no no è lenta uguale anche con il portatile attaccato direttamente all'antenna, ho già aperto un ticket.
Per la vpn con il show crypto ipsec sa , sembra che del traffico passi fra le vpn mi sà che è un problema di routing anche qui.
Apro un nuovo tread?
ecco lo show crypto ipsec sa (lato client):
Codice: Seleziona tutto
router#show crypto ipsec sa
interface: FastEthernet1/0
Crypto map tag: STATIC_router, local addr 94.xxx.xxx.xxx
protected vrf: (none)
local ident (addr/mask/prot/port): (192.168.6.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.254.0/255.255.255.0/0/0)
current_peer 82.xxx.xxx.xxx port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 94.xxx.xxx.xxx, remote crypto endpt.: 82.xxx.xxx.xxx
path mtu 1500, ip mtu 1500
current outbound spi: 0x0(0)
PFS (Y/N): N, DH group: none
inbound esp sas:
inbound ah sas:
inbound pcp sas:
outbound esp sas:
outbound ah sas:
outbound pcp sas:
protected vrf: (none)
local ident (addr/mask/prot/port): (192.168.6.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.0.0/255.255.255.0/0/0)
current_peer 82.xxx.xxx.xxx port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 94.xxx.xxx.xxx, remote crypto endpt.: 82.xxx.xxx.xxx
path mtu 1500, ip mtu 1500
current outbound spi: 0x0(0)
PFS (Y/N): N, DH group: none
inbound esp sas:
inbound ah sas:
inbound pcp sas:
outbound esp sas:
outbound ah sas:
outbound pcp sas:
protected vrf: (none)
local ident (addr/mask/prot/port): (192.168.6.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
current_peer 82.xxx.xxx.xxx port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 4, #pkts encrypt: 4, #pkts digest: 4
#pkts decaps: 961, #pkts decrypt: 961, #pkts verify: 961
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 1, #recv errors 141
local crypto endpt.: 94.xxx.xxx.xxx, remote crypto endpt.: 82.xxx.xxx.xxx
path mtu 1500, ip mtu 1500
current outbound spi: 0x80D40784(2161379204)
PFS (Y/N): N, DH group: none
inbound esp sas:
spi: 0xEAEC056F(3941336431)
transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 59, flow_id: 59, sibling flags 80000040, crypto map: STATIC_router
sa timing: remaining key lifetime (k/sec): (4527573/1862)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0x80D40784(2161379204)
transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 60, flow_id: 60, sibling flags 80000040, crypto map: STATIC_router
sa timing: remaining key lifetime (k/sec): (4527578/1862)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
router#
router#
router#ping
Protocol [ip]:
Target IP address: 192.168.1.21
Repeat count [5]:
Datagram size [100]:
Timeout in seconds [2]:
Extended commands [n]: y
Source address or interface: 97.xxx.xxx.xxx
% Invalid source
Source address or interface: 192.168.6.1
Type of service [0]:
Set DF bit in IP header? [no]:
Validate reply data? [no]:
Data pattern [0xABCD]:
Loose, Strict, Record, Timestamp, Verbose[none]:
Sweep range of sizes [n]:
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.21, timeout is 2 seconds:
Packet sent with a source address of 192.168.6.1
.....
Success rate is 0 percent (0/5)
router#ping
Protocol [ip]:
Target IP address: 192.168.1.21
Repeat count [5]:
Datagram size [100]:
Timeout in seconds [2]:
Extended commands [n]: y
Source address or interface: 94.xxx.xxx.xxx
Type of service [0]:
Set DF bit in IP header? [no]:
Validate reply data? [no]:
Data pattern [0xABCD]:
Loose, Strict, Record, Timestamp, Verbose[none]:
Sweep range of sizes [n]:
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.21, timeout is 2 seconds:
Packet sent with a source address of 94.xxx.xxx.xxx
.....
Success rate is 0 percent (0/5)
router#ping 192.168.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 1/1/4 ms
router#ping 192.168.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
router#ping 192.168.1.21
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.21, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
router#
lato server:
Codice: Seleziona tutto
protected vrf:
local ident (addr/mask/prot/port): (192.168.254.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.6.0/255.255.255.0/0/0)
current_peer: 94.xxx.xxx.xxx:500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 14, #pkts encrypt: 14, #pkts digest 14
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 1, #recv errors 0
local crypto endpt.: 82.xxx.xxx.xxx, remote crypto endpt.: 94.xxx.xxx.xxx
path mtu 1500, media mtu 1500
current outbound spi: 0
inbound esp sas:
inbound ah sas:
inbound pcp sas:
outbound esp sas:
outbound ah sas:
outbound pcp sas:
protected vrf:
local ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.6.0/255.255.255.0/0/0)
current_peer: 94.xxx.xxx.xxx:500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 1536, #pkts encrypt: 1536, #pkts digest 1536
#pkts decaps: 9, #pkts decrypt: 9, #pkts verify 9
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 4, #recv errors 0
local crypto endpt.: 82.xxx.xxx.xxx, remote crypto endpt.: 94.xxx.xxx.xxx
path mtu 1500, media mtu 1500
current outbound spi: EAEC056F
inbound esp sas:
spi: 0x80D40784(2161379204)
transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel, }
slot: 0, conn id: 2030, flow_id: 31, crypto map: STATIC_router
sa timing: remaining key lifetime (k/sec): (4530481/1408)
IV size: 8 bytes
replay detection support: Y
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0xEAEC056F(3941336431)
transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel, }
slot: 0, conn id: 2031, flow_id: 32, crypto map: STATIC_router
sa timing: remaining key lifetime (k/sec): (4530476/1408)
IV size: 8 bytes
replay detection support: Y
outbound ah sas:
outbound pcp sas:
protected vrf:
router#ping 192.168.6.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.6.1, timeout is 2 seconds:
.U.U.
Success rate is 0 percent (0/5)
router#
Da quello che nella mia ignoranza posso capire la vpn tra client e server è andata up ma il traffico non viene instradato correttamente.
il ping dal client al router server 192.168.1.1 al secondo tentativo dall'80% è andato al 100% ma se pingo un qualunque ip (che sono sicuro essere up) che non sia il router non lo pinga.
Dal router server al client non pinga nulla.
Avevo già avuto lo stesso problema con un 857W che mi avete aiutato a risolvere, ho provato tutto quello che mi veniva in mente ma non va.
La tabella di routing è sempre quella sopra.
Grazie Mille!
