[es] - Pomoc oko podizanja IPsec

myki2
BeotelNet ISP
Beograd

Član broj: 204989
Poruke: 3
91.148.109.*

Profil

^{15.12.2008. u 11:14 - pre 187 meseci}

Podigao sam IPsec izmedju C1841 i ASA i to je sve OK IPsec se podize i sve radi kako treba.

Ubacio sam dodatni WAN link, jedan primarni i drugi kao backup, podigao OSPF, definisao loopback adresu...
I to sve radi kako treba.
sada hocu da IPsec dizem sa loopback adrese i to je ono sto nikako nece da mi proradi.
U nastavku je interesantni deo konfiguracije:
--------------------------Ruter-------------------------------
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key XXXXXX address A.B.168.30
!
!
crypto ipsec transform-set Myset esp-3des esp-md5-hmac
!
crypto map IngepostVPN local-address loopback 0
crypto map IngepostVPN 10 ipsec-isakmp
set peer A.B.168.30
set transform-set Myset
match address 102
---------------------------------------------------------------
Takodje da napomenem da sam primenio '' crypto map IngepostVPN '' komandu na oba WAN porta

----------------------ASA-------------------------------------
crypto ipsec transform-set Myset esp-3des esp-md5-hmac
crypto map outside_map 20 match address kripto
crypto map outside_map 20 set peer C.D.E.217 ------------------Ovo je Loopback adresa rutera
crypto map outside_map 20 set transform-set Myset
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 20
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400
----------------------------------------------------------------

Takodje bih napomenio da sam uradio razne ''clear crypto ..... '' komande

Verujem da je problem banalan, pogotovo sto mi IPsec radi kada ga podizem sa Fe interface-a
ali ja jednostavno ne znam da ga resim.
Bio bih zahvalan ako neko ima barem neku ideju, posto sam ja sve moje ideje iscrpio.

MYKI2

Odgovor na temu

myki2
BeotelNet ISP
Beograd

Član broj: 204989
Poruke: 3
91.148.109.*

Profil

Re: Pomoc oko podizanja IPsec - a

^{15.12.2008. u 15:25 - pre 187 meseci}

Poprilicno sam sa siguran da je sa access listama je sve OK!
Sve access liste su obrnuto preslikane.
Posto taj Loopback koristim za NAT ubacio sam access listu koja zabranjuje NAT ip adresama koje idu kroz IPsec.

svejedno ih saljem:

---------------------Ruter--------------------------------------

ip nat inside source list 101 interface Loopback0 overload

access-list 101 deny ip 10.33.1.100 0.0.0.3 10.0.33.0 0.0.0.255
access-list 101 deny ip 10.33.1.104 0.0.0.7 10.0.33.0 0.0.0.255
access-list 101 deny ip 10.33.1.112 0.0.0.7 10.0.33.0 0.0.0.255
access-list 101 deny ip host 10.33.1.32 10.0.33.0 0.0.0.255
access-list 101 deny ip host 10.33.1.1 10.0.33.0 0.0.0.255
access-list 101 permit ip 10.33.1.0 0.0.0.255 any
access-list 102 permit ip 10.33.1.100 0.0.0.3 10.0.33.0 0.0.0.255
access-list 102 permit ip 10.33.1.104 0.0.0.7 10.0.33.0 0.0.0.255
access-list 102 permit ip 10.33.1.112 0.0.0.7 10.0.33.0 0.0.0.255
access-list 102 permit ip host 10.33.1.32 10.0.33.0 0.0.0.255
access-list 102 permit ip host 10.33.1.1 10.0.33.0 0.0.0.255
-----------------------------------------------------------------

----------------------------ASA---------------------------------------------------------

access-list kripto extended permit ip 10.0.33.0 255.255.255.0 10.33.1.100 255.255.255.252
access-list kripto extended permit ip 10.0.33.0 255.255.255.0 10.33.1.104 255.255.255.248
access-list kripto extended permit ip 10.0.33.0 255.255.255.0 10.33.1.112 255.255.255.248
access-list kripto extended permit ip 10.0.33.0 255.255.255.0 host 10.33.1.32
access-list kripto extended permit ip 10.0.33.0 255.255.255.0 host 10.33.1.1
access-list nonat extended deny ip 10.0.33.0 255.255.255.0 10.33.1.100 255.255.255.252
access-list nonat extended deny ip 10.0.33.0 255.255.255.0 10.33.1.104 255.255.255.248
access-list nonat extended deny ip 10.0.33.0 255.255.255.0 10.33.1.112 255.255.255.248
access-list nonat extended deny ip 10.0.33.0 255.255.255.0 host 10.33.1.32
access-list nonat extended deny ip 10.0.33.0 255.255.255.0 host 10.33.1.1
access-list nonat extended permit ip 10.0.33.0 255.255.255.0 any
-------------------------------------------------------------------------------------------

MYKI2

Odgovor na temu