 any
permit ip any any
!
logging trap debugging
access-list 1 remark INSIDE_IF=Vlan1
access-list 1 remark SDM_ACL Category=2
access-list 1 permit xxx.xxx.80.0 0.0.0.255
access-list 100 remark SDM_ACL Category=4
access-list 100 remark IPSec Rule
access-list 100 permit ip xxx.xxx.80.0 0.0.0.255 xx.xxx.5.0 0.0.0.255
access-list 101 remark SDM_ACL Category=2
access-list 101 remark IPSec Rule
access-list 101 deny ip xxx.xxx.80.0 0.0.0.255 xx.xxx.5.0 0.0.0.255
access-list 101 remark IPSec Rule
access-list 101 remark IPSec Rule
access-list 101 deny ip xxx.xxx.80.0 0.0.0.255 xxx.xxx.80.0 0.0.0.255
access-list 101 remark IPSec Rule
access-list 101 permit ip xxx.xxx.80.0 0.0.0.255 any
dialer-list 1 protocol ip permit
no cdp run
route-map SDM_RMAP_1 permit 1
match ip address 101
!
!
control-plane
!
banner login ^CAuthorized access only!
Disconnect IMMEDIATELY if you are not an authorized user!^C
!
line con 0
no modem enable
transport preferred all
transport output telnet
line aux 0
transport preferred all
transport output telnet
line vty 0 4
privilege level 15
transport preferred all
transport input telnet ssh
transport output all
!
scheduler max-task-time 5000
scheduler allocate 4000 1000
scheduler interval 500
end
I cisco sono delle belle bestie, molto toste, ma quando ci prendi la mano vedi la vera putenza dell'IOS rispetto ai routerini da 90 euro 