Добрый день.Необходимо дать доступ к серверу (ssh) через ipsec соединение.
Сервер: 192.168.20.4/24.
маршрут на 192.168.1.1 настроен через 192.168.20.5
C2800:
Белый адрес(l2tp на провайдера) - 55.55.55.55
FE0/0 (в сторону сервера) - 192.168.20.5
Loopback 0 (используется как local ident) 192.168.1.1
ping 192.168.20.4 source 192.168.1.1 - успешен
На той стороне ipsec Freebsd:
Белый адрес: 77.77.77.77
Адреса клиентов в туннеле 192.168.200.0/24
----
Как настроить NAT при обращении к 192.168.1.1 из 192.168.200.0/24 попадать на 192.168.20.4
Пробую сделать так, безуспешно:
!
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname ipsec
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
clock timezone MSK 3
no ip source-route
ip cef
!
!
!
!
ip vrf pppvrf
description vrf for ppp
rd 1:1
!
no ip bootp server
ip name-server 8.8.8.8
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
l2tp-class default-l2tp-class
receive-window 512
!
l2tp-class provider
receive-window 512
!
!
!
voice-card 0
!
!
!
!
!
!
!
!
!
!
!
!
crypto pki token default removal timeout 0
!
!
archive
log config
hidekeys
!
!
ip tcp synwait-time 10
pseudowire-class pw-provider
encapsulation l2tpv2
protocol l2tpv2 provider
ip local interface FastEthernet0/1
!
pseudowire-class tp.provider.ru
! Incomplete config
!
!
!
crypto isakmp policy 110
encr 3des
authentication pre-share
group 2
lifetime 3600
crypto isakmp key password address 77.77.77.77
crypto isakmp invalid-spi-recovery
crypto isakmp keepalive 10 periodic
crypto isakmp aggressive-mode disable
!
!
crypto ipsec transform-set SET esp-3des esp-sha-hmac
!
crypto map AP 10 ipsec-isakmp
set peer 77.77.77.77
set transform-set SET
set pfs group2
match address 101
!
!
!
!
interface Loopback0
ip address 192.168.1.1 255.255.255.0
ip access-group dostup in
ip access-group dostup out
ip nat outside
ip virtual-reassembly
!
interface FastEthernet0/0
description server
ip address 192.168.20.5 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
no mop enabled
!
interface FastEthernet0/1
description ISP_provider
ip address dhcp
ip access-group dostup in
ip access-group dostup out
load-interval 30
duplex auto
speed auto
!
interface Virtual-PPP1
ip address negotiated
ip access-group dostup in
ip access-group dostup out
no ip proxy-arp
ip mtu 1400
ip nat outside
ip virtual-reassembly
no peer neighbor-route
no cdp enable
ppp encrypt mppe auto
ppp authentication chap callin
ppp chap hostname usernameprovider
ppp chap password 7 1446405858517C7C7C7122
pseudowire 99.99.99.2 10 pw-class pw-provider
crypto map AP
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Virtual-PPP1
ip route 8.8.8.8 255.255.255.255 Virtual-PPP1
ip route 10.0.0.0 255.0.0.0 FastEthernet0/1
ip route 99.99.99.2 255.255.255.255 10.97.48.1
!
!
no ip http server
no ip http secure-server
ip nat inside source static tcp 192.168.20.4 22 192.168.1.1 22 extendable
!
ip access-list extended dostup
deny udp any any eq snmp
deny tcp any any eq telnet
permit udp any any eq domain
permit udp any eq domain any
permit ip any any
permit udp host 77.77.77.77 host 55.55.55.55 eq isakmp
permit esp host 77.77.77.77 host 55.55.55.55
permit udp host 77.77.77.77 host 55.55.55.55 eq non500-isakmp
permit ahp host 77.77.77.77 host 55.55.55.55
!
access-list 101 permit ip 192.168.1.0 0.0.0.255 192.168.200.0 0.0.0.255
!
!
!
control-plane
!
!
!
!
!
!
!
!
!
line con 0
logging synchronous
line aux 0
line vty 0 4
login
transport input none
line vty 5 15
login
transport input none
!
scheduler allocate 20000 1000
end
ping 192.168.200.201 не проходит
ping 192.168.200.201 source 192.168.1.1 успешно
