OpenForum RSS: cisco 1841: �� gre+ipsec ��

cisco 1841: �� gre+ipsec �� (demchenko)

Tue, 06 Jul 2010 12:53:05 GMT

>[�� ]
>
>esli nuzhno mogu brosit' moi configi... xotja eto to zhe samoe chto
>u vas:) tol'ko u mejna na pitere netu poslednei route-map ...
>NULL0 tak kak u menja router rugajetsa na eto.
>
>
>posle izmenenija chego to svjazannoe s crypto vsegda xorosho udolit' "sa" na
>oboix peer: "clear crypto isakmp" i "clear crypto sa".
>
>nadejus kak to pomog.

�� :)
�� - �� , �� . �� - �� .

cisco 1841: �� gre+ipsec �� (karen durinyan)

Sun, 04 Jul 2010 05:58:43 GMT

>[�� ]
>>net switch ne dolzhen meshat' esli u vas L2 switch a ne
>>L3 s ACL i route interfaicami.
>
>��, �� l2 switch
>>v ISP ljudi sereznie :) no vse taki mozhno sprosit' u nix
>>na schet filtraci...
>
>��. ��
>�� ; �� ipsec+gre �� , ��
>�� - �� esp.

privet,

ja semuliroval vash network u menja.
vse taki "ip route 212.45.2.67 255.255.255.255 213.182.181.65" na pitere pomog reshit' problemu dlja menja!

ptr#ping 192.168.3.2 so 192.168.3.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.3.2, timeout is 2 seconds:
Packet sent with a source address of 192.168.3.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/16/20 ms
ptr#

msk#ping 192.168.3.1 so 192.168.3.2

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.3.1, timeout is 2 seconds:
Packet sent with a source addr

cisco 1841: �� gre+ipsec �� (demchenko)

Fri, 02 Jul 2010 11:27:14 GMT

>[�� ]
>>
>>�� - �� cache flow ��
>>32, �.�. esp �� :/
>>�� , ��
>>��. �� ?
>>� �� -�� , ��
>>� ��, � �� ?
>
>nadejus ne zabili vkljuchit ip route in|en pered tem kak smotret' v
>route cache.

�� - �� , �� 32 - �� .
>net switch ne dolzhen meshat' esli u vas L2 switch a ne
>L3 s ACL i route interfaicami.

��, �� l2 switch
>v ISP ljudi sereznie :) no vse taki mozhno sprosit' u nix
>na schet filtraci...

��. ��
�� ; �� ipsec+gre �� , �� - �� esp.

cisco 1841: �� gre+ipsec �� (karen durinyan)

Fri, 02 Jul 2010 10:20:51 GMT

>[�� ]
>>esli u vas tol'ko odna strochka to traffic idet v tunnel tol'ko
>>v odnu storonu chto mozhet bit' v sluchae firewalla blakirujushe esp
>>v oboix ili v odnu storonu ili iz za routinga.
>
>�� - �� cache flow ��
>32, �.�. esp �� :/
>�� , ��
>��. �� ?
>� �� -�� , ��
>� ��, � �� ?

nadejus ne zabili vkljuchit ip route in|en pered tem kak smotret' v route cache.
net switch ne dolzhen meshat' esli u vas L2 switch a ne L3 s ACL i route interfaicami.
v ISP ljudi sereznie :) no vse taki mozhno sprosit' u nix na schet filtraci...

cisco 1841: �� gre+ipsec �� (demchenko)

Fri, 02 Jul 2010 07:52:38 GMT

32" (32 eto esp). esli vse v norme to vi dolzhni
>[�� ]
> 32 F185 1E32 14
> Fa-y peer2-ip
> Fa-x peer1-ip
> 32 1E32 F185 14
>
>na oboix routerax chto oznachaet traffik idet v tunnel s oboix storon.
>
>esli u vas tol'ko odna strochka to traffic idet v tunnel tol'ko
>v odnu storonu chto mozhet bit' v sluchae firewalla blakirujushe esp
>v oboix ili v odnu storonu ili iz za routinga.

�� - �� cache flow �� 32, �.�. esp �� :/
�� , �� . �� ?
� �� -�� , �� , � �� ?

cisco 1841: �� gre+ipsec �� (karen durinyan)

Thu, 01 Jul 2010 07:07:38 GMT

>!
>route-map C-OUT permit 3
> match ip address 100
> set ip next-hop 192.168.3.1
>!
>ip access-list ext 100
> permit ip any 192.168.2.0 0.0.0.255

mozhet i oshibajus', no
1. tam zhe est' ip route 192.168.2.0 255.255.255.0 Tunnel1
2. esli problema v route map to pochemu vse rabotajet v sluchae GRE
3. route map C-OUT stoit pod vnutreenem interface a problema v tom chto posle activaci ipseca ping ne vozmozhen mezhdu tunnel interfeisamki a ne mezhdu LAN.

cisco 1841: �� gre+ipsec �� (karen durinyan)

Thu, 01 Jul 2010 06:48:04 GMT

>[�� ]
>Tracing the route to 212.45.2.67
>
> 1 213.182.181.65 4 msec 4 msec 0 msec
>==cut==
>[/code]
>
>�� : ��
>�� -�� .
>�� - �� (� �� ip ��-��)
>�� (isa) � �� .

mozhno posmatret' v route cache i proverit' est' li tam prot 32 mezhdu peerami v oboix napravlenijax. kanechno eto nado delat posle dobovlenija "ip flow in" i "ip flow eg" pod vneshnix interface-ax i posle pinga tunnel-ip s pomoshju "show ip cache flow | in 32" (32 eto esp). esli vse v norme to vi dolzhni uvidet' chto to poxozhe:

Fa-x peer1-ip Fa-y peer2-ip 32 F185 1E32 14
Fa-y peer2-ip Fa-x peer1-ip 32 1E32 F185 14

na oboix routerax chto oznachaet traffik idet v tunnel s oboix storon.
esli u vas tol'ko odna strochka to traffic idet v tunnel tol'ko v odnu storonu chto m

cisco 1841: �� gre+ipsec �� (BOJIKA)

Wed, 30 Jun 2010 12:50:02 GMT

!
route-map C-OUT permit 3
match ip address 100
set ip next-hop 192.168.3.1
!
ip access-list ext 100
permit ip any 192.168.2.0 0.0.0.255

cisco 1841: �� gre+ipsec �� (demchenko)

Wed, 30 Jun 2010 12:36:46 GMT

>
>>dobavte "ip route 212.45.2.67 255.255.255.255 213.182.181.65" route-map zdes ne pomozhet.
>>problema mozhet bit v etom v zavisimosti chto iz sebja predstovljaet gw
>>(RPF - revers path filtring).
>
>izvinjajus. ne uvidel "ip local policy route-map M-OUT" strochku

��, � �� :
[code]
pgate#traceroute 212.45.2.67 so 213.182.181.66 numeric

Type escape sequence to abort.
Tracing the route to 212.45.2.67

1 213.182.181.65 4 msec 4 msec 0 msec
==cut==
[/code]

�� : �� -�� .
�� - �� (� �� ip ��-��) �� (isa) � �� .

OpenForum RSS: cisco 1841: �� ���� ��������� gre+ipsec �������

cisco 1841: �� ���� ��������� gre+ipsec ������� (demchenko)

cisco 1841: �� ���� ��������� gre+ipsec ������� (karen durinyan)

cisco 1841: �� ���� ��������� gre+ipsec ������� (demchenko)

cisco 1841: �� ���� ��������� gre+ipsec ������� (karen durinyan)

cisco 1841: �� ���� ��������� gre+ipsec ������� (demchenko)

cisco 1841: �� ���� ��������� gre+ipsec ������� (karen durinyan)

cisco 1841: �� ���� ��������� gre+ipsec ������� (karen durinyan)

cisco 1841: �� ���� ��������� gre+ipsec ������� (BOJIKA)

cisco 1841: �� ���� ��������� gre+ipsec ������� (demchenko)

OpenForum RSS: cisco 1841: �� gre+ipsec ��

cisco 1841: �� gre+ipsec �� (demchenko)

cisco 1841: �� gre+ipsec �� (karen durinyan)

cisco 1841: �� gre+ipsec �� (demchenko)

cisco 1841: �� gre+ipsec �� (karen durinyan)

cisco 1841: �� gre+ipsec �� (demchenko)

cisco 1841: �� gre+ipsec �� (karen durinyan)

cisco 1841: �� gre+ipsec �� (karen durinyan)

cisco 1841: �� gre+ipsec �� (BOJIKA)

cisco 1841: �� gre+ipsec �� (demchenko)