* Configuración Router rtvpn:

!
!
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname rtvpn
!
boot-start-marker
boot-end-marker
!
enable secret ——-
!
aaa new-model
!
!
aaa authentication login VTY_LOGIN local
aaa authentication login CONSOLE_LOGIN none
aaa authentication login AUX_LOGIN none
aaa authentication login VPN_USERS_DB local
aaa authentication enable default enable
aaa authorization network VPN_NET_PROFILE local
!
aaa session-id common
memory-size iomem 5
no ip source-route
no ip gratuitous-arps
no ip icmp rate-limit unreachable
ip cef
!
!
no ip bootp server
no ip domain lookup
ip domain name campoamor.net
login block-for 30 attempts 3 within 10
!
!
username jramos secret ———-
username user1vpn secret ———
!
!
ip tcp synwait-time 5
ip ssh version 2
!
!
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 2
!
crypto isakmp client configuration group LANCAMPOAMOR
key campoamor
pool POOL_LANCAMPOAMOR
netmask 255.255.255.0
crypto isakmp profile VPN_RAS
match identity group LANCAMPOAMOR
client authentication list VPN_USERS_DB
isakmp authorization list VPN_NET_PROFILE
client configuration address respond
keepalive 30 retry 2
!
!
crypto ipsec transform-set VPNCLIENTS_TS esp-aes 256 esp-sha-hmac
!
crypto dynamic-map VPNCLIENTS_INIT 10
set transform-set VPNCLIENTS_TS
match address TRAF_VPN
reverse-route
!
!
crypto map CMAP_VPN isakmp-profile VPN_RAS
crypto map CMAP_VPN 10 ipsec-isakmp dynamic VPNCLIENTS_INIT
!
!
interface FastEthernet0/0
description Red VPN Server
ip address 192.168.1.201 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
duplex auto
speed auto
no mop enabled
crypto map CMAP_VPN
!
interface FastEthernet0/1
description LAN Campoamor
ip address 192.168.2.1 255.255.255.0
ip access-group SALIDA_LANCAMPOAMOR in
no ip redirects
no ip unreachables
duplex auto
speed auto
!
interface FastEthernet1/0
no ip address
shutdown
duplex auto
speed auto
!
!
ip local pool POOL_LANCAMPOAMOR 192.168.9.16 192.168.9.31
ip route 0.0.0.0 0.0.0.0 192.168.1.1
!
!
no ip http server
no ip http secure-server
!
ip access-list extended SALIDA_LANCAMPOAMOR
permit ip 192.168.2.0 0.0.0.255 192.168.2.0 0.0.0.255
permit ip 192.168.2.0 0.0.0.255 192.168.9.16 0.0.0.15
deny ip 192.168.2.0 0.0.0.255 10.0.0.0 0.0.0.255
deny ip 192.168.2.0 0.0.0.255 192.168.0.0 0.0.255.255
deny ip 192.168.2.0 0.0.0.255 172.16.0.0 0.15.255.255
permit ip any any
ip access-list extended TRAF_VPN
permit ip 192.168.9.16 0.0.0.15 any
permit ip any 192.168.9.16 0.0.0.15
!
no cdp run
!
!
control-plane
!
!
banner login 
*****************************************************************
* RAGASYS, S.A. *
* Este es un sistema privado perteneciente a RAGASYS SISTEMAS *
* Prohibido el acceso no autorizado. *
*****************************************************************

!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
login authentication CONSOLE_LOGIN
line aux 0
exec-timeout 0 0
privilege level 15
logging synchronous
login authentication AUX_LOGIN
line vty 0 4
login authentication VTY_LOGIN
transport input ssh
line vty 5 807
login authentication VTY_LOGIN
transport input ssh
!
!
end

Saludos y espero que os sirva.

La entrada Configuración VPN de acceso remoto – Caso 2 se publicó primero en RAGASYS SISTEMAS.

* Configuración Router rtvpn:

version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname rtvpn
!
boot-start-marker
boot-end-marker
!
enable secret ——-
!
aaa new-model
!
!
aaa authentication login VTY_LOGIN local
aaa authentication login CONSOLE_LOGIN none
aaa authentication login AUX_LOGIN none
aaa authentication login VPN_USERS_DB local
aaa authentication enable default enable
aaa authorization network VPN_NET_PROFILE local
!
aaa session-id common
memory-size iomem 5
no ip source-route
no ip gratuitous-arps
no ip icmp rate-limit unreachable
ip cef
!
!
no ip bootp server
no ip domain lookup
ip domain name campoamor.net
login block-for 30 attempts 3 within 10
!
!
username ragasys secret ————
username user1vpn secret ———-
!
!
ip tcp synwait-time 5
ip ssh version 2
!
!
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 2
!
crypto isakmp client configuration group LANCAMPOAMOR
key campoamor
pool POOL_LANCAMPOAMOR
netmask 255.255.255.0
crypto isakmp profile VPN_RAS
match identity group LANCAMPOAMOR
client authentication list VPN_USERS_DB
isakmp authorization list VPN_NET_PROFILE
client configuration address respond
keepalive 30 retry 2
!
!
crypto ipsec transform-set VPNCLIENTS_TS esp-aes 256 esp-sha-hmac
!
crypto dynamic-map VPNCLIENTS_INIT 10
set transform-set VPNCLIENTS_TS
match address TRAF_VPN
reverse-route
!
!
crypto map CMAP_VPN isakmp-profile VPN_RAS
crypto map CMAP_VPN 10 ipsec-isakmp dynamic VPNCLIENTS_INIT
!
!
interface FastEthernet0/0
description Red VPN Server
ip address 192.168.1.201 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
duplex auto
speed auto
no mop enabled
crypto map CMAP_VPN
!
interface FastEthernet0/1
description LAN Campoamor
ip address 192.168.2.1 255.255.255.0
ip access-group SALIDA_LANCAMPOAMOR in
no ip redirects
no ip unreachables
duplex auto
speed auto
!
interface FastEthernet1/0
no ip address
shutdown
duplex auto
speed auto
!
!
ip local pool POOL_LANCAMPOAMOR 192.168.2.16 192.168.2.31
ip route 0.0.0.0 0.0.0.0 192.168.1.1
!
!
no ip http server
no ip http secure-server
!
ip access-list extended SALIDA_LANCAMPOAMOR
permit ip 192.168.2.0 0.0.0.255 192.168.2.0 0.0.0.255
deny ip 192.168.2.0 0.0.0.255 10.0.0.0 0.0.0.255
deny ip 192.168.2.0 0.0.0.255 192.168.0.0 0.0.255.255
deny ip 192.168.2.0 0.0.0.255 172.16.0.0 0.15.255.255
permit ip any any
ip access-list extended TRAF_VPN
permit ip 192.168.2.16 0.0.0.15 any
permit ip any 192.168.2.16 0.0.0.15
!
no cdp run
!
!
control-plane
!
!
banner login 
*****************************************************************
* RAGASYS, S.A. *
* Este es un sistema privado perteneciente a RAGASYS SISTEMAS *
* Prohibido el acceso no autorizado. *
*****************************************************************

!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
login authentication CONSOLE_LOGIN
line aux 0
exec-timeout 0 0
privilege level 15
logging synchronous
login authentication AUX_LOGIN
line vty 0 4
login authentication VTY_LOGIN
transport input ssh
line vty 5 807
login authentication VTY_LOGIN
transport input ssh
!
!
end

La entrada Configuración VPN de acceso remoto – Caso 1 se publicó primero en RAGASYS SISTEMAS.

* Configuración Router rtcala:
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname rtcala
!
boot-start-marker
boot-end-marker
!
enable secret ——
enable password ——-
!
no aaa new-model
memory-size iomem 5
no ip icmp rate-limit unreachable
ip cef
!
!
no ip domain lookup
ip domain name ragasys.net
!
!
username ragasys privilege 15 secret ——
!
!
ip tcp synwait-time 5
ip ssh version 2
!
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key cala4madrid address 212.45.12.2
!
!
crypto ipsec transform-set LINKTOMADRID esp-3des esp-sha-hmac
!
crypto map CALA 1 ipsec-isakmp
set peer 212.45.12.2
set transform-set LINKTOMADRID
set pfs group2
match address 120
!
!
interface FastEthernet0/0
description LAN Cala
ip address 192.168.1.1 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
interface Serial0/0
description WAN-INTERNET
ip address 212.45.12.1 255.255.255.0
ip nat outside
ip virtual-reassembly
clock rate 2000000
crypto map CALA
!
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
interface Serial0/1
no ip address
shutdown
clock rate 2000000
!
interface FastEthernet1/0
no ip address
shutdown
duplex auto
speed auto
!
!
ip route 0.0.0.0 0.0.0.0 Serial0/0
!
!
ip http server
ip http authentication local
no ip http secure-server
ip nat inside source route-map noNAT interface Serial0/0 overload
!
access-list 100 remark ACL para hacer PAT con la conexion a INTERNET y filtar VPN
access-list 100 deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 100 permit ip 192.168.1.0 0.0.0.255 any
access-list 120 remark ACL para permitir el trafico desde Cala a Madrid
access-list 120 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 120 deny ip any any
!
route-map noNAT permit 1
match ip address 100
!
!
control-plane
!
!
line con 0
exec-timeout 0 0
privilege level 15
password ——-
logging synchronous
login local
line aux 0
exec-timeout 0 0
privilege level 15
password ——–
logging synchronous
login local
line vty 0 4
password 7 ——-
login local
transport input telnet ssh
!
!
end

* Configuración Router rtmadrid:

version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname rtmadrid
!
boot-start-marker
boot-end-marker
!
enable secret ——–
enable password ———
!
no aaa new-model
memory-size iomem 5
no ip icmp rate-limit unreachable
ip cef
!
!
no ip domain lookup
ip domain name ragasys.net
!
!
username ragasys privilege 15 secret ——
!
!
ip tcp synwait-time 5
ip ssh version 2
!
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key cala4madrid address 212.45.12.1
!
!
crypto ipsec transform-set LINKTOCALA esp-3des esp-sha-hmac
!
crypto map MADRID 1 ipsec-isakmp
set peer 212.45.12.1
set transform-set LINKTOCALA
set pfs group2
match address 120
!
!
interface FastEthernet0/0
description LAN Madrid
ip address 192.168.2.1 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
interface Serial0/0
ip address 212.45.12.2 255.255.255.0
ip nat outside
ip virtual-reassembly
clock rate 2000000
crypto map MADRID
!
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
interface Serial0/1
no ip address
shutdown
clock rate 2000000
!
interface FastEthernet1/0
no ip address
shutdown
duplex auto
speed auto
!
!
ip route 0.0.0.0 0.0.0.0 Serial0/0
!
!
ip http server
ip http authentication local
no ip http secure-server
ip nat inside source route-map noNAT interface Serial0/0 overload
!
access-list 100 remark ACL para hacer PAT con la conexion a INTERNET y flitar VPN
access-list 100 deny ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 100 permit ip 192.168.2.0 0.0.0.255 any
access-list 120 remark ACL para permitir el trafico desde Madrid a Cala
access-list 120 permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 120 deny ip any any
!
route-map noNAT permit 1
match ip address 100
!
!
control-plane
!
!
line con 0
exec-timeout 0 0
privilege level 15
password ——-
logging synchronous
login local
line aux 0
exec-timeout 0 0
privilege level 15
password ——–
logging synchronous
login local
line vty 0 4
password ———
login local
transport input telnet ssh
!
!
end

La entrada Configuración VPN site to site con Routers Cisco se publicó primero en RAGASYS SISTEMAS.