Cisco VPN Client Errore - Reason 403
Inviato: gio 21 feb , 2008 9:49 pm
Ho un Cisco VPN Client che mi funziona perfettamente verso un server 803 ma non ne vuole sapere di stabilire una connessione verso un 837 (avendo una vpn configurata come l'803). Mi si pianta sull'autenticazione dell'utente del quale so per certo di aver inserito le giuste credenziali, riportandomi l'errore 403.
Potendomi collegare con il client verso l'803, presumo il problema sia lato server 837. Per cui vi chiedo guardando la conf.. dov'e' l'intoppo ?
Potendomi collegare con il client verso l'803, presumo il problema sia lato server 837. Per cui vi chiedo guardando la conf.. dov'e' l'intoppo ?
Codice: Seleziona tutto
!
version 12.4
no service pad
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname hostname
!
boot-start-marker
boot-end-marker
!
no logging buffered
enable secret xxxxxxxxx
!
aaa new-model
!
!
aaa authentication login userauthen local
aaa authorization network groupauthor local
!
aaa session-id common
!
resource policy
!
no ip dhcp use vrf connected
ip dhcp excluded-address 10.10.10.1
!
ip dhcp pool CLIENT
import all
network 10.10.10.0 255.255.255.0
default-router 10.10.10.1
dns-server 62.xx.xx.xx 62.xx.xx.xx
lease 0 2
!
!
ip cef
ip name-server 62.xx.xx.xx
ip name-server 62.xx.xx.xx
!
!
!
username user privilege 15 secret xxxxxxxxxxxx
!
!
!
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
!
crypto isakmp client configuration group vpngruppo
key ciscokey
pool remote-pool
acl 151
!
!
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
!
crypto dynamic-map remote-dyn 10
set transform-set ESP-DES-SHA ESP-DES-MD5 ESP-3DES-MD5
reverse-route
!
!
crypto map remotemap client authentication list userauthen
crypto map remotemap isakmp authorization list groupauthor
crypto map remotemap client configuration address respond
crypto map remotemap 10 ipsec-isakmp dynamic remote-dyn
!
!
!
interface Ethernet0
ip address 212.xxx.xxx.xxx 255.255.255.240 secondary
ip address 10.10.10.1 255.255.255.0
ip nat inside
ip virtual-reassembly
no ip mroute-cache
crypto map remotemap
hold-queue 100 out
!
interface Ethernet2
no ip address
shutdown
hold-queue 100 out
!
interface ATM0
no ip address
no ip mroute-cache
atm vc-per-vp 64
no atm ilmi-keepalive
dsl operating-mode auto
pvc 8/35
encapsulation aal5mux ppp dialer
dialer pool-member 1
!
!
interface FastEthernet1
duplex auto
speed auto
!
interface FastEthernet2
duplex auto
speed auto
!
interface FastEthernet3
duplex auto
speed auto
!
interface FastEthernet4
duplex auto
speed auto
!
interface Dialer1
ip address negotiated
ip nat outside
ip virtual-reassembly
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication chap pap callin
ppp chap hostname user@email
ppp chap password xxxxxxxx
ppp pap sent-username user@email password xxxxxxxx
ppp ipcp dns request
ppp ipcp wins request
crypto map remotemap
hold-queue 224 in
!
ip local pool remote-pool 192.168.5.200 192.168.5.203
ip route 0.0.0.0 0.0.0.0 Dialer1
ip http server
ip http access-class 23
ip http authentication local
no ip http secure-server
ip http max-connections 4
ip http timeout-policy idle 600 life 86400 requests 10000
!
ip nat inside source route-map nonat interface Dialer1 overload
ip nat inside source static 10.10.10.2 212.xxx.xxx.xxx extendable
ip nat inside source static 10.10.10.3 212.xxx.xxx.xxx extendable
ip nat inside source static 10.10.10.4 212.xxx.xxx.xxx extendable
!
access-list 100 deny ip 10.10.10.0 0.0.0.255 192.168.5.0 0.0.0.255
access-list 100 permit ip 10.10.10.0 0.0.0.255 any
access-list 151 permit ip 10.10.10.0 0.0.0.255 192.168.5.0 0.0.0.255
dialer-list 1 protocol ip permit
route-map nonat permit 10
match ip address 100
!
!
control-plane
!
!
line con 0
exec-timeout 120 0
no modem enable
stopbits 1
line aux 0
line vty 0 4
access-class 23 in
exec-timeout 120 0
length 0
!
scheduler max-task-time 5000
end