مساعدة بخصوص VPn SITE TO SITE

[last_time_00]

السلام عليكم


انا شغال بشركة ركبت برنامج خاص بارسال رسائل الى المستخدمين
SMS


عالراوتر فيه REAL IP


بس للأسف Tunnel دائما DOWN
لما عم اعمل TEST على برنامج
cisco configuration professional عم يعطيني


checking peer connectivity failed


هي الاعدادات يلي عملتها عالراوتر و يلي بيقدر يساعدني .. بكون مشكور
هل فيه اي خطأ ؟؟


مع العلم انو هي القصة بتحتاج الى 2
REAL IP
واحد بكون عالراوتر و التاني بس بتعملو اكسيس ليست حسب كلام الشركة


crypto isakmp policy 100
encr 3des
hash md5
authentication pre-share
group 2


crypto isakmp key (KEY) address XXX.118.128.XXX -----(PEER ISP)


crypto map VPN-SMS 999 ipsec-isakmp
set peer XXX.118.128.XXX
set transform-set VPN-FOR-SMS
match address vpn-acc-sms


ip nat inside source static (IP SERVER SMS) XX.XX.XX.XX ------REAL IP 2
ip route 0.0.0.0 0.0.0.0 XX.XX.XX.XX ----- MY Getway


ip access-list extended vpn-acc-sms
permit ip host -- REAL IP 2-- host 212.118.129.59 ---- host in ISP
permit ip host -- REAL IP 2-- host 212.118.129.200 ----


interface GigabitEthernet0/1
ip address -- REAL IP 1-- 255.255.255.248
crypto map VPN-SMS

[neelk]

اخ الكريم ممكن توصح الكفجريشن كامل مع تغير ip add and password عن طريف copy paste اكون افضل

[last_time_00]

!
!
!
version 15.0
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime
service timestamps log datetime msec localtime
service password-encryption
!
hostname
!
boot-start-marker
boot-end-marker
!
logging buffered 4096
enable password 7
!
no aaa new-model
!
!
!
clock timezone
!
!
crypto pki trustpoint TP-self-signed-4256698250
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-4256698250
revocation-check none
rsakeypair TP-self-signed-4256698250
!
!


no ipv6 cef
no ip source-route
ip cef
!
!
!
!
no ip bootp server
ip domain name lab.local
!
multilink bundle-name authenticated
!
!
license udi pid C3900-SPE150/K9 sn FOC14400CCR
!
!
username user privilege 15 secret
!
redundancy
!
!
!
!
crypto isakmp policy 2
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key ZZZZZZ address XX.XX.XX.XX (PEER IP)
!
!
crypto ipsec transform-set vpn-for-sms esp-3des esp-md5-hmac
!
!
crypto map vpn-sms 10 ipsec-isakmp
set peer XX.XX.XX.XX (PEER IP)
set transform-set vpn-for-sms
match address vpn-acc-sms
!
!
!
!
!
interface GigabitEthernet0/0
description $ETH-LAN$$ETH-SW-LAUNCH$$INTF-INFO-GE 0/0$
no ip address
duplex auto
speed auto
!
!
interface GigabitEthernet0/0.SSS
description Ethernet0/0.SSS dot1q vlan id=SSS. By VPNSC: Job Id# =
encapsulation dot1Q SSS
ip address AA.AA.AA.AA 255.255.255.252
!
interface GigabitEthernet0/1
ip address XXX.XXX.XXX.XXX 255.255.255.248 (REAL IP 1)
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
crypto map vpn-sms
!
!
interface GigabitEthernet0/2
ip address 192.168.10.2 255.255.255.252
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
!
interface ATM0/0/0
no ip address
shutdown
no atm ilmi-keepalive
!
!
router bgp 64803
no synchronization
bgp log-neighbor-changes
network 10.33.20.0 mask 255.255.255.0
network 10.33.21.0 mask 255.255.255.0
network 172.16.0.0
network 172.16.0.0 mask 255.255.255.0
network 192.168.10.0 mask 255.255.255.252
network 192.168.100.0
neighbor AA.AA.AA.AA remote-as 65000
no auto-summary
!
ip forward-protocol nd
!
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip nat inside source static 192.168.100.2 interface GigabitEthernet0/1


ip nat inside source static XX.XX.XX.XX(SERVER-IP) XX.XX.XX.XX (REAL-IP-2)


ip route 0.0.0.0 0.0.0.0 XX.XX.XX.XX (GETWAY)


ip route 10.33.18.0 255.255.255.0 192.168.10.1
ip route 10.33.19.0 255.255.255.0 192.168.10.1
ip route 10.33.20.0 255.255.255.0 192.168.10.1
ip route 10.33.21.0 255.255.255.0 192.168.10.1
ip route 172.16.0.0 255.255.255.0 192.168.10.1
ip route 192.168.100.0 255.255.255.0 192.168.10.1
!
ip access-list extended vpn-acc-sms
permit ip host XX.XX.XX.XX(REAL-IP-2) host 212.118.129.59
permit ip host XX.XX.XX.XX(REAL-IP-2) host 212.118.129.200
!
access-list 23 permit 10.10.10.0 0.0.0.7
!
!
!
!
!
snmp-server community public RO
snmp-server host public
!
control-plane
!
!
banner exec ^CC


Router Name:


Location:




^C
banner login ^CCcc






^C
!
line con 0

login
line aux 0
line vty 0 4
privilege level 15

login
transport input
line vty 5 15

privilege level 15
login local
transport input
!
scheduler allocate 20000 1000
end

[last_time_00]

ما حدا ركب ولا مرة على راوتر خدمة SMS

[neelk]

اخى الكنفجريشن من المفترض اكون لروترين من توضيح التبولجى اذا حابب مساعدة حقيقية وليس تخمين
مع عمل الاتى
debug crypto isa sa
debug crypto ipsec sa
ping to other site
and copy paste the result

[last_time_00]

حبيبي كأنك عم تحكي كلام ما منطقي بالمرة .. شلون بدي قول لمخدم الانترنيت تبعي .. عطيني الكونفيجريشيـــــــن تبع الراوتر تبعك
برأيك انت بيعطيني

انا و سبق و حكيت tunnel down ......
يعني كل شي 00000000000000000000000000000