siccome ho una ADSL con IP dinamico, uso l'877 come VPN client, e uso un ASA 5505 come VPN server (Ip statico). Direi che son riuscito a fare quasi tutto senza grossi problemi, il tunnel viene stabilito con la sede remota, e anche la parte IPSec funziona bene.
Il punto è che le due reti remote non si pingano, non si vedono.. e se faccio un "show crypto ipsec sa" i pacchetti sono sempre a zero. non c'è traffico.
credo che il problema sia a lato router, vi posto la conf. e ringrazio sin da ora se qualcuno (magari wizard
) potesse darmi un indizio. Non voglio la pappa pronta, se ho la dritta vado a cercarmi la documentazione necessaria. Grazie mille !
(è riportato solo quello che può riguardare la vpn, il resto è tagliato..)
la rete locale è 192.168.100.0/24 e la remota è 192.168.1.0/24
Building configuration...
Current configuration : 7833 bytes
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
ip cef
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.100.20 192.168.100.254
!
ip inspect name Firewall cuseeme
ip inspect name Firewall dns
ip inspect name Firewall ftp
ip inspect name Firewall h323
ip inspect name Firewall https
ip inspect name Firewall icmp
ip inspect name Firewall imap
ip inspect name Firewall pop3
ip inspect name Firewall rcmd
ip inspect name Firewall realaudio
ip inspect name Firewall rtsp
ip inspect name Firewall esmtp
ip inspect name Firewall sqlnet
ip inspect name Firewall streamworks
ip inspect name Firewall tftp
ip inspect name Firewall tcp
ip inspect name Firewall udp
ip inspect name Firewall vdolive
no ip bootp server
ip name-server 151.99.125.2
ip name-server 151.99.125.3
!
!
!
!
crypto ipsec client ezvpn ASA
connect auto
group DefaultRAGroup key cisco
mode network-extension
peer 213.82.171.4
xauth userid mode interactive
!
!
bridge irb
!
!
!
interface Dot11Radio0.1
encapsulation dot1Q 1 native
no snmp trap link-status
no cdp enable
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
!
interface Vlan1
description Interfaccia LAN
no ip address
no ip unreachables
no ip proxy-arp
ip tcp adjust-mss 1452
no ip mroute-cache
bridge-group 1
!
interface Dialer0
description Interfaccia PPPoA Verso ISP
ip ddnsxxxxxxxxxxxxxxxxx
ip address negotiated
no ip redirects
no ip unreachables
no ip proxy-arp
ip mtu 1492
ip inspect Firewall out
ip nat outside
ip virtual-reassembly
encapsulation ppp
no ip mroute-cache
dialer pool 1
no cdp enable
crypto ipsec client ezvpn ASA
!
interface BVI1
description Bridge fra LAN e WLAN verso WAN
ip address 192.168.100.254 255.255.255.0
ip access-group 102 in
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1452
crypto ipsec client ezvpn ASA inside
!
ip classless
ip route 0.0.0.0 0.0.0.0 Dialer0
!
no ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source list 105 interface Dialer0 overload
ip nat inside source static udp 192.168.100.100 4682 interface Dialer0 4682
ip nat inside source static tcp 192.168.100.105 4673 interface Dialer0 4673
ip nat inside source static udp 192.168.100.105 4673 interface Dialer0 4673
ip nat inside source static tcp 192.168.100.100 4672 interface Dialer0 4672
ip nat inside source static udp 192.168.100.100 4672 interface Dialer0 4672
ip nat inside source static tcp 192.168.100.100 3724 interface Dialer0 3724
ip nat inside source route-map EzVPN1 interface Dialer0 overload
!
access-list 102 permit ip 192.168.100.0 0.0.0.255 any
access-list 103 permit ip 192.168.100.0 0.0.0.255 any
access-list 103 permit ip 192.168.100.0 0.0.0.255 any
access-list 105 deny ip 192.168.100.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 105 deny ip 192.168.100.0 0.0.0.255 192.168.70.0 0.0.0.255
access-list 105 permit ip 192.168.100.0 0.0.0.255 any
access-list 700 permit 0013.e8f7.eed5 0000.0000.0000
access-list 700 permit 0020.002a.e611 0000.0000.0000
access-list 700 permit 001c.df38.21e6 0000.0000.0000
access-list 700 permit 0013.e8f7.52a9 0000.0000.0000
access-list 700 permit 001b.fc11.12ab 0000.0000.0000
access-list 700 deny 0000.0000.0000 ffff.ffff.ffff
no cdp run
route-map EzVPN1 permit 1
description Routing verso endpoint VPN
match ip address 103![/u]
