форумы  помощь  поиск  регистрация  майллист  ВХОД  слежка

Вариант для распечатки		Архивированная нить - только для чтения!  Пред. тема | След. тема
Форумы Маршрутизаторы CISCO и др. оборудование. (Public)
Изначальное сообщение		[Проследить за развитием треда]

"Настройка почты через IPSec/VPN Tunnel (PIX 515)"
Сообщение от IAV (ok) on 10-Авг-04, 13:13  (MSK)
Добрый всем день! Помогите чайнику ... Стандартная задача - объединение 2-х офисов (192.168.1.х и 192.168.2.х) через Internet.На обоих концах стоят PIX 515. Поднят IPSec/VPN Tunnel Using Pre-Shared Key Without Nat. Никак не удается настроить посылку/прием почты из сети 192.168.2.x на почтовый сервер 192.168.1.5 (соответственно 192.168.1.x). Следующие строки есть на обоих пиксах: fixup protocol smtp 25 access-group 101 in interface outside access-list 101 permit tcp 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0 eq pop3 access-list 101 permit tcp 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0 eq smtp access-list outside_cryptomap_20 permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0 Заранее благодарен за все ответы.
	Рекомендовать в FAQ | Cообщить модератору | Наверх

Индекс форумов | Темы | Пред. тема | След. тема

Сообщения по теме

1. "Настройка почты через IPSec/VPN Tunnel (PIX 515)"
Сообщение от lomo on 10-Авг-04, 13:44  (MSK)
>Добрый всем день! Помогите чайнику ... > >Стандартная задача - объединение 2-х офисов (192.168.1.х и 192.168.2.х) через Internet.На обоих >концах стоят PIX 515. >Поднят IPSec/VPN Tunnel Using Pre-Shared Key Without Nat. >Никак не удается настроить посылку/прием почты из сети 192.168.2.x на почтовый сервер >192.168.1.5 (соответственно 192.168.1.x). > >Следующие строки есть на обоих пиксах: > >fixup protocol smtp 25 >access-group 101 in interface outside >access-list 101 permit tcp 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0 eq pop3 >access-list 101 permit tcp 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0 eq smtp >access-list outside_cryptomap_20 permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0 > >Заранее благодарен за все ответы. А при чем тут interface outside и VPN(ы)? А сети-то вообще удалось объединить? Конфиг покажите полностью.
	Рекомендовать в FAQ | Cообщить модератору | Наверх

	2. "Настройка почты через IPSec/VPN Tunnel (PIX 515)"
	Сообщение от IAV (ok) on 10-Авг-04, 15:17  (MSK)
	Сети удалось объединить (по крайней мере по порту 8401 все работает) Конфиг первого пикса: Building configuration... : Saved : PIX Version 6.3(1) interface ethernet0 auto interface ethernet1 100full interface ethernet2 100full nameif ethernet0 outside security0 nameif ethernet1 inside security100 nameif ethernet2 DMZ security50 enable password yF1Xrfjfjj2S encrypted passwd yF1Xrjjkkk5g2S encrypted hostname pix:office1 domain-name cisco.com fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol ils 389 fixup protocol pptp 1723 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 no names name 212.44.130.39 SOVINTEL_POST_1 name 195.68.135.65 SOVINTEL_POST_2 name 212.44.130.13 SOVINTEL_POST_3 name 192.168.1.5 GUB name 10.0.0.4 GUB_DMZ name 195.186.240.164 GUB_translation name 195.186.240.161 Router name 195.186.87.34 Out_PIX_2 name 192.168.2.0 GubNet_2 name 192.168.1.0 GubNet_1 object-group network SOVINTEL_POST   description SOVINTEL POST   network-object 212.44.130.39 255.255.255.255   network-object 195.68.135.65 255.255.255.255   network-object 212.44.130.13 255.255.255.255 access-list 101 permit icmp any any unreachable access-list 101 permit icmp any any echo-reply access-list 101 permit icmp any any time-exceeded access-list 101 permit icmp any any source-quench access-list 101 permit icmp any any traceroute access-list 101 permit tcp 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0 eq 8401 access-list 101 permit icmp 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0 access-list 101 permit tcp 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0 eq pop3 access-list 101 permit tcp 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0 eq smtp access-list 101 permit tcp 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0 eq telnet access-list inside_access_in permit udp 192.168.1.0 255.255.255.0 any eq domain access-list inside_access_in permit tcp 192.168.1.0 255.255.255.0 any eq domain access-list inside_access_in permit tcp 192.168.1.0 255.255.255.0 any eq www access-list inside_access_in permit tcp 192.168.1.0 255.255.255.0 any eq https access-list inside_access_in permit tcp 192.168.1.0 255.255.255.0 any eq ftp access-list inside_access_in permit tcp 192.168.1.0 255.255.255.0 any eq ftp-data access-list inside_access_in permit tcp 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0 eq pop3 access-list inside_access_in permit tcp 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0 eq smtp access-list inside_access_in permit icmp 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0 access-list inside_access_in permit tcp 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0 eq telnet access-list DMZ_access_in permit udp 10.0.0.0 255.255.255.0 any eq domain access-list DMZ_access_in permit tcp 10.0.0.0 255.255.255.0 any eq domain access-list DMZ_access_in permit tcp 10.0.0.0 255.255.255.0 any eq www access-list DMZ_access_in permit tcp 10.0.0.0 255.255.255.0 any eq https access-list DMZ_access_in permit tcp 10.0.0.0 255.255.255.0 any eq ftp access-list DMZ_access_in permit tcp 10.0.0.0 255.255.255.0 any eq ftp-data access-list DMZ_access_in permit tcp host 10.0.0.4 object-group SOVINTEL_POST eq pop3 access-list DMZ_access_in permit tcp host 10.0.0.4 object-group SOVINTEL_POST eq smtp access-list inside_outbound_nat0_acl permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0 access-list outside_cryptomap_20 permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0 pager lines 24 logging on logging timestamp logging trap debugging mtu outside 1500 mtu inside 1500 mtu DMZ 1500 ip address outside 195.186.240.162 255.255.255.248 ip address inside 192.168.1.103 255.255.255.0 ip address DMZ 10.0.0.3 255.255.255.0 ip audit info action alarm ip audit attack action alarm pdm location 195.186.240.161 255.255.255.255 outside pdm location 192.168.1.5 255.255.255.255 inside pdm location 212.44.130.39 255.255.255.255 outside pdm location 195.68.135.65 255.255.255.255 outside pdm location 212.44.130.13 255.255.255.255 outside pdm location 10.0.0.4 255.255.255.255 DMZ pdm location 195.186.240.164 255.255.255.255 outside pdm location 195.186.87.38 255.255.255.255 outside pdm location 195.186.87.34 255.255.255.255 outside pdm location 192.168.2.0 255.255.255.0 outside pdm group SOVINTEL_POST outside pdm logging warnings 100 pdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 0 access-list inside_outbound_nat0_acl nat (inside) 1 192.168.1.0 255.255.255.0 0 0 static (DMZ,outside) 195.186.240.164 10.0.0.4 netmask 255.255.255.255 0 0 static (inside,DMZ) 192.168.1.0 192.168.1.0 netmask 255.255.255.0 0 50 access-group 101 in interface outside access-group inside_access_in in interface inside access-group DMZ_access_in in interface DMZ route outside 0.0.0.0 0.0.0.0 195.186.240.161 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server RADIUS protocol radius aaa-server LOCAL protocol local http server enable http 192.168.1.105 255.255.255.255 inside no snmp-server location no snmp-server contact snmp-server community public no snmp-server enable traps floodguard enable sysopt connection permit-ipsec crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac crypto map outside_map 20 ipsec-isakmp crypto map outside_map 20 match address outside_cryptomap_20 crypto map outside_map 20 set peer 195.186.87.34 crypto map outside_map 20 set transform-set ESP-3DES-MD5 crypto map outside_map interface outside isakmp enable outside isakmp key ******** address 195.186.87.34 netmask 255.255.255.255 no-xauth no-config-mode isakmp policy 20 authentication pre-share isakmp policy 20 encryption 3des isakmp policy 20 hash md5 isakmp policy 20 group 2 isakmp policy 20 lifetime 86400 telnet 192.168.1.206 255.255.255.255 inside telnet 192.168.1.199 255.255.255.255 inside telnet 192.168.1.105 255.255.255.255 inside telnet timeout 5 ssh timeout 5 console timeout 0 dhcpd lease 3600 dhcpd ping_timeout 750 username admin password s03cFqpQOIelXB1Y encrypted privilege 15 terminal width 80 Cryptochecksum:a10c966d549776695ebd52f07f0 : end [OK] конфиг второго пикса: Building configuration... : Saved : PIX Version 6.3(1) interface ethernet0 auto interface ethernet1 100full interface ethernet2 100full nameif ethernet0 outside security0 nameif ethernet1 inside security100 nameif ethernet2 DMZ security50 enable password yF1hjlhkpDw5g2S encrypted passwd 2KFhgjhdI.2KhU encrypted hostname pix:office2 domain-name cisco.com fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol ils 389 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 names name 192.168.2.0 GubNet_2 name 192.168.1.0 GubNet_1 name 192.168.2.106 TEST name 192.168.1.5 POSTSERVER object-group network TERMINAL   description REMOTE TERMINAL GROUP network-object TEST 255.255.255.255 access-list inside_access_in permit udp GubNet_2 255.255.255.0 any eq domain access-list inside_access_in permit tcp GubNet_2 255.255.255.0 any eq domain access-list inside_access_in permit tcp GubNet_2 255.255.255.0 any eq www access-list inside_access_in permit tcp GubNet_2 255.255.255.0 any eq ftp access-list inside_access_in permit tcp GubNet_2 255.255.255.0 any eq ftp-data access-list inside_access_in permit tcp GubNet_2 255.255.255.0 GubNet_1 255.255.255.0 eq 8401 access-list inside_access_in permit tcp GubNet_2 255.255.255.0 GubNet_1 255.255.255.0 eq pop3 access-list inside_access_in permit tcp GubNet_2 255.255.255.0 GubNet_1 255.255.255.0 eq smtp access-list outside_access_in permit icmp GubNet_1 255.255.255.0 GubNet_2 255.255.255.0 unreachable access-list outside_access_in permit icmp GubNet_1 255.255.255.0 GubNet_2 255.255.255.0 echo-reply access-list outside_access_in permit icmp GubNet_1 255.255.255.0 GubNet_2 255.255.255.0 time-exceeded access-list outside_access_in permit icmp GubNet_1 255.255.255.0 GubNet_2 255.255.255.0 source-quench access-list outside_access_in permit icmp GubNet_1 255.255.255.0 GubNet_2 255.255.255.0 traceroute access-list outside_access_in permit tcp GubNet_1 255.255.255.0 GubNet_2 255.255.255.0 eq ftp access-list outside_access_in permit tcp GubNet_1 255.255.255.0 GubNet_2 255.255.255.0 eq ftp-data access-list outside_access_in permit tcp GubNet_1 255.255.255.0 GubNet_2 255.255.255.0 eq pop3 access-list outside_access_in permit tcp GubNet_1 255.255.255.0 GubNet_2 255.255.255.0 eq smtp access-list outside_access_in permit icmp any any unreachable access-list outside_access_in permit icmp any any echo-reply access-list outside_access_in permit icmp any any time-exceeded access-list outside_access_in permit icmp any any source-quench access-list outside_access_in permit icmp any any traceroute access-list inside_outbound_nat0_acl permit ip GubNet_2 255.255.255.0 GubNet_1 255.255.255.0 access-list outside_cryptomap_20 permit ip GubNet_2 255.255.255.0 GubNet_1 255.255.255.0 pager lines 24 logging on logging trap warnings mtu outside 1500 mtu inside 1500 mtu DMZ 1500 ip address outside 195.186.87.34 255.255.255.248 ip address inside 192.168.2.103 255.255.255.0 ip address DMZ 10.0.2.3 255.255.255.0 ip audit info action alarm ip audit attack action alarm pdm location GubNet_2 255.255.255.0 inside pdm location GubNet_1 255.255.255.0 outside pdm location TEST 255.255.255.255 inside pdm location APPSRV 255.255.255.255 inside pdm location POSTSERVER 255.255.255.255 outside pdm group TERMINAL inside pdm logging warnings 100 pdm history enable arp timeout 14400 global (outside) 1 interface global (outside) 2 195.186.87.38 nat (inside) 0 access-list inside_outbound_nat0_acl nat (inside) 1 GubNet_2 255.255.255.0 0 0 static (inside,DMZ) GubNet_2 GubNet_2 netmask 255.255.255.0 0 0 access-group outside_access_in in interface outside access-group inside_access_in in interface inside access-group DMZ_access_in in interface DMZ route outside 0.0.0.0 0.0.0.0 195.186.87.33 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server RADIUS protocol radius aaa-server LOCAL protocol local http server enable http TEST 255.255.255.255 inside http IT 255.255.255.255 inside no snmp-server location no snmp-server contact snmp-server community public no snmp-server enable traps floodguard enable sysopt connection permit-ipsec crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac crypto map outside_map 20 ipsec-isakmp crypto map outside_map 20 match address outside_cryptomap_20 crypto map outside_map 20 set peer 195.186.240.162 crypto map outside_map 20 set transform-set ESP-3DES-MD5 crypto map outside_map interface outside isakmp enable outside isakmp key ******** address 195.186.240.162 netmask 255.255.255.255 no-xauth no-config-mode isakmp policy 20 authentication pre-share isakmp policy 20 encryption 3des isakmp policy 20 hash md5 isakmp policy 20 group 2 isakmp policy 20 lifetime 86400 telnet SWIFT 255.255.255.255 inside telnet timeout 5 ssh timeout 5 console timeout 0 username admin password s03cFqpQOIelXB1Y encrypted privilege 15 terminal width 80 Cryptochecksum:4b2ec76a90da16107765f9eebed : end [OK]
		Рекомендовать в FAQ | Cообщить модератору | Наверх

	3. "Настройка почты через IPSec/VPN Tunnel (PIX 515)"
	Сообщение от lomo on 10-Авг-04, 17:46  (MSK)
	>Сети удалось объединить (по крайней мере по порту 8401 все работает) Если Вы применяете "sysopt connection permit-ipsec", то для полного доступа между сетеми ничего кроме Ваших "access-list outside_cryptomap_20" и "access-list inside_outbound_nat0_acl" А в "access-list outside_access_in" вообще не должно пакетов попадать.. Сделайте "sh access-list outside_access_in" и убедитесь сами.. Начните с подчистки лишних строчек - они сильно затрудняют понимание.. Настройте логи на syslog какой-нить машины. Включите debug(и).. Когда Вы делаете из второй сети "telnet 192.168.1.5 25" что-нить попадает в "access-list inside_access_in" на втором PIX(е)?
		Рекомендовать в FAQ | Cообщить модератору | Наверх

Удалить

Индекс форумов | Темы | Пред. тема | След. тема

Пожалуйста, прежде чем написать сообщение, ознакомьтесь с данными рекомендациями.