Cisco Easy VPN?

[MYOEY 10]

Ich habe folgende Konstallation:

 

PIX515 --> Easy-VPN Server

 

PIX506 --> Easy-VPN Client

 

Die VPN Verbindung wird erfogreich aufgebaut und funktioniert alles soweit bis auf, wenn ein PC hinter dem Easy-vpn-Server einen PC hinter dem Easy-vpn-Client anpingen will, geht es nicht obwohl der PC hinter dem Client den PC hinter dem Server anpingen kann!

 

 

Config:

 

Easy-VPN-Server# sho run

: Saved

:

PIX Version 6.3(5)

interface ethernet0 100full

interface ethernet1 100full

nameif ethernet0 outside security0

nameif ethernet1 inside security100

hostname Easy-VPN-Server

access-list outside permit icmp any any

access-list inside permit ip any any

access-list 101 permit ip 192.168.174.0 255.255.255.0 10.20.10.0 255.255.255.0

pager lines 24

logging on

logging standby

logging buffered debugging

logging trap debugging

logging host inside 192.168.174.100

mtu outside 1500

mtu inside 1500

ip address outside x.x.x.x 255.255.255.224

ip address inside 192.168.174.241 255.255.255.0

ip audit info action alarm

ip audit attack action alarm

global (outside) 1 interface

nat (inside) 0 access-list 101

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

access-group outside in interface outside

access-group inside in interface inside

route outside 0.0.0.0 0.0.0.0 213.252.50.98 1

floodguard enable

sysopt connection permit-ipsec

crypto ipsec transform-set myset esp-3des esp-sha-hmac

crypto dynamic-map dynmap 10 set transform-set myset

crypto map mymap 10 ipsec-isakmp dynamic dynmap

crypto map mymap interface outside

isakmp enable outside

isakmp identity address

isakmp keepalive 30 10

isakmp nat-traversal 20

isakmp policy 10 authentication pre-share

isakmp policy 10 encryption des

isakmp policy 10 hash sha

isakmp policy 10 group 2

isakmp policy 10 lifetime 28800

vpngroup office split-tunnel 101

vpngroup office idle-time 1800

vpngroup office password **********

telnet timeout 5

 

 

Easy-VPN-Client# sho run

: Saved

:

PIX Version 6.3(4)

interface ethernet0 100baset

interface ethernet1 100full

nameif ethernet0 outside security0

nameif ethernet1 inside security100

hostname Easy-VPN-Client

fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69

names

pager lines 24

logging on

logging buffered debugging

logging history debugging

mtu outside 1500

mtu inside 1500

ip address outside pppoe setroute

ip address inside 10.20.10.250 255.255.255.0

ip audit info action alarm

ip audit attack action alarm

pdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

conduit permit icmp any any

conduit permit icmp any any echo

floodguard enable

telnet timeout 5

ssh timeout 5

console timeout 0

 

vpdn group tonline request dialout pppoe

vpdn group tonline localname *************@t-online-com.de

vpdn group tonline ppp authentication pap

vpdn username **************@t-online-com.de password *********

 

vpnclient server x.x.x.x

vpnclient mode network-extension-mode

vpnclient vpngroup office password ********

vpnclient enable

terminal width 80

 

Was fehlt da eigentlich noch?

 

 

Danke & Gruss

[thematrix 10]

Servus,

 

ich würde eine Access-list auf beiden mit beiden Richtungen anlegen.

 

Gruss,

 

thematrix

[MYOEY 10]

Danke für deine Antwort!

 

Gruß