[es] - Cisco Easy VPN Server + VPN Client

losm1

Član broj: 253305
Poruke: 30
*.dynamic.sbb.rs.

+2 Profil

^{07.03.2011. u 19:13 - pre 159 meseci}

Pokušavam da konfigurišem jedan cisco access router da funkcioniše kao VPN server.
Kao klijent koristim Cisco VPN Client 5.00.07.290.

Ispratio sam neka uputstva ali klijent baca grešku 433.

Konfiguracija sledi, debug crypto isakmp je u prilogu, gde grešim?

!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname box
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 warnings
enable secret 5 xxxxxxxxxx
!
aaa new-model
!
!
aaa authentication login vpnclient local
aaa authorization network localgroups local
!
aaa session-id common
!
resource policy
!
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
ip subnet-zero
ip cef
!
!
no ip domain lookup
!
!
voice-card 0
!
!
username vpnuser secret 5 xxxxxxxxxxx
!
!
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 2
crypto isakmp keepalive 20 10
!
crypto isakmp client configuration group vpn-access
key test
dns 192.168.1.1
domain ls49.org
pool vpn-addr
acl acl-vpn
include-local-lan
max-users 2
max-logins 2
!
!
crypto ipsec transform-set client-transform esp-aes 256 esp-sha-hmac
!
crypto dynamic-map dynmap 10
set transform-set client-transform
!
!
crypto map map-0 client authentication list vpnclient
crypto map map-0 isakmp authorization list localgroups
crypto map map-0 client configuration address respond
crypto map map-0 1000 ipsec-isakmp dynamic dynmap
!
!
interface FastEthernet0/0
ip address 10.0.0.254 255.255.255.0
duplex auto
speed auto
no cdp enable
!
interface FastEthernet0/1
ip address 192.168.1.10 255.255.255.0
duplex auto
speed auto
crypto map map-0
!
interface Serial0/1/0
no ip address
shutdown
clock rate 2000000
!
ip local pool vpn-addr 10.0.0.1 10.0.0.15
ip classless
ip route 0.0.0.0 0.0.0.0 FastEthernet0/0
!
!
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip access-list extended acl-vpn
permit ip 10.0.0.0 0.0.255.255 any
!
access-list 23 permit 192.168.0.0 0.0.255.255
access-list 101 permit ip 192.168.0.0 0.0.255.255 any
!
!
control-plane
!
!
line con 0
line aux 0
line vty 0 4
access-class 23 in
transport input telnet ssh
line vty 5 15
access-class 23 in
transport input telnet ssh
!
end

Prikačeni fajlovi

debug_crypto_isakmp.txt - 11.8k

Odgovor na temu

mckrsta
Nenad Krstic
System Engineer
AT&T Slovakia
Bratislava

Član broj: 44532
Poruke: 219
*.dynamic.isp.telekom.rs.

Sajt: www.bor030.net

+6 Profil

Re: Cisco Easy VPN Server + VPN Client

^{07.03.2011. u 20:01 - pre 159 meseci}

upravo mi je sa kompletnom tvojom konfiguracijom, prosao vpn klijent....

jedino sto sam izmenio je to da sam dodao novog user-a sa novim pass, ostalo nisam dirao

obrati paznju koj interface, tj koju ip adresu gadjas.... tj gadjas onaj int na koj si primenio crypto mapu...

probaj i ovo

1. Uninstall the vpn client.
2. Start a command prompt.
3. Type
"netsh int ip reset reset.log"
4. Type
"netsh winsock reset"
5. Reboot
6. Install the VPN client
7. Import the pcf.
8. Try connecting again

Odgovor na temu

losm1

Član broj: 253305
Poruke: 30
*.dynamic.sbb.rs.

+2 Profil

Re: Cisco Easy VPN Server + VPN Client

^{09.03.2011. u 17:58 - pre 159 meseci}

Probao sam i sa drugog racunara, isti ishod, ne verujem da bi uninstall klijenta pomogao.
Da li postoji neki compatibility matrix verzija IOS-a i VPNClient-a? Da nije da se nesto verzije ne mirisu.

Odgovor na temu

losm1

Član broj: 253305
Poruke: 30
*.dynamic.sbb.rs.

+2 Profil

Re: Cisco Easy VPN Server + VPN Client

^{23.03.2011. u 21:08 - pre 159 meseci}

Uradio sam write erase, reload, ucitao konfiguraciju i VPN funkcionise. Ne znam sta je u bilo u pitanju ali sada radi!

Odgovor na temu

bachi
Vladimir Vučićević
System administrator
Beograd, Srbija

Član broj: 17912
Poruke: 5318

Sajt: www.bachi.in.rs

+2827 Profil

Re: Cisco Easy VPN Server + Pfsense IPSec client

^{15.04.2011. u 08:02 - pre 158 meseci}

Ae da iskoristim ovu temu, da ne kradem Gojku prostora. :D

Naime, možda ćemo se kačiti na trezor preko VPNa radi online plaćanja, a koliko vidim, oni vpn server drže na Ciscu i nude Cisco VPN klijent za Windows. E sad, ja vrlo malo znam oko samog Cisca, ali sam pročitao da taj klijent ume da pravi probleme, da zna da izazove BSOD, ovo ono. Da li je Ciscov VPN u stvari klasičan ipsec, ili nešto drugo?

Ako jeste, da li bi onda mogao u svom pfSense-u da ostvarim konekciju ka Cisco VPN ruteru?

Dole na slici su opcije koje imam na pFsense-u vezano za ipsec:

Hvala unapred. :D

... Vladimir Vučićević aka. Bachi
~~~ www.bachi.in.rs <<<<>>>> [email protected]
>>> It's nice to be important, but it's more important to be nice...

Odgovor na temu