Есть два офиса. В обоих стоят циски 1811. Полазив по инету смог организовать между ними туннель. но теперь ещё требуется чтобы в каждый офис можно было подключаться по vpn из других мест(филиалы и домашние компы) не посредственно с компов. Помогите, пожалуйста, решить проблему.
З.Ы. 1 циску подкручивал уже готовую. (Был настроен доступ для vpn клиентов, но после моих настроек пропал )
З.Ы.Ы. Честно искал похожую ситуацию на форуме и не нашёл(
З.Ы.Ы. Соответственно 46.х.х.х -местный провайдер, а 62.х.х.х провайдер второго офиса. ну пароли пользователей потёр
Код: Выделить всё
no aaa new-model
!
resource policy
!
clock timezone msk 3
clock summer-time msk-summer recurring last Sun Mar 2:00 last Sun Oct 3:00
!
!
ip cef
!
!
ip domain name eu***nt.ru
ip name-server 192.168.1.100
ip name-server 8.8.8.8
ip ssh authentication-retries 2
ip ssh version 2
vpdn enable
!
vpdn-group 1
! Default PPTP VPDN group
accept-dialin
protocol pptp
virtual-template 1
!
vpdn-group VPN
accept-dialin
protocol pptp
virtual-template 1
!
!
!
!
username rootevs privilege 15 secret
username nekrasov privilege 0 password
username crs privilege 0 password
username ssnvpn privilege 0 password
username Surova_S privilege 0 password
username ivanov_noutVPN privilege 0 password
username MOD_vpn privilege 0 password
username AverinAD privilege 0 password
username Yaroslavl privilege 0 password
username kpn1c privilege 0 password
username kmm privilege 0 password
username SdaVpN privilege 0 password
username atc_kts privilege 0 password
username altair privilege 0 password
!
!
crypto isakmp policy 100
encr aes
hash md5
authentication pre-share
group 2
crypto isakmp key cisco address 62.x.x.x
crypto isakmp key cisco address 62.x.x.x
!
!
crypto ipsec transform-set EVStrnSET esp-aes esp-md5-hmac
crypto ipsec transform-set PEERS esp-aes esp-md5-hmac
!
crypto ipsec profile EVSprf
set transform-set EVStrnSET
!
crypto ipsec profile PEERS
set transform-set PEERS
!
!
crypto map IPSEC 100 ipsec-isakmp
set peer 62.x.x.x
set peer 62.x.x.x
set security-association idle-time 600
set transform-set PEERS
set pfs group1
match address ACL_IPSEC
!
!
!
!
interface FastEthernet0
ip address 46.x.x.x 255.255.255.252
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
no snmp trap link-status
crypto map IPSEC
!
interface FastEthernet1
ip address 192.168.1.254 255.255.255.0
ip nat inside
ip virtual-reassembly
no ip route-cache cef
no ip route-cache
shutdown
duplex auto
speed auto
no snmp trap link-status
!
interface FastEthernet2
!
interface FastEthernet3
shutdown
!
interface FastEthernet4
shutdown
!
interface FastEthernet5
shutdown
!
interface FastEthernet6
shutdown
!
interface FastEthernet7
shutdown
!
interface FastEthernet8
shutdown
!
interface FastEthernet9
shutdown
!
interface Virtual-Template1
ip unnumbered FastEthernet0
peer default ip address pool vpdn
no keepalive
ppp encrypt mppe auto
ppp authentication ms-chap ms-chap-v2
!
interface Vlan1
description $ES_LAN$
ip address 192.168.1.254 255.255.255.0
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1452
!
interface Async1
no ip address
encapsulation slip
no ip route-cache
!
ip local pool vpdn 192.168.1.246 192.168.1.253
ip local pool vpn 192.168.1.200 192.168.1.244
ip route 0.0.0.0 0.0.0.0 46.x.x.x
ip route 192.168.2.0 255.255.255.0 62.x.x.x
ip route 192.168.2.0 255.255.255.0 62.x.x.x
!
ip dns server
!
ip http server
no ip http secure-server
ip nat inside source list 101 interface FastEthernet0 overload
!
ip access-list standard SNMP-HOSTS
!
ip access-list extended ACL_IPSEC
permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
permit ip host 46.x.x.x host 62.x.x.x
permit ip host 62.x.x.x host 46.x.x.x
deny ip any any
permit ip host 62.x.x.x host 46.x.x.x
permit ip host 46.x.x.x host 62.x.x.x
permit ip host 62.x.x.x host 16.x.x.x
permit ip host 62.x.x.x host 46.x.x.x
ip access-list extended INET_IN
permit tcp any host 46.x.x.x eq 1723
permit tcp any host 46.x.x.x eq 47
permit udp any host 46.x.x.x gt 1024
permit tcp any host 46.x.x.x established
permit icmp any host 46.x.x.x echo-reply
permit gre any host 46.x.x.x
permit udp any host 46.x.x.x eq ntp
!
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 100 permit udp host 8.8.8.8 eq domain any
access-list 100 permit tcp host 192.168.1.150 any eq pop3
access-list 100 permit udp host 46.x.x.x eq domain any
access-list 100 permit udp host 46.x.x.x eq domain any
access-list 101 deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 101 permit ip 192.168.1.0 0.0.0.255 any
access-list 102 permit ip 192.168.1.0 0.0.0.255 any
snmp-server community public RO SNMP-HOSTS
no cdp run
!
!
!
route-map RMAP_1 permit 1
match ip address 102
!
!
!
!
control-plane
!
!
line con 0
line 1
modem InOut
stopbits 1
speed 115200
flowcontrol hardware
line aux 0
line vty 0 1
password 7 00071A150754
login
transport input telnet ssh
line vty 2 4
exec-timeout 120 0
password 7 00071A150754
login
transport input ssh
line vty 5 9
exec-timeout 120 0
login local
transport input ssh
!
ntp clock-period 17175157
ntp source FastEthernet4
ntp peer 77.234.200.98
!
webvpn context Default_context
ssl authenticate verify all
!
no inservice
!
end
