Devo dire che grazie alla versatilità degli apparati cisco, si riesce a fargli fare anche il caffe.
Veniamo a noi.Sono riuscito a collegare due siti tramite VPN "anche se su uno dei due siti c'è freeswan Linux" e devo dire che tutto funziona egreggiamente, ma dovrei perfezionare alcune cose che dopo la configurazione del Cisco 877 installato vi dirò.
Codice: Seleziona tutto
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname router_foligno
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 debugging
logging console critical
enable secret 5 $1$oZ4h$NogeGj1IMgVpxU9mmhOTR1
!
no aaa new-model
!
resource policy
!
clock timezone PCTime 1
clock summer-time PCTime date Mar 30 2003 2:00 Oct 26 2003 3:00
no ip source-route
!
!
ip cef
ip tcp synwait-time 10
no ip bootp server
ip domain name interbusiness.it
ip name-server 151.99.125.2
ip name-server 151.99.0.100
ip ssh time-out 60
ip ssh authentication-retries 2
!
!
crypto pki trustpoint TP-self-signed-2799396859
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-2799396859
revocation-check none
rsakeypair TP-self-signed-2799396859
!
!
crypto pki certificate chain TP-self-signed-2799396859
certificate self-signed 01
30820257 308201C0 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 32373939 33393638 3539301E 170D3037 31313136 30383538
31365A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D32 37393933
39363835 3930819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100B9A5 A90F2C6B 253FAD41 61F859B8 20E99EFE 8181FE21 84705CB7 5170804F
1AE05858 F745215A FC78F376 E16CC481 4D608864 571B19F0 E10A31C2 79259CC9
68893161 1E012BDF A9FBA1B2 04B271C0 436DB18B B48E3375 A5930C79 F3648A90
B28D681F 2D0A60F9 05D9AD98 0EAF3156 DC9A9232 EC538965 8CF49796 50444B7C
94DD0203 010001A3 7F307D30 0F060355 1D130101 FF040530 030101FF 302A0603
551D1104 23302182 1F726F75 7465725F 666F6C69 676E6F2E 696E7465 72627573
696E6573 732E6974 301F0603 551D2304 18301680 149B9ED2 F10F11AC E031F226
B1441077 881413B2 22301D06 03551D0E 04160414 9B9ED2F1 0F11ACE0 31F226B1
44107788 1413B222 300D0609 2A864886 F70D0101 04050003 818100AA 9ECDAEAA
D9FFAA95 EDB5BC43 A28D8217 1BC861FB 019E9DCF F554639B 4126CFC9 6877F2F1
2432EDA6 C876C41A 5E26C11F CC808401 0AF1D51A 5E9EEA15 1D2522D9 05971FB0
CDF37C21 9C73A870 A685850F D64EB6CF 0413F8A1 A32CFC68 59C3B59F 10DCAAF7
FF336753 64B53C08 B8BFFF0E AF9892FA 47CBA99A 5E0FC01E 005EE1
quit
username admin privilege 15 secret 5 $1$M0l8$niBo0Ms8POBZieAuy3WQG0
!
!
!
crypto isakmp policy 9
encr 3des
hash md5
authentication pre-share
lifetime 28800
crypto isakmp key test address 85.43.45.90
!
crypto ipsec security-association lifetime seconds 28800
!
crypto ipsec transform-set s1s2trans esp-3des esp-md5-hmac
!
crypto map to-site2 10 ipsec-isakmp
set peer 85.43.45.90
set transform-set s1s2trans
match address 101
reverse-route
!
!
!
interface ATM0
no ip address
no ip redirects
no ip proxy-arp
ip route-cache flow
no atm ilmi-keepalive
dsl operating-mode auto
crypto ipsec df-bit clear
!
interface ATM0.1 point-to-point
description PVC verso P2P
bandwidth 4096
ip address 88.44.214.193 255.255.255.248
ip nat outside
ip virtual-reassembly
no snmp trap link-status
pvc 8/35
oam-pvc manage
oam retry 5 5 1
encapsulation aal5snap
!
crypto map to-site2
crypto ipsec df-bit clear
!
interface FastEthernet0
hold-queue 100 out
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$ES_LAN$$FW_INSIDE$
ip address 192.168.64.254 255.255.255.0
ip nat inside
ip virtual-reassembly
ip route-cache flow
!
ip route 0.0.0.0 0.0.0.0 ATM0.1 permanent
!
no ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source route-map nonat interface ATM0.1 overload
!
logging trap debugging
access-list 101 permit ip 192.168.64.0 0.0.0.255 192.168.33.0 0.0.0.255
access-list 150 deny ip 192.168.64.0 0.0.0.255 192.168.33.0 0.0.0.255
access-list 150 permit ip 192.168.64.0 0.0.0.255 any
no cdp run
route-map nonat permit 10
match ip address 150
!
!
control-plane
!
banner login ^CAuthorized access only!
Disconnect IMMEDIATELY if you are not an authorized user!^C
!
line con 0
login local
no modem enable
transport output telnet
line aux 0
login local
transport output telnet
line vty 0 4
privilege level 15
login local
transport input telnet ssh
!
scheduler max-task-time 5000
scheduler allocate 4000 1000
scheduler interval 500
end
Sito 1 : 192.168.33.5/24 IpCop Firewall
Sito 2 : 192.168.64.254/24 Cisco 877
Ora,come già detto, la vpn funziona perfettamente, le due sedi comunicano in tutti i versi, le velocità sono perfette, unico nodo da sciogliere è che dal sito 2 vorrei far uscire tutto il traffico verso internet attraverso il sito 1 cioè tramite il firewall.Il Dilemma per me è :
ip route + Acl oppure ACL o IpRoute....
Dopo tutti i tentativi e quintali di nozioni apprese dal sito cisco,sono entrato un pò in confusione ed eccomi quì a cercare qualche spunto da chi ovviamente ne sà più di mè.
Vi ringrazio anticipatamente per un'eventuale risposta.
