Cisco 857W che si impallano...
Inviato: mer 05 mar , 2008 4:02 pm
Ciao a tutti...
Ho un problemino abbastanza grave con 2 cisco 857w...
Si impallano alla grande!
Tra i 2 c'e' in tunnel ipsec, sul quale viaggiano 2 o 3 connessioni terminal services e posta di outlook a server exchange.
Finchè ci sono 2 postazioni, nessun problema, appena si collega la terza o qualcuno scarica la posta, il router del 'branch office' si pianta (completamente freezzato, non risponde a nulla), ed ogni tanto si impalla pure quello nella sede principale. Le linee sono delle 4mb download e 512 upload (NGI pure... Le linee sono fantastiche...), che per il traffico generato dovrebbero essere sufficienti...
La config del router che si blocca ogni tanto è la seguente (ma anche l'altro ha una config praticamente identica...):
La rete dell'ufficio distaccato è 192.168.201.x, mentre la sede principale è 192.168.200.x.
Questo è lo sh ver:
Non ho ancora aggiornato il fw dell'adsl...
Se non fai troppo traffico attraverso la vpn, no problem... Va benissimo-
Mi sto gia' muovendo per aggiornare ios ed i fw adsl...
Qualcuno sa dirmi cosa hanno visto? E' un problema di config?
Grazie a tutti!
Ho un problemino abbastanza grave con 2 cisco 857w...
Si impallano alla grande!
Tra i 2 c'e' in tunnel ipsec, sul quale viaggiano 2 o 3 connessioni terminal services e posta di outlook a server exchange.
Finchè ci sono 2 postazioni, nessun problema, appena si collega la terza o qualcuno scarica la posta, il router del 'branch office' si pianta (completamente freezzato, non risponde a nulla), ed ogni tanto si impalla pure quello nella sede principale. Le linee sono delle 4mb download e 512 upload (NGI pure... Le linee sono fantastiche...), che per il traffico generato dovrebbero essere sufficienti...
La config del router che si blocca ogni tanto è la seguente (ma anche l'altro ha una config praticamente identica...):
Codice: Seleziona tutto
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
no service dhcp
!
hostname CISCO857-2
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 debugging
logging console critical
!
aaa new-model
!
!
aaa authentication login default local
aaa authorization exec default local
!
aaa session-id common
!
resource policy
!
clock timezone MIAZONA 1
clock summer-time MIAZONA recurring last Sun Mar 2:00 last Sun Oct 3:00
no ip source-route
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.200.201 192.168.200.254
ip dhcp excluded-address 192.168.200.1 192.168.200.9
!
ip dhcp pool sdm-pool1
import all
network 192.168.200.0 255.255.255.0
default-router 192.168.200.254
dns-server 192.168.200.254
netbios-name-server 192.168.200.254
!
ip dhcp pool MASTER
host 192.168.200.1 255.255.255.0
client-identifier 0100.13d4.03e3.f2
client-name MASTER
dns-server 192.168.200.254
netbios-name-server 192.168.200.254
default-router 192.168.200.254
!
!
ip cef
ip tcp synwait-time 10
no ip bootp server
ip host PS-569C90 192.168.200.202
ip name-server 212.216.112.112
ip name-server 212.216.172.62
ip name-server 88.149.128.12
ip name-server 88.149.128.22
ip ssh time-out 60
ip ssh authentication-retries 2
!
!
crypto pki trustpoint TP-self-signed-894807470
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-894807470
revocation-check none
rsakeypair TP-self-signed-894807470
!
!
crypto pki certificate chain TP-self-signed-894807470
certificate self-signed 01
username xxxxxx privilege 15 secret 5 xxxxxxxx
!
!
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key CHIAVE address INDIRIZZO
!
!
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec df-bit clear
!
crypto map SDM_CMAP_1 1 ipsec-isakmp
description Tunnel to INDIRIZZO
set peer INDIRIZZO
set transform-set ESP-3DES-SHA
match address 100
!
bridge irb
!
!
interface Null0
no ip unreachables
!
interface ATM0
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip route-cache flow
no ip mroute-cache
no atm ilmi-keepalive
pvc 8/35
encapsulation aal5snap
protocol ppp dialer
dialer pool-member 1
!
dsl operating-mode auto
hold-queue 224 in
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface Dot11Radio0
no ip address
ip tcp adjust-mss 1452
!
encryption key 1 size 128bit 7 CHIAVE transmit-key
encryption mode ciphers wep128
!
ssid WIFI
authentication open
guest-mode
infrastructure-ssid optional
!
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0
54.0
station-role root
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$
no ip address
ip tcp adjust-mss 1452
bridge-group 1
!
interface Dialer0
description $FW_OUTSIDE$
mtu 1492
ip address negotiated
ip access-group 101 in
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip virtual-reassembly
encapsulation ppp
ip route-cache flow
dialer pool 1
dialer-group 1
no snmp trap link-status
no cdp enable
ppp authentication chap pap callin
ppp chap hostname UTENTE
ppp chap password 7 PASSWORD
ppp pap sent-username UTENTE password 7 PASSWORD
crypto map SDM_CMAP_1
!
interface BVI1
description $FW_INSIDE$
ip address 192.168.200.254 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip virtual-reassembly
ip route-cache flow
ip tcp adjust-mss 1452
!
ip route 0.0.0.0 0.0.0.0 Dialer0
!
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source static tcp 192.168.200.1 3389 interface Dialer0 3389
ip nat inside source route-map SDM_RMAP_1 interface Dialer0 overload
ip dns server
!
logging trap debugging
access-list 100 remark SDM_ACL Category=4
access-list 100 remark IPSec Rule
access-list 100 permit ip 192.168.200.0 0.0.0.255 192.168.201.0 0.0.0.255
access-list 100 remark SDM_ACL Category=4
access-list 100 remark IPSec Rule
access-list 101 permit tcp any any eq telnet
access-list 101 deny ip 127.0.0.0 0.255.255.255 any
access-list 101 deny ip 10.0.0.0 0.255.255.255 any
access-list 101 deny ip 172.16.0.0 0.15.255.255 any
access-list 101 deny ip 192.168.0.0 0.0.255.255 any
access-list 101 deny ip host 0.0.0.0 any
access-list 101 deny ip host 255.255.255.255 any
access-list 101 permit tcp any any eq 3389
access-list 101 permit ip host 88.149.181.100 any
access-list 101 permit icmp any any echo-reply
access-list 101 permit tcp any any eq 22
access-list 101 permit udp host 193.204.114.233 eq ntp any eq ntp
access-list 101 permit udp host 193.204.114.232 eq ntp any eq ntp
access-list 101 permit tcp any any established
access-list 101 permit udp any any eq domain
access-list 101 permit udp any any gt 1023
access-list 101 deny icmp any any
access-list 101 deny ip any any
access-list 105 remark SDM_ACL Category=2
access-list 105 remark IPSec Rule
access-list 105 deny ip 192.168.200.0 0.0.0.255 192.168.201.0 0.0.0.255
access-list 105 permit ip 192.168.200.0 0.0.0.255 any
access-list 105 remark SDM_ACL Category=2
access-list 105 remark IPSec Rule
no cdp run
route-map SDM_RMAP_1 permit 1
match ip address 105
!
!
control-plane
!
bridge 1 protocol ieee
bridge 1 route ip
banner login ^CCAuthorized access only!
Disconnect IMMEDIATELY if you are not an authorized user!^C
!
line con 0
no modem enable
transport output telnet
line aux 0
transport output telnet
line vty 0 4
access-class 23 in
privilege level 15
transport input telnet ssh
!
scheduler max-task-time 5000
scheduler allocate 4000 1000
scheduler interval 500
ntp clock-period 17175026
ntp master
ntp server 193.204.114.232 prefer
ntp server 193.204.114.233
end
La rete dell'ufficio distaccato è 192.168.201.x, mentre la sede principale è 192.168.200.x.
Questo è lo sh ver:
Codice: Seleziona tutto
Cisco IOS Software, C850 Software (C850-ADVSECURITYK9-M), Version 12.4(6)T6, REL
EASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2006 by Cisco Systems, Inc.
Compiled Fri 08-Dec-06 22:38 by kellythw
ROM: System Bootstrap, Version 12.3(8r)YI3, RELEASE SOFTWARE
MIOROUTER uptime is 1 day, 18 hours, 44 minutes
System returned to ROM by power-on
System restarted at 21:11:17 Asti Mon Mar 3 2008
System image file is "flash:c850-advsecurityk9-mz.124-6.T6.bin"
Cisco 857W (MPC8272) processor (revision 0x200) with 59392K/6144K bytes of memor
y.
Processor board ID FCZ111322R9
MPC8272 CPU Rev: Part Number 0xC, Mask Number 0x10
4 FastEthernet interfaces
1 ATM interface
1 802.11 Radio
128K bytes of non-volatile configuration memory.
20480K bytes of processor board System flash (Intel Strataflash)
Configuration register is 0x2102
Non ho ancora aggiornato il fw dell'adsl...
Codice: Seleziona tutto
Init FW: embedded
Operation FW: embedded
FW Version: 2.5.42
Mi sto gia' muovendo per aggiornare ios ed i fw adsl...
Qualcuno sa dirmi cosa hanno visto? E' un problema di config?
Grazie a tutti!
Anzi, piu' o meno funziona!