Buona sera a tutti,
vi scrivo in quanto sto tentando di collegare 2 cisco 837 in vpn tra di loro ma dopo aver configurato i due router con il comando show crypto isakmp sa non c'e' nessun tunnel attivo.
Di seguito riporto la configurazione che ho impostato sui due router ipotetici:
Immaginiamo la rete A:
IP Privati 192.168.1.0
Ip Pubblico: 82.88.88.125
Immaginiamo la rete B:
IP Privati 192.168.2.0
Ip Pubblico: 82.88.99.99
Router A:
Cripto isakmp policy 1
Encr des
Hash md5
Authentication pre-share
Group 1
Cripto isakmp key password address 82.88.99.99
Crypto ipsec transorm-set vpn esp-3des esp-md5-hmac
Crypto map vpn 10 ipsec-isakmp
Set peer 82.88.99.99
Set transform-set vpn
Match address 101
Interface Dialer1 (ha come ip 82.88.88.125, visto da show ip interface brief)
Cripto map vpn
Access-list 110 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
Router B:
Cripto isakmp policy 1
Encr des
Hash md5
Authentication pre-share
Group 1
Cripto isakmp key password address 82.88.88.125
Crypto ipsec transorm-set vpn esp-3des esp-md5-hmac
Crypto map vpn 10 ipsec-isakmp
Set peer 82.88.88.125
Set transform-set vpn
Match address 101
Interface Dialer1 (ha come ip 82.88.99.99, visto da show ip interface brief)
Cripto map vpn
Access-list 110 permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
Vi ringrazio in anticipo
Dok
VPN tra cisco 837
Moderatore: Federico.Lagni
-
- n00b
- Messaggi: 23
- Iscritto il: gio 30 dic , 2004 7:21 pm
io non ne capisco tanto, però hai dato un'occhiata a questo?
http://www.cisco.com/en/US/products/hw/ ... #wp1087165
http://www.cisco.com/en/US/products/hw/ ... #wp1087165
-
- Holy network Shaman
- Messaggi: 637
- Iscritto il: gio 07 apr , 2005 9:30 pm
- Località: Cisco Systems Inc. West Tasman Drive 170, San Jose CA
- Contatta:
hai sbagliato ad applicare la crypto access list
sotto la crypto map hai scritto match address 101
mentre la crypto access list ha 110 cm id cotnrolla se hai sbagliato a fare copia incolla qui oppure no.
poi hai messo il comando crypto map "nome crypto map" sotto le interfaccie outside??
sotto la crypto map hai scritto match address 101
mentre la crypto access list ha 110 cm id cotnrolla se hai sbagliato a fare copia incolla qui oppure no.
poi hai messo il comando crypto map "nome crypto map" sotto le interfaccie outside??
CCIE Routing & Switching # 20567
CCNP R&S - CCNP Sec - CCNP Collaboration - CCNP Datacenter - CCDP - VCP6-DCV
-
- Holy network Shaman
- Messaggi: 637
- Iscritto il: gio 07 apr , 2005 9:30 pm
- Località: Cisco Systems Inc. West Tasman Drive 170, San Jose CA
- Contatta:
poi occhio xke se la lan e' nattata su internet devi fare una route-map che blocchi il nat tra la site-to-site senno' la vpn funziona ma nn ti vedi i pc xke il router natta cmq
fai lo sh run dei 2 ruouter e postale complete...
fai lo sh run dei 2 ruouter e postale complete...
CCIE Routing & Switching # 20567
CCNP R&S - CCNP Sec - CCNP Collaboration - CCNP Datacenter - CCDP - VCP6-DCV
-
- Cisco fan
- Messaggi: 67
- Iscritto il: mar 26 lug , 2005 8:52 pm
Ispa ha scritto:poi occhio xke se la lan e' nattata su internet devi fare una route-map che blocchi il nat tra la site-to-site senno' la vpn funziona ma nn ti vedi i pc xke il router natta cmq
fai lo sh run dei 2 ruouter e postale complete...
effettivamente ora mi succedono 2 cose:
1- se faccio ping 192.168.2.200 mi da risposta scaduta. Se invece digito il comando ping e setto tutti i parametri con host di arrivo 192.168.2.200 e interfaccia di partenza 192.168.1.1 il ping viene effettuato
2- non riesco a collegarmi via telnet tra le due reti
Può essere dovuto a quello che mi dicevi tu?
Dok
-
- Cisco fan
- Messaggi: 67
- Iscritto il: mar 26 lug , 2005 8:52 pm
Ecco la conf:
Current configuration : 4397 bytes
!
version 12.3
no service pad
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname Router
!
no logging buffered
enable secret 5 $1$mQg0$GWnultjTZqvDlK6/9/iTP.
!
username Router password 7 xxxxxxxx
username CRWS_Kannan privilege 15 password 7 xxxxxxxx
96B6576465F47
no aaa new-model
ip subnet-zero
ip name-server 62.94.0.1
ip name-server 62.94.0.2
!
ip dhcp pool CLIENT
import all
network 192.168.8.0 255.255.255.0
default-router 192.168.8.1
lease 0 2
!
!
ip inspect name myfw cuseeme timeout 3600
ip inspect name myfw ftp timeout 3600
ip inspect name myfw rcmd timeout 3600
ip inspect name myfw realaudio timeout 3600
ip inspect name myfw smtp timeout 3600
ip inspect name myfw tftp timeout 30
ip inspect name myfw udp timeout 15
ip inspect name myfw tcp timeout 3600
ip inspect name myfw h323 timeout 3600
ip audit notify log
ip audit po max-events 100
no ftp-server write-enable
!
!
!
!
crypto isakmp policy 1
hash md5
authentication pre-share
crypto isakmp key 0 password address 82.88.88.125
!
!
crypto ipsec transform-set vpn esp-3des esp-md5-hmac
!
crypto map vpn 1 ipsec-isakmp
set peer 82.88.88.125
set transform-set vpn
match address 101
!
!
!
!
interface Ethernet0
description CRWS Generated text. Please do not delete this:192.168.8.1-255.255.
255.0
ip address 192.168.8.1 255.255.255.0
ip access-group 122 out
ip nat inside
no ip mroute-cache
hold-queue 100 out
!
interface ATM0
no ip address
no ip mroute-cache
atm vc-per-vp 64
no atm ilmi-keepalive
pvc 8/35
encapsulation aal5mux ppp dialer
dialer pool-member 1
!
dsl operating-mode auto
!
interface FastEthernet1
no ip address
duplex auto
speed auto
!
interface FastEthernet2
no ip address
duplex auto
speed auto
!
interface FastEthernet3
no ip address
duplex auto
speed auto
!
interface FastEthernet4
no ip address
duplex auto
speed auto
!
interface Dialer1
ip address negotiated
ip access-group 111 in
ip nat outside
ip inspect myfw out
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication chap pap callin
ppp chap hostname xxxxxxx
ppp chap password 7 xxxxxxx
ppp pap sent-username xxxxxxx password 7 xxxxxxx
ppp ipcp dns request
ppp ipcp wins request
crypto map vpn
hold-queue 224 in
!
ip nat inside source list 102 interface Dialer1 overload
ip nat inside source static tcp 192.168.8.1 80 interface Dialer1 80
ip nat inside source static tcp 192.168.8.200 1500 interface Dialer1 1500
ip nat inside source static tcp 192.168.8.201 1501 interface Dialer1 1501
ip classless
ip route 0.0.0.0 0.0.0.0 Dialer1
ip http server
no ip http secure-server
!
access-list 101 permit ip 192.168.8.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 111 permit tcp any any eq 1501
access-list 111 permit tcp any any eq 1500
access-list 111 permit tcp any any eq www
access-list 111 permit tcp any any eq telnet
access-list 111 permit icmp any any administratively-prohibited
access-list 111 permit icmp any any echo
access-list 111 permit icmp any any echo-reply
access-list 111 permit icmp any any packet-too-big
access-list 111 permit icmp any any time-exceeded
access-list 111 permit icmp any any traceroute
access-list 111 permit icmp any any unreachable
access-list 111 permit udp any eq bootps any eq bootpc
access-list 111 permit udp any eq bootps any eq bootps
access-list 111 permit udp any eq domain any
access-list 111 permit esp any any
access-list 111 permit udp any any eq isakmp
access-list 111 permit udp any any eq 10000
access-list 111 permit tcp any any eq 1723
access-list 111 permit tcp any any eq 139
access-list 111 permit udp any any eq netbios-ns
access-list 111 permit udp any any eq netbios-dgm
access-list 111 permit gre any any
access-list 111 deny ip any any
access-list 122 deny tcp any any eq telnet
access-list 122 permit ip any any
dialer-list 1 protocol ip permit
!
line con 0
exec-timeout 120 0
no modem enable
stopbits 1
line aux 0
transport input all
line vty 0 4
exec-timeout 120 0
login local
length 0
!
scheduler max-task-time 5000
!
end
Current configuration : 4397 bytes
!
version 12.3
no service pad
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname Router
!
no logging buffered
enable secret 5 $1$mQg0$GWnultjTZqvDlK6/9/iTP.
!
username Router password 7 xxxxxxxx
username CRWS_Kannan privilege 15 password 7 xxxxxxxx
96B6576465F47
no aaa new-model
ip subnet-zero
ip name-server 62.94.0.1
ip name-server 62.94.0.2
!
ip dhcp pool CLIENT
import all
network 192.168.8.0 255.255.255.0
default-router 192.168.8.1
lease 0 2
!
!
ip inspect name myfw cuseeme timeout 3600
ip inspect name myfw ftp timeout 3600
ip inspect name myfw rcmd timeout 3600
ip inspect name myfw realaudio timeout 3600
ip inspect name myfw smtp timeout 3600
ip inspect name myfw tftp timeout 30
ip inspect name myfw udp timeout 15
ip inspect name myfw tcp timeout 3600
ip inspect name myfw h323 timeout 3600
ip audit notify log
ip audit po max-events 100
no ftp-server write-enable
!
!
!
!
crypto isakmp policy 1
hash md5
authentication pre-share
crypto isakmp key 0 password address 82.88.88.125
!
!
crypto ipsec transform-set vpn esp-3des esp-md5-hmac
!
crypto map vpn 1 ipsec-isakmp
set peer 82.88.88.125
set transform-set vpn
match address 101
!
!
!
!
interface Ethernet0
description CRWS Generated text. Please do not delete this:192.168.8.1-255.255.
255.0
ip address 192.168.8.1 255.255.255.0
ip access-group 122 out
ip nat inside
no ip mroute-cache
hold-queue 100 out
!
interface ATM0
no ip address
no ip mroute-cache
atm vc-per-vp 64
no atm ilmi-keepalive
pvc 8/35
encapsulation aal5mux ppp dialer
dialer pool-member 1
!
dsl operating-mode auto
!
interface FastEthernet1
no ip address
duplex auto
speed auto
!
interface FastEthernet2
no ip address
duplex auto
speed auto
!
interface FastEthernet3
no ip address
duplex auto
speed auto
!
interface FastEthernet4
no ip address
duplex auto
speed auto
!
interface Dialer1
ip address negotiated
ip access-group 111 in
ip nat outside
ip inspect myfw out
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication chap pap callin
ppp chap hostname xxxxxxx
ppp chap password 7 xxxxxxx
ppp pap sent-username xxxxxxx password 7 xxxxxxx
ppp ipcp dns request
ppp ipcp wins request
crypto map vpn
hold-queue 224 in
!
ip nat inside source list 102 interface Dialer1 overload
ip nat inside source static tcp 192.168.8.1 80 interface Dialer1 80
ip nat inside source static tcp 192.168.8.200 1500 interface Dialer1 1500
ip nat inside source static tcp 192.168.8.201 1501 interface Dialer1 1501
ip classless
ip route 0.0.0.0 0.0.0.0 Dialer1
ip http server
no ip http secure-server
!
access-list 101 permit ip 192.168.8.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 111 permit tcp any any eq 1501
access-list 111 permit tcp any any eq 1500
access-list 111 permit tcp any any eq www
access-list 111 permit tcp any any eq telnet
access-list 111 permit icmp any any administratively-prohibited
access-list 111 permit icmp any any echo
access-list 111 permit icmp any any echo-reply
access-list 111 permit icmp any any packet-too-big
access-list 111 permit icmp any any time-exceeded
access-list 111 permit icmp any any traceroute
access-list 111 permit icmp any any unreachable
access-list 111 permit udp any eq bootps any eq bootpc
access-list 111 permit udp any eq bootps any eq bootps
access-list 111 permit udp any eq domain any
access-list 111 permit esp any any
access-list 111 permit udp any any eq isakmp
access-list 111 permit udp any any eq 10000
access-list 111 permit tcp any any eq 1723
access-list 111 permit tcp any any eq 139
access-list 111 permit udp any any eq netbios-ns
access-list 111 permit udp any any eq netbios-dgm
access-list 111 permit gre any any
access-list 111 deny ip any any
access-list 122 deny tcp any any eq telnet
access-list 122 permit ip any any
dialer-list 1 protocol ip permit
!
line con 0
exec-timeout 120 0
no modem enable
stopbits 1
line aux 0
transport input all
line vty 0 4
exec-timeout 120 0
login local
length 0
!
scheduler max-task-time 5000
!
end
-
- Holy network Shaman
- Messaggi: 637
- Iscritto il: gio 07 apr , 2005 9:30 pm
- Località: Cisco Systems Inc. West Tasman Drive 170, San Jose CA
- Contatta:
nn ho capito xke hai messo il nat statico...
CCIE Routing & Switching # 20567
CCNP R&S - CCNP Sec - CCNP Collaboration - CCNP Datacenter - CCDP - VCP6-DCV
-
- Holy network Shaman
- Messaggi: 637
- Iscritto il: gio 07 apr , 2005 9:30 pm
- Località: Cisco Systems Inc. West Tasman Drive 170, San Jose CA
- Contatta:
e cmq secondo me si potrebbe ottimizzare quella configurazione eviterei di fare quelle access-list cosi' lunghe....
CCIE Routing & Switching # 20567
CCNP R&S - CCNP Sec - CCNP Collaboration - CCNP Datacenter - CCDP - VCP6-DCV
-
- Holy network Shaman
- Messaggi: 637
- Iscritto il: gio 07 apr , 2005 9:30 pm
- Località: Cisco Systems Inc. West Tasman Drive 170, San Jose CA
- Contatta:
access-list 111 permit icmp any any administratively-prohibited
access-list 111 permit icmp any any echo
access-list 111 permit icmp any any echo-reply
access-list 111 permit icmp any any packet-too-big
access-list 111 permit icmp any any time-exceeded
access-list 111 permit icmp any any traceroute
access-list 111 permit icmp any any unreachable
questa per ex se metti permi icmp any any penso ke vadi cmq hai provato?
access-list 111 permit icmp any any echo
access-list 111 permit icmp any any echo-reply
access-list 111 permit icmp any any packet-too-big
access-list 111 permit icmp any any time-exceeded
access-list 111 permit icmp any any traceroute
access-list 111 permit icmp any any unreachable
questa per ex se metti permi icmp any any penso ke vadi cmq hai provato?
CCIE Routing & Switching # 20567
CCNP R&S - CCNP Sec - CCNP Collaboration - CCNP Datacenter - CCDP - VCP6-DCV
-
- Cisco fan
- Messaggi: 67
- Iscritto il: mar 26 lug , 2005 8:52 pm
ho fatto una enooooorme cavolata
ho tolto qualche access list importante e non riesco più a collegarmi via telnet al router (considerate che sono da remoto)
C'e' qualche modo per rientrare?
Ultima spiaggia tornare sul posto....
Dok
ho tolto qualche access list importante e non riesco più a collegarmi via telnet al router (considerate che sono da remoto)
C'e' qualche modo per rientrare?
Ultima spiaggia tornare sul posto....
Dok
-
- Holy network Shaman
- Messaggi: 637
- Iscritto il: gio 07 apr , 2005 9:30 pm
- Località: Cisco Systems Inc. West Tasman Drive 170, San Jose CA
- Contatta:
se hai perso il router in teoria nn hai salvato la cfg giusto?? se si chiami e dici se ti spengono e riaccendono il router altrimenti vai li
CCIE Routing & Switching # 20567
CCNP R&S - CCNP Sec - CCNP Collaboration - CCNP Datacenter - CCDP - VCP6-DCV