Cisco PIX515E VPN server (PPTP)

[Gendalf]

Настроил с помощью визарда PPTP VPN

Код: Выделить всё

: Saved
: Written by enable_15 at 16:35:39.854 ALMST Thu Oct 8 2009
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname vpn
domain-name mydomain
clock timezone ALMST 6
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol pptp 1723
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list outside_inbound_nat0_acl permit ip interface outside 1.2.3.128 255.255.255.128 
access-list inside_outbound_nat0_acl permit ip any 1.2.3.128 255.255.255.128 
pager lines 80
logging on
logging timestamp
logging console debugging
mtu outside 1500
mtu inside 1500
ip address outside 1.2.0.253 255.255.255.240
ip address inside 192.168.100.79 255.255.255.224
ip audit info action alarm
ip audit attack action alarm
ip local pool vpn-pool 1.2.3.128-1.2.3.254
no failover
failover timeout 0:00:00
failover poll 15
no failover ip address outside
no failover ip address inside
pdm location 192.168.100.86 255.255.255.255 inside
pdm history enable
arp timeout 14400
nat (inside) 0 access-list inside_outbound_nat0_acl
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+ 
aaa-server TACACS+ max-failed-attempts 3 
aaa-server TACACS+ deadtime 10 
aaa-server RADIUS protocol radius 
aaa-server RADIUS max-failed-attempts 3 
aaa-server RADIUS deadtime 10 
aaa-server RADIUS (inside) host 192.168.100.86 secret timeout 10
aaa-server LOCAL protocol local 
aaa authentication ssh console LOCAL
aaa authentication http console LOCAL
http server enable
http 192.168.100.64 255.255.255.224 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-pptp
auth-prompt prompt prompt 
telnet timeout 5
ssh 192.168.100.64 255.255.255.224 inside
ssh timeout 15
console timeout 0
vpdn group PPTP-VPDN-GROUP accept dialin pptp
vpdn group PPTP-VPDN-GROUP ppp authentication pap
vpdn group PPTP-VPDN-GROUP ppp authentication chap
vpdn group PPTP-VPDN-GROUP ppp authentication mschap
vpdn group PPTP-VPDN-GROUP ppp encryption mppe 40
vpdn group PPTP-VPDN-GROUP client configuration address local vpn-pool
vpdn group PPTP-VPDN-GROUP client authentication aaa RADIUS
vpdn group PPTP-VPDN-GROUP client accounting RADIUS
vpdn group PPTP-VPDN-GROUP pptp echo 60
vpdn enable outside
vpdn enable inside
terminal width 80

В качестве Radius сервера использую Lanbilling радиус-агент. Все работает в принципе замечательно, но.
При подключении циска в лог сыплет такое:

Код: Выделить всё

Oct  9 16:35:05 192.168.100.79 %PIX-4-403102: PPP virtual interface 1 rcvd pkt with invalid protocol: 45, reason: unknown or unsupported protocol
Oct  9 16:35:05 192.168.100.79 %PIX-4-403102: PPP virtual interface 1 rcvd pkt with invalid protocol: 33, reason: unknown or unsupported protocol
Oct  9 16:35:05 192.168.100.79 %PIX-4-403102: PPP virtual interface 1 rcvd pkt with invalid protocol: 49, reason: unknown or unsupported protocol
Oct  9 16:35:05 192.168.100.79 %PIX-4-403102: PPP virtual interface 1 rcvd pkt with invalid protocol: e6, reason: unknown or unsupported protocol
Oct  9 16:35:05 192.168.100.79 %PIX-4-403102: PPP virtual interface 1 rcvd pkt with invalid protocol: 8c, reason: unknown or unsupported protocol
Oct  9 16:35:05 192.168.100.79 %PIX-4-403102: PPP virtual interface 1 rcvd pkt with invalid protocol: 49, reason: unknown or unsupported protocol

Кто-нибудь с таким сталкивался? Ногами сильно не пинать, в цисках не силен. Кстати, как я понял в новых версиях софта PIX PPTP как такового нет, есть ли у кого-нибудь конфиг для L2TP?

[Хостинг HostFood.ru]

Тарифы на хостинг в России, от 12 рублей: https://www.host-food.ru/tariffs/hosting/
Тарифы на виртуальные сервера (VPS/VDS/KVM) в РФ, от 189 руб.: https://www.host-food.ru/tariffs/virtualny-server-vps/
Выделенные сервера, Россия, Москва, от 2000 рублей (HP Proliant G5, Intel Xeon E5430 (2.66GHz, Quad-Core, 12Mb), 8Gb RAM, 2x300Gb SAS HDD, P400i, 512Mb, BBU):
https://www.host-food.ru/tariffs/vydelennyi-server-ds/
Недорогие домены в популярных зонах: https://www.host-food.ru/domains/

[LHC]

У меня есть, но для ASA v. 8.0 В качестве радиус-сервера числится IAS. Нужно?

[Gendalf]

У меня есть, но для ASA v. 8.0 В качестве радиус-сервера числится IAS. Нужно?

нужно и даже очень.

[LHC]

Код: Выделить всё

!!! ASA Version 8.0(4)
!
hostname client-asa
enable password xxxxxxxxxxxxxxxxxxxxxx encrypted
passwd xxxxxxxxxxxxxxxxxxxxxx encrypted
names
!
interface Vlan1
 	nameif inside
 	security-level  100
 	ip address 172.16.0.254 255.255.255.0
!
interface Vlan2
 	nameif outside
 	security-level 0
 	ip address x.x.x.x 255.255.255.252
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
clock timezone MSK 4
dns domain-lookup inside
dns domain-lookup outside
dns server-group DefaultDNS
 	name-server x.x.x.x
 	name-server x.x.x.y
dns server-group LOCALDomain
 	name-server 172.16.0.1
 domain-name domain.local
access-list nonat extended permit ip 172.16.0.0 255.255.255.0 172.17.0.0 255.255.255.0
access-list EXTNET extended permit tcp any any eq smtp
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
ip local pool defpool 172.17.0.10-172.17.0.40 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
icmp permit host x.x.x.x outside
asdm image disk0:/asdm-613.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list nonat
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) tcp interface smtp 172.16.0.1 smtp netmask 255.255.255.255
access-group EXTNET in interface outside
route outside 0.0.0.0 0.0.0.0 x.x.x.x 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
aaa-server  protocol radius
aaa-server def-vpn (inside) host 172.16.0.1
 	key XXXXXX
aaa authentication ssh console LOCAL
http 172.16.0.0 255.255.255.0 inside
snmp-server host outside x.x.x.x community MyCOMMUNITY
snmp-server location MSK
snmp-server contact admin@domain.ru
snmp-server community MyCOMMUNITY
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set regularset-sha esp-3des esp-sha-hmac
crypto ipsec transform-set regularset-sha mode transport
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map regulardyn 10 set transform-set regularset-sha
crypto dynamic-map regulardyn 10 set security-association lifetime seconds 28800
crypto dynamic-map regulardyn 10 set security-association lifetime kilobytes 4608000
crypto dynamic-map regulardyn 10 set reverse-route
crypto map standardmap  ipsec-isakmp dynamic regulardyn
crypto map standardmap interface outside
crypto isakmp enable outside
crypto isakmp policy 10
 	authentication pre-share
        encryption 3des
        hash sha
        group 2
        lifetime 43200
crypto isakmp nat-traversal 30
telnet timeout 5
ssh 172.16.0.0 255.255.255.0 inside
ssh x.x.x.x 255.255.255.255 outside
ssh timeout 5
ssh version 2
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ntp server 172.16.0.1 source inside prefer
group-policy DefaultRAGroup internal
group-policy DefaultRAGroup attributes
          dns-server value 172.16.0.1
          vpn-tunnel-protocol IPSec l2tp-ipsec
          ipsec-udp enable
          default-domain value domain.local
username asaroot password XXXXXXXXX encrypted privilege 15
username asaroot attributes
 	service-type admin
username c-rescue password XXXXXXXXXXXXXX nt-encrypted
username c-rescue attributes
 	vpn-simultaneous-logins 10
 	vpn-tunnel-protocol IPSec l2tp-ipsec
 	service-type remote-access
tunnel-group DefaultRAGroup general-attributes
         address-pool defpool
         authentication-server-group def-vpn
         default-group-policy DefaultRAGroup
tunnel-group DefaultRAGroup ipsec-attributes
 	 pre-shared-key *
tunnel-group DefaultRAGroup ppp-attributes
         no authentication chap
         no authentication ms-chap-v1
         authentication ms-chap-v2
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
 message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
 inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
prompt hostname context

Вот такой конфиг. Работает на ASA 7.2 и 8.0. Взят с боевого устройства. Пояснения тут минимальны. 172.16.0.0/24 - внутренняя подсеть, 172.16.0.1 - Win2K3-сервер, на котором крутится AD, Exchange, IAS (Radius-сервер). Cisco отдает адреса из своего пула, хотя можно сделать форвардинг на внутренний DHCP. На всякий пожарный создан локальный пользователь, который может подымать туннель, без RADIUS-аутентификации. Используется pre-shared key. Тип VPN - L2TP over IPSec, шифрование 3DES, хеш - SHA. Подключение проверено для ОС Win 2000 (с небольшими модификациями реестра)/XP/Vista.
P.S. Подойдет ли вам конфиг гарантировать не могу, но в принципе ASA есть логическое продолжение линейки PIX, так что изменения будут не очень большими.
P.P.S. Надо писать статью....