Buongiorno a tutti...
E' il mio primo post, ed ho subito un problema da risolvere...
Un problema che è un pezzo che mi sta stressando...
Ho un router cisco 1801 che fa da server vpn (in PPTP) per client wxp.
Il client si collega al router, passa l'aaa tramite radius, prende l'ip, ma non riesco a pingare null sulla rete se non lo stesso ip dell'interfaccia interna del router.
Questo sia con il 'Usa gateway predefinito sulla rete remota' abilitato, che disabilitato.
Queste sono le route che si aggiunogno sul client una volta fatta la connessione:
Indirizzo rete Mask Gateway Interfaccia Metrica
xx.xx.xx.xx 255.255.255.255 192.168.201.200 192.168.201.7 20
192.168.1.0 255.255.255.0 192.168.1.24 192.168.1.24 1
192.168.1.24 255.255.255.255 127.0.0.1 127.0.0.1 50
192.168.1.255 255.255.255.255 192.168.1.24 192.168.1.24 50
224.0.0.0 240.0.0.0 192.168.1.24 192.168.1.24 50
255.255.255.255 255.255.255.255 192.168.1.24 192.168.1.24 1
Non vedo una route per la rete della vpn...
Con il flag 'utulizza gateway predefinito...' impostato sul client, si aggiunge la seguente riga:
Indirizzo rete Mask Gateway Interfaccia Metrica
0.0.0.0 0.0.0.0 192.168.1.24 192.168.1.24 1
Ma in ogni caso, non posso pingare nulla sulla rete, se non appunto l'ip dell'interfaccia interna del router
L'unica route attualmente attiva sul router è quella di default (la last resort) 0.0.0.0 0.0.0.0 ATM0.1, che butta tutto sull'interfaccia connessa ad internet.
x.x.x.x è l'ip pubblico del server vpn
192.168.1.24 è l'ip che ha dato il server vpn al client vpn
192.168.201.7 è l'ip dell'interfaccia di rete del pc client
192.168.1.1 è l'ip dell'interfaccia interna del router
192.168.201.200 è il router che il pc client utilizza per connettersi ad internet
Come posso modificare la config del router per permettere al client di raggiungere tutti gli host della rete locale?
Grazie mille!
Problema VPN PPTP e route
Moderatore: Federico.Lagni
-
masterx81
- Cisco enlightened user
- Messaggi: 154
- Iscritto il: mer 20 giu , 2007 11:20 am
Se puo' essere utile, qua c'e' la config....
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname Router
!
boot-start-marker
boot-end-marker
!
security authentication failure rate 3 log
security passwords min-length 6
logging buffered 51200 debugging
logging console critical
enable secret xxxx
!
aaa new-model
!
!
aaa group server radius VPNDialIn
server 192.168.1.1 auth-port 1812 acct-port 1813
!
aaa authentication attempts login 5
aaa authentication login console none
aaa authentication login telnet local
aaa authentication ppp default group VPNDialIn
aaa authorization exec default local
aaa authorization network default group VPNDialIn
!
aaa session-id common
!
resource policy
!
clock timezone Asti 1
clock summer-time Asti recurring last Sun Mar 2:00 last Sun Oct 3:00
clock calendar-valid
no ip source-route
!
!
ip cef
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.200.1 192.168.200.9
ip dhcp excluded-address 192.168.200.201 192.168.200.254
!
ip dhcp pool sdm-pool1
import all
network 192.168.200.0 255.255.255.0
default-router 192.168.200.254
dns-server 192.168.200.254
!
!
ip tcp synwait-time 10
no ip bootp server
ip domain name xxx.it
ip name-server 212.216.112.112
ip name-server 212.216.172.62
ip name-server 151.99.125.2
ip name-server 151.99.0.100
ip ssh time-out 60
ip ssh authentication-retries 2
ip inspect name DEFAULT100 cuseeme
ip inspect name DEFAULT100 ftp
ip inspect name DEFAULT100 h323
ip inspect name DEFAULT100 icmp
ip inspect name DEFAULT100 netshow
ip inspect name DEFAULT100 rcmd
ip inspect name DEFAULT100 realaudio
ip inspect name DEFAULT100 rtsp
ip inspect name DEFAULT100 esmtp
ip inspect name DEFAULT100 sqlnet
ip inspect name DEFAULT100 streamworks
ip inspect name DEFAULT100 tftp
ip inspect name DEFAULT100 tcp
ip inspect name DEFAULT100 udp
ip inspect name DEFAULT100 vdolive
ip address-pool dhcp-proxy-client
ip dhcp-server 192.168.1.1
vpdn enable
!
vpdn-group VPNDialIn
! Default PPTP VPDN group
accept-dialin
protocol pptp
virtual-template 1
!
!
isdn switch-type basic-net3
!
-cut-
username router privilege 15 secret xxx
!
!
!
bridge irb
!
!
!
interface Null0
no ip unreachables
!
interface FastEthernet0
ip address 192.168.1.200 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip route-cache flow
duplex auto
speed auto
!
interface BRI0
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
encapsulation ppp
ip route-cache flow
isdn switch-type basic-net3
isdn point-to-point-setup
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
!
interface FastEthernet5
!
interface FastEthernet6
!
interface FastEthernet7
!
interface FastEthernet8
!
interface ATM0
mtu 1492
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip route-cache flow
no atm ilmi-keepalive
dsl operating-mode itu-dmt
!
interface ATM0.1 point-to-point
description $ES_WAN$$FW_OUTSIDE$
backup delay 1 30
backup interface BRI0
ip address xx.xx.xx.xx 255.255.255.240
ip access-group 100 in
ip verify unicast reverse-path
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip virtual-reassembly
no snmp trap link-status
pvc 8/35
oam-pvc manage
encapsulation aal5snap
!
!
interface Virtual-Template1
description $FW_OUTSIDE$
ip unnumbered FastEthernet0
ip verify unicast reverse-path
no ip redirects
no ip unreachables
no ip proxy-arp
ip route-cache flow
peer default ip address dhcp
no keepalive
compress mppc
ppp encrypt mppe auto required
ppp authentication ms-chap ms-chap-v2 callin VPNDialIn
ppp authorization VPNDialIn
!
interface Virtual-Dot11Radio1
no ip address
!
interface Virtual-Dot11Radio3
no ip address
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-FE 1$$ES_LAN$$FW_INSIDE$
ip address 192.168.200.254 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip virtual-reassembly
ip route-cache flow
ip tcp adjust-mss 1452
!
ip route 0.0.0.0 0.0.0.0 ATM0.1
!
ip dns server
!
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source static tcp 192.168.200.1 443 interface ATM0.1 443
ip nat inside source route-map SDM_RMAP_1 interface ATM0.1 overload
ip nat inside source static tcp 192.168.200.1 143 interface ATM0.1 143
ip nat inside source static tcp 192.168.200.1 21 interface ATM0.1 21
ip nat inside source static tcp 192.168.200.1 80 interface ATM0.1 80
ip nat inside source static tcp 192.168.200.1 8080 interface ATM0.1 8080
ip nat inside source static tcp 192.168.200.1 3389 interface ATM0.1 3389
!
logging trap debugging
access-list 100 deny ip 127.0.0.0 0.255.255.255 any
access-list 100 deny ip 10.0.0.0 0.255.255.255 any
access-list 100 deny ip 172.16.0.0 0.15.255.255 any
access-list 100 deny ip 192.168.0.0 0.0.255.255 any
access-list 100 deny ip host 0.0.0.0 any
access-list 100 deny ip host 255.255.255.255 any
access-list 100 permit icmp any any echo-reply
access-list 100 permit udp host 193.204.114.233 eq ntp any eq ntp
access-list 100 permit udp host 193.204.114.232 eq ntp any eq ntp
access-list 100 permit tcp any any established
access-list 100 permit tcp any any eq www
access-list 100 permit tcp any any eq 8080
access-list 100 permit tcp any any eq 443
access-list 100 permit tcp any any eq 143
access-list 100 permit tcp any any eq 3389
access-list 100 permit udp any any gt 1023
access-list 100 permit udp host 212.216.112.112 any eq domain
access-list 100 permit udp host 212.216.172.62 any eq domain
access-list 100 permit udp host 151.99.125.2 any eq domain
access-list 100 permit udp host 151.99.0.100 any eq domain
access-list 100 permit udp any eq isakmp any eq isakmp
access-list 100 permit tcp any any eq 1723
access-list 100 permit gre any any
access-list 100 permit tcp any eq ftp-data any gt 1023
access-list 100 deny ip any any
access-list 101 remark VTY Access-class list
access-list 101 remark SDM_ACL Category=1
access-list 101 permit ip 192.168.200.0 0.0.0.255 any
access-list 101 deny ip any any
access-list 105 remark SDM_ACL Category=2
access-list 105 remark IPSec Rule
access-list 105 permit ip 192.168.200.0 0.0.0.255 any
dialer-list 1 protocol ip permit
no cdp run
!
!
!
route-map SDM_RMAP_1 permit 1
match ip address 105
!
!
!
radius-server host 192.168.1.1 auth-port 1812 acct-port 1813 key xxx
radius-server vsa send accounting
radius-server vsa send authentication
!
control-plane
!
bridge 1 protocol ieee
bridge 1 route ip
banner login CAuthorized access only!
Disconnect IMMEDIATELY if you are not an authorized user!
!
line con 0
login authentication console
transport output telnet
line aux 0
transport output telnet
line vty 0 4
access-class 101 in
login authentication telnet
transport input telnet ssh
!
scheduler allocate 4000 1000
scheduler interval 500
ntp clock-period 17180210
ntp master
ntp update-calendar
ntp server 193.204.114.232 prefer
ntp server 193.204.114.233
!
webvpn context Default_context
ssl authenticate verify all
!
no inservice
!
end
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname Router
!
boot-start-marker
boot-end-marker
!
security authentication failure rate 3 log
security passwords min-length 6
logging buffered 51200 debugging
logging console critical
enable secret xxxx
!
aaa new-model
!
!
aaa group server radius VPNDialIn
server 192.168.1.1 auth-port 1812 acct-port 1813
!
aaa authentication attempts login 5
aaa authentication login console none
aaa authentication login telnet local
aaa authentication ppp default group VPNDialIn
aaa authorization exec default local
aaa authorization network default group VPNDialIn
!
aaa session-id common
!
resource policy
!
clock timezone Asti 1
clock summer-time Asti recurring last Sun Mar 2:00 last Sun Oct 3:00
clock calendar-valid
no ip source-route
!
!
ip cef
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.200.1 192.168.200.9
ip dhcp excluded-address 192.168.200.201 192.168.200.254
!
ip dhcp pool sdm-pool1
import all
network 192.168.200.0 255.255.255.0
default-router 192.168.200.254
dns-server 192.168.200.254
!
!
ip tcp synwait-time 10
no ip bootp server
ip domain name xxx.it
ip name-server 212.216.112.112
ip name-server 212.216.172.62
ip name-server 151.99.125.2
ip name-server 151.99.0.100
ip ssh time-out 60
ip ssh authentication-retries 2
ip inspect name DEFAULT100 cuseeme
ip inspect name DEFAULT100 ftp
ip inspect name DEFAULT100 h323
ip inspect name DEFAULT100 icmp
ip inspect name DEFAULT100 netshow
ip inspect name DEFAULT100 rcmd
ip inspect name DEFAULT100 realaudio
ip inspect name DEFAULT100 rtsp
ip inspect name DEFAULT100 esmtp
ip inspect name DEFAULT100 sqlnet
ip inspect name DEFAULT100 streamworks
ip inspect name DEFAULT100 tftp
ip inspect name DEFAULT100 tcp
ip inspect name DEFAULT100 udp
ip inspect name DEFAULT100 vdolive
ip address-pool dhcp-proxy-client
ip dhcp-server 192.168.1.1
vpdn enable
!
vpdn-group VPNDialIn
! Default PPTP VPDN group
accept-dialin
protocol pptp
virtual-template 1
!
!
isdn switch-type basic-net3
!
-cut-
username router privilege 15 secret xxx
!
!
!
bridge irb
!
!
!
interface Null0
no ip unreachables
!
interface FastEthernet0
ip address 192.168.1.200 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip route-cache flow
duplex auto
speed auto
!
interface BRI0
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
encapsulation ppp
ip route-cache flow
isdn switch-type basic-net3
isdn point-to-point-setup
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
!
interface FastEthernet5
!
interface FastEthernet6
!
interface FastEthernet7
!
interface FastEthernet8
!
interface ATM0
mtu 1492
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip route-cache flow
no atm ilmi-keepalive
dsl operating-mode itu-dmt
!
interface ATM0.1 point-to-point
description $ES_WAN$$FW_OUTSIDE$
backup delay 1 30
backup interface BRI0
ip address xx.xx.xx.xx 255.255.255.240
ip access-group 100 in
ip verify unicast reverse-path
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip virtual-reassembly
no snmp trap link-status
pvc 8/35
oam-pvc manage
encapsulation aal5snap
!
!
interface Virtual-Template1
description $FW_OUTSIDE$
ip unnumbered FastEthernet0
ip verify unicast reverse-path
no ip redirects
no ip unreachables
no ip proxy-arp
ip route-cache flow
peer default ip address dhcp
no keepalive
compress mppc
ppp encrypt mppe auto required
ppp authentication ms-chap ms-chap-v2 callin VPNDialIn
ppp authorization VPNDialIn
!
interface Virtual-Dot11Radio1
no ip address
!
interface Virtual-Dot11Radio3
no ip address
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-FE 1$$ES_LAN$$FW_INSIDE$
ip address 192.168.200.254 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip virtual-reassembly
ip route-cache flow
ip tcp adjust-mss 1452
!
ip route 0.0.0.0 0.0.0.0 ATM0.1
!
ip dns server
!
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source static tcp 192.168.200.1 443 interface ATM0.1 443
ip nat inside source route-map SDM_RMAP_1 interface ATM0.1 overload
ip nat inside source static tcp 192.168.200.1 143 interface ATM0.1 143
ip nat inside source static tcp 192.168.200.1 21 interface ATM0.1 21
ip nat inside source static tcp 192.168.200.1 80 interface ATM0.1 80
ip nat inside source static tcp 192.168.200.1 8080 interface ATM0.1 8080
ip nat inside source static tcp 192.168.200.1 3389 interface ATM0.1 3389
!
logging trap debugging
access-list 100 deny ip 127.0.0.0 0.255.255.255 any
access-list 100 deny ip 10.0.0.0 0.255.255.255 any
access-list 100 deny ip 172.16.0.0 0.15.255.255 any
access-list 100 deny ip 192.168.0.0 0.0.255.255 any
access-list 100 deny ip host 0.0.0.0 any
access-list 100 deny ip host 255.255.255.255 any
access-list 100 permit icmp any any echo-reply
access-list 100 permit udp host 193.204.114.233 eq ntp any eq ntp
access-list 100 permit udp host 193.204.114.232 eq ntp any eq ntp
access-list 100 permit tcp any any established
access-list 100 permit tcp any any eq www
access-list 100 permit tcp any any eq 8080
access-list 100 permit tcp any any eq 443
access-list 100 permit tcp any any eq 143
access-list 100 permit tcp any any eq 3389
access-list 100 permit udp any any gt 1023
access-list 100 permit udp host 212.216.112.112 any eq domain
access-list 100 permit udp host 212.216.172.62 any eq domain
access-list 100 permit udp host 151.99.125.2 any eq domain
access-list 100 permit udp host 151.99.0.100 any eq domain
access-list 100 permit udp any eq isakmp any eq isakmp
access-list 100 permit tcp any any eq 1723
access-list 100 permit gre any any
access-list 100 permit tcp any eq ftp-data any gt 1023
access-list 100 deny ip any any
access-list 101 remark VTY Access-class list
access-list 101 remark SDM_ACL Category=1
access-list 101 permit ip 192.168.200.0 0.0.0.255 any
access-list 101 deny ip any any
access-list 105 remark SDM_ACL Category=2
access-list 105 remark IPSec Rule
access-list 105 permit ip 192.168.200.0 0.0.0.255 any
dialer-list 1 protocol ip permit
no cdp run
!
!
!
route-map SDM_RMAP_1 permit 1
match ip address 105
!
!
!
radius-server host 192.168.1.1 auth-port 1812 acct-port 1813 key xxx
radius-server vsa send accounting
radius-server vsa send authentication
!
control-plane
!
bridge 1 protocol ieee
bridge 1 route ip
banner login CAuthorized access only!
Disconnect IMMEDIATELY if you are not an authorized user!
!
line con 0
login authentication console
transport output telnet
line aux 0
transport output telnet
line vty 0 4
access-class 101 in
login authentication telnet
transport input telnet ssh
!
scheduler allocate 4000 1000
scheduler interval 500
ntp clock-period 17180210
ntp master
ntp update-calendar
ntp server 193.204.114.232 prefer
ntp server 193.204.114.233
!
webvpn context Default_context
ssl authenticate verify all
!
no inservice
!
end
-
Wizard
- Intergalactic subspace network admin
- Messaggi: 3441
- Iscritto il: ven 03 feb , 2006 10:04 am
- Località: Emilia Romagna
- Contatta:
Mi sembra che manchi la regola per il nat0 nella acl 105
Il futuro è fatto di persone che hanno delle intuizioni e visioni .....sono quelle persone che fanno la differenza...... quelle dotate di un TERZO OCCHIO....
-
masterx81
- Cisco enlightened user
- Messaggi: 154
- Iscritto il: mer 20 giu , 2007 11:20 am
Ciao!
Infatti la 105 l'ho sistemata un po' meglio, ma in teoria quella fa solo il denatting delle interfacce locali verso la vpn...
Ora è messa così:
ip nat inside source list 105 interface ATM0.1 overload
access-list 105 deny ip any 192.168.200.0 0.0.0.255
access-list 105 deny ip any 192.168.1.0 0.0.0.255
access-list 105 permit ip 192.168.200.0 0.0.0.255 any
access-list 105 deny ip any any
Comunque non va...
Continuo a credere che sia un problema di route...
Ma non so come risolverlo!!!
Grazie per l'interesse!!!
Infatti la 105 l'ho sistemata un po' meglio, ma in teoria quella fa solo il denatting delle interfacce locali verso la vpn...
Ora è messa così:
ip nat inside source list 105 interface ATM0.1 overload
access-list 105 deny ip any 192.168.200.0 0.0.0.255
access-list 105 deny ip any 192.168.1.0 0.0.0.255
access-list 105 permit ip 192.168.200.0 0.0.0.255 any
access-list 105 deny ip any any
Comunque non va...
Continuo a credere che sia un problema di route...
Ma non so come risolverlo!!!
Grazie per l'interesse!!!
-
Wizard
- Intergalactic subspace network admin
- Messaggi: 3441
- Iscritto il: ven 03 feb , 2006 10:04 am
- Località: Emilia Romagna
- Contatta:
Inserisci sul router la rotta (rete pool vpn verso atm0.1)
Il futuro è fatto di persone che hanno delle intuizioni e visioni .....sono quelle persone che fanno la differenza...... quelle dotate di un TERZO OCCHIO....
-
Wizard
- Intergalactic subspace network admin
- Messaggi: 3441
- Iscritto il: ven 03 feb , 2006 10:04 am
- Località: Emilia Romagna
- Contatta:
Scusa, x le vpn pptp non ci vuole ne la rotta ne il nat0 (servono nelle ipsec).
Configurazione funzionante x una vpn pptp:
Configurazione funzionante x una vpn pptp:
Codice: Seleziona tutto
username remoto password ***
vpdn enable
vpdn-group 1
Default PPTP VPDN group
accept-dialin
protocol pptp
virtual-template 99
local name ***
interface Virtual-Template99
ip unnumbered Ethernet0
peer default ip address pool vpn
ppp encrypt mppe 40
ppp authentication chap
ip local pool vpn 192.6.2.190 192.6.2.199Il futuro è fatto di persone che hanno delle intuizioni e visioni .....sono quelle persone che fanno la differenza...... quelle dotate di un TERZO OCCHIO....
-
masterx81
- Cisco enlightened user
- Messaggi: 154
- Iscritto il: mer 20 giu , 2007 11:20 am
Wizard ha scritto:Scusa, x le vpn pptp non ci vuole ne la rotta ne il nat0 (servono nelle ipsec).
Configurazione funzionante x una vpn pptp:
Codice: Seleziona tutto
username remoto password *** vpdn enable vpdn-group 1 Default PPTP VPDN group accept-dialin protocol pptp virtual-template 99 local name *** interface Virtual-Template99 ip unnumbered Ethernet0 peer default ip address pool vpn ppp encrypt mppe 40 ppp authentication chap ip local pool vpn 192.6.2.190 192.6.2.199
Ma è la stessa che ho io....
Pero', perchè non riesco a pingare nulla oltre al router???
-
Wizard
- Intergalactic subspace network admin
- Messaggi: 3441
- Iscritto il: ven 03 feb , 2006 10:04 am
- Località: Emilia Romagna
- Contatta:
Permetti il proxy arp dalla interfaccia ethernet
Il futuro è fatto di persone che hanno delle intuizioni e visioni .....sono quelle persone che fanno la differenza...... quelle dotate di un TERZO OCCHIO....
-
Wizard
- Intergalactic subspace network admin
- Messaggi: 3441
- Iscritto il: ven 03 feb , 2006 10:04 am
- Località: Emilia Romagna
- Contatta:
http://it.wikipedia.org/wiki/Proxy_ARP
Disabilitalo nelle interfaccie pubbliche ma in quelle private a volte serve...
Disabilitalo nelle interfaccie pubbliche ma in quelle private a volte serve...
Il futuro è fatto di persone che hanno delle intuizioni e visioni .....sono quelle persone che fanno la differenza...... quelle dotate di un TERZO OCCHIO....
