Ho disabilitato globalmente l'IPS , è configurato il ZBPF , queste le parti della config. che potrebbero interessare:
Codice: Seleziona tutto
Dynamic DNS Update Method: my_ddns
Dynamic DNS update via HTTP based protocols
URL used to add DNS records: https://my_user:[email protected]/nic/update?system=dyndns&hostname=<h>&myip=<a>
URL used to remove DNS records: https://my_user:[email protected]/nic/update?system=dyndns&hostname=<h>&myip=<a>
Maximum update interval: 1 days 0 hours 0 minutes 0 seconds
Minimum update interval: 1 days 0 hours 0 minutes 0 seconds
router02#sh run int di0
Building configuration...
Current configuration : 535 bytes
!
interface Dialer0
ip ddns update hostname my_host.dyndns.org
ip ddns update my_ddns host members.dyndns.org
ip address negotiated
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip virtual-reassembly in
ip verify unicast reverse-path
zone-member security wan
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication chap pap callin
ppp chap hostname aliceadsl
ppp chap password 7 03055702050A20485D05
ppp pap sent-username aliceadsl password 7 00051F0F075E0A021C2D
no cdp enable
end
Zone-pair name wan2self
Source-Zone wan Destination-Zone self
service-policy wan2self-p-map
Policy Map type inspect wan2self-p-map
Class ipsec-in-c-map
Pass
Class web.vpn-c-map
Pass log
Class class-default
Drop log
Zone-pair name self2wan
Source-Zone self Destination-Zone wan
service-policy self2wan-p-map
Policy Map type inspect self2wan-p-map
Class ipsec-out-c-map
Pass
Class web.vpn-c-map
Pass log
Class self2out-c-map
Inspect
Class class-default
Drop
Class Map type inspect match-any self2out-c-map (id 29)
Match protocol tcp
Match protocol udp
Match protocol icmpCodice: Seleziona tutto
000792: *Oct 31 19:08:43.743 Rome: HTTPDNSUPD: URL = 'https://my_user:[email protected]/nic/update?system=dyndns
&hostname=my_host.dyndns.org&myip=my_ip'
000795: *Oct 31 19:09:03.752 Rome: HTTPDNSUPD: Call returned Connection time out, update of my_host.dyndns.org <=> my_ip failed
000796: *Oct 31 19:09:03.752 Rome: DYNDNSUPD: Another update completed (outstanding=0, total=0)
000797: *Oct 31 19:09:03.752 Rome: HTTPDNSUPD: Clearing all session 12 info
000798: *Oct 31 19:09:14.562 Rome: %FW-6-DROP_PKT: Dropping tcp session 204.13.248.111:443 my_ip:13403 on zone-pair wan2self
class class-default due to DROP action found in policy-map with ip ident 0
Il certificato è presente ( via enrollment terminal pem), ho provato anche con un altro method (http) , niente... ho fatto anche altri tentativi di volta in volta meno restrittivi sulla wan-zone , alla fine ho provato anche con una sola policy-map (pass log) sia sulla wan2self che sulla self2wan , in pratica "tutto aperto" (una class-map con match su acl "permit ip any any"....) niente....se invece incollo la richiesta nel browser ( firefox, ie) l'update è ok ...
Qualche idea ???
jonatha
