Rizio ha scritto:Se c'è un modo per routare il traffico multicast oltre la net d'appartenenza non lo conosco (ma sarei curioso), in compenso però creare un tunnel GRE è facile facile.
Crei un tunnel punto punto:
Codice: Seleziona tutto
interface Tunnel1
description Tunnel GRE punto 1
ip address 192.168.255.13 255.255.255.252
ip mtu 1420
tunnel source Vlan2
tunnel destination IP_PUBBLICO_DEL_PUNTO_2
e dall'altro capo:
Codice: Seleziona tutto
interface Tunnel1
description Tunnel GRE punto 2
ip address 192.168.255.14 255.255.255.252
ip mtu 1420
tunnel source Vlan2
tunnel destination IP_PUBBLICO_DEL_PUNTO_1
In pratica crei 2 punti che si "cercano" a vicenda attraverso l'ip pubblico dei 2 apparati. Alle 2 interfacce dai 2 ip privati che poi userai nell'instradamento delle varie rotte.
Rizio
Ciao Rizio grazie per la risposta. Ti spiego nel dettaglio com'e' lo scenario di utilizzo.
A casa mia ho un cisco 877w che lavora su un'adsl alice con ip dinamico ma con il ddns e il server vpn cisco. Nella mia rete sono presenti 2 pc con ubuntu, 2 iphone, 1 macbook e una stampante di rete samsung. La apple da qualche mese a questa parte sull'iphone ha rilasciato la funzione airprint che consente di stampare i documenti direttamente dall'iphone sulla stampante di rete o collegato a qualche pc. Dalla mia rete wifi quando sono a casa, stampo direttamente le email che ricevo sull'iphone, il mio server con ubuntu attraverso il servizio avahi-daemon in multicast trasmette i parametri di utilizzo alla rete, l'iphone individua la stampante (usa il zeroconf pertanto non posso impostare nessun ip di rete per la stampante all'iphone), l'iphone trasmette al mio serverino ubuntu la richiesta di stampa, e il servizio cups di ubuntu si occupa di gestire la stampa verso la stampante samsung di rete.
L'iphone come ben sai e' abbastanza blindato rispetto ad android, ma ha nativamente il supporto alle vpn della cisco e ma purtroppo non ha nessun supporto ad openvpn. Pertanto sul cisco a casa mia c'e' il server vpn, che uso solo dall'iphone per connettermi in vnc ai vari client della rete di casa quando sono via per lavoro, attraverso la rete 3g/edge oppure se ho un portatile a portata di mano mi collego con openvpn, poiche' c'e' un serverino con ubuntu sui cui gira il server openvpn e che accendo alla bisogna attraverso il wake on lan. Il mio problema e' quando sono fuori per lavoro per dei giorni, mio padre purtroppo e' all'eta' della pietra, ha una piccola attivita', ma non sa usare mail e computer, pertanto tutte le cose che anni fa riceveva per fax ora gliele inviano per email e gliele stampo tutte io. Il mio problema e' che vorrei stampare questi documenti quando sono via direttamente dall'iphone senza bisogno di andare sempre a cercare un pc per configurarmi openvpn o avere sempre con me il netbook con ubuntu, pertanto avrei bisogno che dal cisco877 di casa mia quando mi collego con l'iphone in vpn sia disponibile il multicast sulla vpn cisco, cosi' attraverso airprint dall'iphone riesco a stampare sti benedetti documenti per mio padre. Se si potesse configurare un ip statico nell'airprint dell'iphone avrei fatto bingo, ma purtroppo vuole rilevare sempre la stampante di rete quando attivo la vpn cisco sempre e solo attraverso il multicast
Scusa per tutta sta pappardella di spiegazioni, mi servirebbe fare un tunnel gre non lan 2 lan, ma lan 2 client, si puo' fare un tunnel gre a questo modo? A me sembra che la configurazione che mi hai suggerito sia per una lan 2 lan o sbaglio? Grazie per la pazienza
dimenticavo questa e' la configurazione che uso ora:
Codice: Seleziona tutto
version 15.0
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug uptime
service timestamps log datetime msec localtime
service password-encryption
service internal
service sequence-numbers
!
hostname xxxxxx
!
boot-start-marker
boot-end-marker
!
logging exception 100000
logging count
logging userinfo
logging queue-limit 10000
logging buffered 150000
enable secret 5 xxxxxx
!
no aaa new-model
!
!
!
clock timezone MET 1
clock summer-time MEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
crypto pki token default removal timeout 0
!
!
dot11 syslog
!
dot11 ssid xxxxxx
vlan 1
authentication open
authentication key-management wpa
wpa-psk ascii 7 xxxxxx
!
no ip source-route
ip gratuitous-arps
no ip icmp rate-limit unreachable
!
!
no ip dhcp use vrf connected
ip dhcp excluded-address 172.20.25.95
ip dhcp excluded-address 172.20.25.205
!
ip dhcp pool vlan1
import all
network 172.20.25.0 255.255.255.128
default-router 172.20.25.95
dns-server 172.20.25.95 8.8.8.8
!
ip dhcp pool quad-ubuntu-gbit
host 172.20.25.202 255.255.255.0
hardware-address xxxxxx
default-router 172.20.25.95
dns-server 172.20.25.95 8.8.8.8
!
ip dhcp pool iphone3gs
host 172.20.25.204 255.255.255.0
client-identifier xxxxxx
default-router 172.20.25.95
dns-server 172.20.25.95 8.8.8.8
!
ip dhcp pool iphone3gsxxxxxx
host 172.20.25.205 255.255.255.0
client-identifier xxxxxx
default-router 172.20.25.95
dns-server 172.20.25.95 8.8.8.8
!
ip dhcp pool macbookxxxxxx
host 172.20.25.206 255.255.255.0
client-identifier xxxxxx
default-router 172.20.25.95
dns-server 172.20.25.95 8.8.8.8
!
ip dhcp pool clx3185
host 172.20.25.207 255.255.0.0
client-identifier xxxxxx
default-router 172.20.25.95
dns-server 172.20.25.95 8.8.8.8
!
!
ip cef
no ip bootp server
ip domain retry 10
ip domain timeout 1
ip domain name xxxxxx
ip host manuel.charta.it 10.10.10.10
ip host quad 172.20.25.202
ip host iph 172.20.25.204
ip host cis 172.20.25.95
ip host QuadVpn 10.10.10.1
ip host xbox 172.20.25.205
ip host pippo 172.20.25.95
ip name-server 8.8.8.8
ip name-server 8.8.4.4
ip multicast-routing
ip inspect WAAS flush-timeout 10
ip inspect udp idle-time 300
ip inspect tcp finwait-time 120
ip inspect tcp synwait-time 120
ip inspect tcp reassembly queue length 512
ip inspect tcp reassembly memory limit 65536
ip inspect name ciscocasa icmp
ip inspect name ciscocasa cuseeme
ip inspect name ciscocasa dns
ip inspect name ciscocasa ftp
ip inspect name ciscocasa h323
ip inspect name ciscocasa imap
ip inspect name ciscocasa pop3
ip inspect name ciscocasa rcmd
ip inspect name ciscocasa realaudio
ip inspect name ciscocasa rtsp
ip inspect name ciscocasa esmtp
ip inspect name ciscocasa sqlnet
ip inspect name ciscocasa streamworks
ip inspect name ciscocasa vdolive
ip inspect name ciscocasa winmx
ip inspect name ciscocasa tcp
ip inspect name ciscocasa udp
ip inspect name ciscocasa https
ip ddns update method dyndns1
HTTP
add http://xxxxxx:[email protected]/nic/update?system=dyndns&hostname=<h>&myip=<a>
interval maximum 0 0 30 0
!
no ipv6 cef
!
multilink bundle-name authenticated
!
password encryption aes
!
!
archive
log config
hidekeys
!
username xxxxxx privilege 15 secret 5 xxxxxx
scripting tcl secure-mode
!
!
ip tcp selective-ack
ip tcp synwait-time 120
ip ssh source-interface BVI1
ip ssh version 2
ip ssh pubkey-chain
username manu
quit
ip scp server enable
!
!
crypto logging session
!
crypto isakmp policy 10
encr aes 256
hash md5
authentication pre-share
group 2
lifetime 3600
crypto isakmp keepalive 10
crypto isakmp nat keepalive 20
crypto isakmp xauth timeout 90
!
crypto isakmp client configuration group xxxxxx
key 6 xxxxxx
domain wr
pool remote-pool
acl 158
save-password
include-local-lan
max-users 20
max-logins 10
!
crypto ipsec security-association idle-time 3600
!
crypto ipsec transform-set VPN-CLI-SET esp-aes 256 esp-md5-hmac
!
crypto dynamic-map remote-dyn 10
set transform-set VPN-CLI-SET
!
!
crypto map remotemap local-address Dialer0
crypto map remotemap client authentication list userauthen
crypto map remotemap isakmp authorization list groupauthor
crypto map remotemap client configuration address respond
crypto map remotemap 65535 ipsec-isakmp dynamic remote-dyn
!
bridge irb
!
!
!
interface ATM0
no ip address
no atm ilmi-keepalive
dsl operating-mode adsl2+
dsl bitswap both
!
!
interface ATM0.1 point-to-point
pvc 8/35
oam-pvc 0
encapsulation aal5snap
pppoe-client dial-pool-number 1
!
!
interface FastEthernet0
!
!
interface FastEthernet1
!
!
interface FastEthernet2
!
!
interface FastEthernet3
!
!
interface Dot11Radio0
no ip address
!
encryption vlan 1 mode ciphers aes-ccm
!
!
broadcast-key change 172800
!
!
ssid xxxxxx
!
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
channel 2457
station-role root
antenna gain 128
world-mode dot11d country IT both
!
!
interface Dot11Radio0.1
encapsulation dot1Q 1 native
ip directed-broadcast
ip tcp adjust-mss 1452
no cdp enable
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
!
interface Vlan1
no ip address
ip directed-broadcast
ip tcp adjust-mss 1452
bridge-group 1
!
!
interface Dialer0
ip ddns update hostname xxxxxx
ip ddns update dyndns1
ip address negotiated
ip access-group 101 in
ip mtu 1492
ip nat outside
ip inspect ciscocasa out
no ip virtual-reassembly
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication pap callin
ppp pap sent-username xxxxxx password 7 xxxxxx
no cdp enable
crypto map remotemap
!
!
interface BVI1
ip address 172.20.25.95 255.255.255.0
ip nat inside
no ip virtual-reassembly
ip tcp adjust-mss 1452
!
!
ip local pool remote-pool 172.20.26.0 172.20.26.254
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
ip dns server
ip nat translation timeout 600
ip nat translation tcp-timeout 120
ip nat translation finrst-timeout 120
ip nat translation syn-timeout 120
ip nat translation dns-timeout 120
ip nat translation icmp-timeout 120
ip nat translation max-entries 2147483647
ip nat pool UBUNTUQ 172.20.25.202 172.20.25.202 netmask 255.255.255.0 type rotary
ip nat inside source static tcp 172.20.25.202 51413 interface Dialer0 51413
ip nat inside source list 102 interface Dialer0 overload
ip nat inside source static tcp 172.20.25.202 5555 interface Dialer0 5555
ip nat inside source static udp 172.20.25.255 9 interface Dialer0 15458
ip nat inside source static udp 172.20.25.205 3074 interface Dialer0 3074
ip nat inside source static tcp 172.20.25.205 3074 interface Dialer0 3074
ip nat inside source static tcp 172.20.25.202 443 interface Dialer0 443
ip nat inside destination list FILESERVER pool UBUNTUQ
ip nat inside destination list TEST pool UBUNTUQ
ip route 0.0.0.0 0.0.0.0 Dialer0
ip route 10.10.10.0 255.255.255.0 172.20.25.202
ip route 172.20.25.0 255.255.255.0 Dialer0
ip route 172.20.26.0 255.255.255.0 Dialer0
!
ip access-list extended FILESERVER
remark PORTE FTP STANDARD JSCAPE
permit tcp any any range ftp-data ftp
remark PORTE FTP PASSIVO JSCAPE
permit tcp any any range 47000 47010
ip access-list extended TEST
permit tcp any any range 6881 6900
!
logging source-interface Dialer0
logging 172.20.25.202
access-list 101 remark **** ICMP ****
access-list 101 permit icmp any any
access-list 101 remark **** VPN ****
access-list 101 permit ip 172.20.26.0 0.0.0.255 any
access-list 101 permit udp any any eq non500-isakmp
access-list 101 permit udp any any eq isakmp
access-list 101 permit esp any any
access-list 101 permit tcp any any eq 1723
access-list 101 permit gre any any
access-list 101 remark **** DNS ****
access-list 101 permit udp host 8.8.4.4 eq domain any
access-list 101 permit udp host 8.8.8.8 eq domain any
access-list 101 permit udp host 151.99.125.2 eq domain any
access-list 101 permit udp host 151.99.125.3 eq domain any
access-list 101 permit udp host 208.67.222.222 eq domain any
access-list 101 permit udp host 195.186.1.110 eq domain any
access-list 101 permit tcp host 8.8.4.4 eq domain any
access-list 101 permit tcp host 8.8.8.8 eq domain any
access-list 101 permit tcp host 151.99.125.2 eq domain any
access-list 101 permit tcp host 151.99.125.3 eq domain any
access-list 101 permit tcp host 208.67.222.222 eq domain any
access-list 101 permit tcp host 195.186.1.110 eq domain any
access-list 101 remark **** NTP ****
access-list 101 permit udp host 193.204.114.232 eq ntp any
access-list 101 permit udp host 193.204.114.233 eq ntp any
access-list 101 remark **** FTP-WEB ****
access-list 101 permit tcp any gt 1023 any eq ftp
access-list 101 permit tcp any gt 1023 any eq ftp-data
access-list 101 permit tcp any any range 47000 47010
access-list 101 permit tcp any any eq www
access-list 101 remark **** XBOX ****
access-list 101 permit udp any any eq 3074
access-list 101 permit tcp any any eq 3074
access-list 101 permit udp any any eq 88
access-list 101 remark **** OPENVPN ****
access-list 101 permit tcp any any eq 443
access-list 101 permit tcp any any eq 5555
access-list 101 remark **** PIDGIN ****
access-list 101 permit tcp any any range 6881 6890
access-list 101 remark **** AMSN ****
access-list 101 permit tcp any any range 6891 6900
access-list 101 remark **** WOL ****
access-list 101 permit udp any any eq 15458
access-list 101 remark **** TORRENT ****
access-list 101 permit tcp any any eq 51413
access-list 101 permit tcp any any established
access-list 101 deny ip any any
access-list 102 deny ip 172.20.25.0 0.0.0.255 172.20.26.0 0.0.0.255
access-list 102 permit ip 172.20.25.0 0.0.0.255 any
access-list 102 permit ip 172.20.26.0 0.0.0.255 any
access-list 158 permit ip 172.20.25.0 0.0.0.255 172.20.26.0 0.0.0.255
dialer-list 1 protocol ip permit
no cdp run
!
!
!
!
route-map POL-NAT permit 10
match ip address 107
!
!
control-plane
!
!
bridge 1 protocol ieee
bridge 1 route ip
!
line con 0
no modem enable
speed 115200
line aux 0
line vty 0 4
session-timeout 3600
exec-timeout 60 0
privilege level 15
login local
transport input all
!
no scheduler max-task-time
ntp server 193.204.114.232
ntp server 193.204.114.233 prefer
!
webvpn context Default_context
ssl authenticate verify all
!
no inservice
!
end
grazie
