cabu 10 Geschrieben 17. Februar 2009 Melden Teilen Geschrieben 17. Februar 2009 Hallo, ich habe einen 851 über ein DSL-Modem D-Link 380T angebunden. Es soll mit DynDns eine VPN-Verbindung ermöglicht werden. Ich habe vor einem halben Jahr mal eine Startup-Config im Netz gefunden (leider nicht gespeichert), aber bei google kommt momentan leider nur Kommerzmüll und keine wirkliche Hilfe... Ich habe folgende Config von einem Kollegen bekommen, aber irgendwie funktioniert die nicht. Der Router will keine Internetverbindung mit dem Modem aufbauen. Ich kann den 851 anpingen von meinem PC 192.168.1.31 Die LED's am Modem sagen, das DSL und LAN anliegen... Hilfe !! Zitieren Link zu diesem Kommentar
cabu 10 Geschrieben 17. Februar 2009 Autor Melden Teilen Geschrieben 17. Februar 2009 router#show running-config Building configuration... Current configuration : 7356 bytes ! version 12.4 no service pad service tcp-keepalives-in service tcp-keepalives-out service timestamps debug datetime msec localtime show-timezone service timestamps log datetime msec localtime show-timezone service password-encryption service sequence-numbers ! hostname router ! boot-start-marker boot-end-marker ! logging buffered 512000 enable secret 5 ... ! aaa new-model ! ! aaa authentication login default local aaa authentication login vpn_xauth_ml_1 local aaa authorization exec default local aaa authorization network vpn_group_ml_1 local ! ! aaa session-id common ! crypto pki trustpoint TP-self-signed-2846655211 enrollment selfsigned subject-name cn=IOS-Self-Signed-Certificate-2846655211 revocation-check none rsakeypair TP-self-signed-2846655211 ! ! crypto pki certificate chain TP-self-signed-2846655211 certificate self-signed 01 ... quit dot11 syslog no ip source-route no ip dhcp use vrf connected ip dhcp excluded-address 192.168.1.1 ! ip dhcp pool dhcp_pool_1 import all network 192.168.1.0 255.255.255.0 default-router 192.168.1.1 dns-server 192.168.1.1 lease 0 2 ! ! no ip cef ip auth-proxy max-nodata-conns 3 ip admission max-nodata-conns 3 no ip bootp server ip domain name home ip name-server 212.6.108.140 ip name-server 212.6.108.141 ip ddns update method dyndns HTTP add http://xxx:xxx/@members.dyndns.org/nic/updatesystem=dyndns'>http://xxx:xxx/@members.dyndns.org/nic/updatesystem=dyndns &hostname=xxx.dyndns.org&myip=<a> remove http://xxx:xxx/@members.dyndns.org/nic/updatesystem=dyn dns&hostname=xxx.dyndns.org&myip=<a> ! ! ! ! username admin privilege 15 secret 5 ... ! ! crypto isakmp policy 1 encr 3des authentication pre-share group 2 ! crypto isakmp client configuration group VPN-Home key xxx pool VPN_DHCP_POOL_1 crypto isakmp profile vpn-ike-profile-1 match identity group VPN-Home client authentication list vpn_xauth_ml_1 isakmp authorization list vpn_group_ml_1 client configuration address respond virtual-template 1 ! ! crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto ipsec transform-set ESP-3DES-SHA1 esp-3des esp-sha-hmac ! crypto ipsec profile VPN_Profile_1 set transform-set ESP-3DES-SHA1 set isakmp-profile vpn-ike-profile-1 ! ! archive log config hidekeys ! ! ip tcp synwait-time 10 ! ! ! interface Loopback1 description $FW_INSIDE$ ip address 192.168.2.1 255.255.255.0 no ip redirects no ip unreachables no ip proxy-arp ! interface Null0 no ip unreachables ! interface FastEthernet0 ! interface FastEthernet1 ! interface FastEthernet2 ! interface FastEthernet3 ! interface FastEthernet4 no ip address duplex auto speed auto pppoe enable group global pppoe-client dial-pool-number 1 no keepalive ! interface Virtual-Template1 type tunnel description $FW_INSIDE$ ip unnumbered Loopback1 no ip redirects no ip unreachables no ip proxy-arp tunnel mode ipsec ipv4 tunnel protection ipsec profile VPN_Profile_1 ! interface Vlan1 description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$FW_INSIDE$ ip address 192.168.1.1 255.255.255.0 no ip redirects no ip unreachables no ip proxy-arp ip nat inside ip virtual-reassembly ip tcp adjust-mss 1412 ! interface Dialer1 ip ddns update dyndns ip address negotiated ip access-group Internet_In in ip access-group Internet_Out out no ip redirects no ip unreachables no ip proxy-arp ip mtu 1492 ip nat outside ip virtual-reassembly encapsulation ppp no ip route-cache no ip mroute-cache dialer pool 1 dialer idle-timeout 0 dialer persistent dialer-group 1 no cdp enable ppp authentication chap callin ppp chap hostname xxx ppp chap password 7 xxx ! ip local pool VPN_DHCP_POOL_1 192.168.2.33 192.168.2.62 ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 Dialer1 ! Zitieren Link zu diesem Kommentar
cabu 10 Geschrieben 17. Februar 2009 Autor Melden Teilen Geschrieben 17. Februar 2009 no ip http server ip http authentication local ip http secure-server ip http timeout-policy idle 60 life 86400 requests 10000 ip dns server ip nat inside source list 4 interface Dialer1 overload ! ip access-list extended Internet_In evaluate Internet_Out_Reflex remark DNS permit udp host 212.6.108.140 eq domain any permit udp host 212.6.108.141 eq domain any remark VPN In permit udp any any eq non500-isakmp permit udp any any eq isakmp permit esp any any permit ahp any any remark NTP (123) permit udp host 213.240.180.155 eq ntp any eq ntp permit udp host 84.16.235.159 eq ntp any eq ntp remark SSH permit tcp 194.156.172.64 0.0.0.63 any eq 22 permit tcp 194.156.172.16 0.0.0.15 any eq 22 remark ICMP permit icmp any any echo-reply permit icmp any any time-exceeded permit icmp any any unreachable remark Deny all internals ip adresses deny ip 10.0.0.0 0.255.255.255 any deny ip 172.16.0.0 0.15.255.255 any deny ip 192.168.0.0 0.0.255.255 any deny ip 127.0.0.0 0.255.255.255 any deny ip host 255.255.255.255 any deny ip host 0.0.0.0 any remark Deny all deny ip any any log ip access-list extended Internet_Out remark WINS, NETBIOS deny ip any host 141.200.6.33 deny ip any host 141.200.6.34 deny udp any eq netbios-ns any log remark VPN Out permit udp any eq 10000 any eq 10000 reflect Internet_Out_Reflex permit udp any gt 1000 any eq isakmp reflect Internet_Out_Reflex permit udp any gt 1000 any eq non500-isakmp reflect Internet_Out_Reflex permit tcp any gt 1024 any eq www reflect Internet_Out_Reflex permit ip any any reflect Internet_Out_Reflex ! access-list 4 remark NAT Rule access-list 4 permit 192.168.1.0 0.0.0.255 access-list 4 deny any access-list 23 permit 192.168.1.0 0.0.0.255 access-list 23 permit 192.168.2.0 0.0.0.255 access-list 23 permit 194.156.172.64 0.0.0.63 access-list 23 permit 194.156.172.16 0.0.0.15 access-list 23 deny any no cdp run ! control-plane ! ! line con 0 no modem enable transport output telnet line aux 0 transport output telnet line vty 0 4 access-class 23 in transport input ssh ! scheduler max-task-time 5000 end Zitieren Link zu diesem Kommentar
cabu 10 Geschrieben 17. Februar 2009 Autor Melden Teilen Geschrieben 17. Februar 2009 Und als startprotokoll bekomme ich folgendes: *Mar 1 00:00:04.279: %VPN_HW-6-INFO_LOC: Crypto engine: onboard 0 State changed to: Initialized *Mar 1 00:00:04.283: %VPN_HW-6-INFO_LOC: Crypto engine: onboard 0 State changed to: Enabled *Mar 1 00:00:06.811: %LINK-3-UPDOWN: Interface FastEthernet0, changed state to up *Mar 1 00:00:06.811: %LINK-3-UPDOWN: Interface FastEthernet4, changed state to up 000006: *Mar 1 00:00:07.839 UTC: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0, changed state to up 000007: *Mar 1 00:00:07.839 UTC: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet4, changed state to up 000008: *Mar 1 00:00:08.939 UTC: %SYS-5-CONFIG_I: Configured from memory by console 000009: *Mar 1 02:56:47.335 UTC: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback1, changed state to up 000010: *Mar 1 02:56:47.335 UTC: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Template1, changed state to down 000011: *Mar 1 02:56:47.339 UTC: %SYS-5-RESTART: System restarted -- Cisco IOS Software, C850 Software (C850-ADVSECURITYK9-M), Version 12.4(15)T5, RELEASE SOFTWARE (fc4) Technical Support: Cisco - Shortcut Copyright © 1986-2008 by Cisco Systems, Inc. Compiled Thu 01-May-08 02:07 by prod_rel_team 000012: *Mar 1 02:56:47.339 UTC: %SNMP-5-COLDSTART: SNMP agent on host router is undergoing a cold start 000013: *Mar 1 02:56:47.363 UTC: %SSH-5-ENABLED: SSH 1.99 has been enabled 000014: *Mar 1 02:56:47.591 UTC: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is OFF 000015: *Mar 1 02:56:47.591 UTC: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is OFF 000016: *Mar 1 02:56:47.591 UTC: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON 000017: *Mar 1 02:56:47.607 UTC: %LINEPROTO-5-UPDOWN: Line protocol on Interface NVI0, changed state to up 000018: *Mar 1 02:56:48.611 UTC: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state to up 000019: *Mar 1 02:56:48.963 UTC: %LINK-3-UPDOWN: Interface FastEthernet3, changed state to up 000020: *Mar 1 02:56:48.963 UTC: %LINK-3-UPDOWN: Interface FastEthernet2, changed state to up 000021: *Mar 1 02:56:48.963 UTC: %LINK-3-UPDOWN: Interface FastEthernet0, changed state to up 000022: *Mar 1 02:56:49.963 UTC: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet3, changed state to down 000023: *Mar 1 02:56:49.963 UTC: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet2, changed state to down 000024: *Mar 1 02:56:49.963 UTC: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet1, changed state to up 000025: *Mar 1 02:56:49.963 UTC: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0, changed state to down 000026: *Mar 1 02:56:50.287 UTC: %DIALER-6-BIND: Interface Vi2 bound to profile Di1 000027: *Mar 1 02:56:50.303 UTC: %LINK-3-UPDOWN: Interface Virtual-Access2, changed state to up 000028: *Mar 1 02:56:50.555 UTC: %DIALER-6-UNBIND: Interface Vi2 unbound from profile Di1 000029: *Mar 1 02:56:50.559 UTC: %LINK-3-UPDOWN: Interface Virtual-Access2, changed state to down 000030: *Mar 1 02:57:12.815 UTC: %DIALER-6-BIND: Interface Vi2 bound to profile Di1 000031: *Mar 1 02:57:12.819 UTC: %LINK-3-UPDOWN: Interface Virtual-Access2, changed state to up 000032: *Mar 1 02:57:13.055 UTC: %DIALER-6-UNBIND: Interface Vi2 unbound from profile Di1 000033: *Mar 1 02:57:13.059 UTC: %LINK-3-UPDOWN: Interface Virtual-Access2, changed state to down 000034: *Mar 1 02:57:35.343 UTC: %DIALER-6-BIND: Interface Vi2 bound to profile Di1 000035: *Mar 1 02:57:35.347 UTC: %LINK-3-UPDOWN: Interface Virtual-Access2, changed state to up 000036: *Mar 1 02:57:35.591 UTC: %DIALER-6-UNBIND: Interface Vi2 unbound from profile Di1 000037: *Mar 1 02:57:35.595 UTC: %LINK-3-UPDOWN: Interface Virtual-Access2, changed state to down Ich muß leider sagen, daß ich Cisco nicht selber programmieren kann, sondern nur ab und an leichte Anpassungen mache... Zitieren Link zu diesem Kommentar
Otaku19 33 Geschrieben 17. Februar 2009 Melden Teilen Geschrieben 17. Februar 2009 seh zB keine dialer-list Zitieren Link zu diesem Kommentar
Empfohlene Beiträge
Schreibe einen Kommentar
Du kannst jetzt antworten und Dich später registrieren. Falls Du bereits ein Mitglied bist, logge Dich jetzt ein.