Cisco 887VA Konfiguration für SIPGATE-Trunking

Vielen Dank für die schnelle Antwort.

Ich beziehe bei meinem Provider eine öffentliche IP laut show ip int brief

Ich werde mich heute Abend nach der Arbeit gleich mal ran machen und das genannte korrigieren. Soblad das getan ist werde ich einen SIP-DEBUG starten und diesen hier posten.

Gibt es bei dem DEBUG irgendwas zu beachten? Oder einen speziellen Start-Befehl?

Sooo.. ich habe nun den Cisco887vaw so eingestellt wie in der o.g. Anleitung.

Es funktioniert soweit auch alles (PPPoE Session über port Faeth3 mit VLAN 10 und dialer 0 zu m-net aufgebaut) ping geht vom Cisco aus zu google/heise raus und auch dns Auflösung klappt.

Vielen Dank schonmal bis hier!

Allerdings kann ich mit den Geräten im lan nicht raus pingen ins WAN oder dns auflösen?
Was habe ich da falsch gemacht?

Entschuldige bitte das ich etwas vom SIP-Thema abkomme aber ich denke mal das der Cisco erstmal so sauber laufen sollte und ich erst dann die sip-ua usw. parameter hinzufüge?

Daher benötige ich also bitte nochmals deinen Rat!

p.s. : der Dialer 2 ist für eine evt. VDSL Anbindung gedacht

Hier die sh run: (Hoffe diesmal ist sie schon etwas besser als die 1.)
Sollte noch mehr benötigt werden debugs etc. bitte kurz schreiben welche, dann lade ich die sofort hoch!


version 15.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Cisco887vaw
!
boot-start-marker
boot-end-marker
!
!
security authentication failure rate 3 log
security passwords min-length 6
no logging buffered
enable secret 5 $1$p/nc$8aTroUxaO4ukJ63Co1/qu1
!
no aaa new-model
memory-size iomem 10
clock timezone CET 1 0
clock summer-time CEST recurring last Sun Mar 2:00 last Sun Oct 3:00
service-module wlan-ap 0 bootimage autonomous
!
!
no ip source-route
no ip gratuitous-arps
!
!
!
!
!
ip dhcp binding cleanup interval 600
ip dhcp excluded-address 192.168.66.1 192.168.66.239
ip dhcp excluded-address 192.168.66.254
!
ip dhcp pool local
import all
network 192.168.66.0 255.255.255.0
default-router 192.168.66.1
dns-server 192.168.66.1
domain-name media-kontor.local
!
!
!
ip domain name media-kontor.local
ip name-server 185.40.174.19
ip inspect name myfw tcp
ip inspect name myfw udp
ip inspect name myfw sip
ip inspect name myfw rtsp
ip cef
no ipv6 cef
!
!
!
!
!
multilink bundle-name authenticated
!
password encryption aes
!
!
!
!
!
!
license udi pid CISCO887VGW-GNE-K9 sn FCZ1608C0FW
!
!
username admin privilege 15 secret 5 $1$svVc$TmyGi9WbMwx29FXsk1Zu81
!
!
!
!
!
controller VDSL 0
!
controller Cellular 0
!
!
!
!
!
!
!
!
!
!
!
!
interface Ethernet0
description $ETH-WAN$
no ip address
no ip route-cache
pppoe enable group global
pppoe-client dial-pool-number 2
!
interface FastEthernet0
no ip address
!
interface FastEthernet1
no ip address
!
interface FastEthernet2
no ip address
!
interface FastEthernet3
switchport access vlan 10
no ip address
!
interface wlan-ap0
no ip address
arp timeout 0
!
interface Wlan-GigabitEthernet0
no ip address
!
interface Cellular0
no ip address
encapsulation ppp
!
interface Vlan1
description local LAN
ip address 192.168.66.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
ip tcp adjust-mss 1412
!
interface Vlan10
no ip address
ip nat outside
ip virtual-reassembly in
pppoe enable group global
pppoe-client dial-pool-number 1
!
interface Dialer0
ip address negotiated
no ip redirects
ip mtu 1452
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication chap pap callin
ppp chap hostname XXXXXXXXXXXXX
ppp chap password 0 XXXXXXXXXXXX
ppp pap sent-username XXXXXXXXXXX password 0 XXXXX
!
interface Dialer2
ip address negotiated
ip mtu 1452
encapsulation ppp
dialer pool 2
dialer-group 2
ppp authentication chap pap callin
ppp chap hostname XXXXXXXXX
ppp chap password 0 XXXXXXXXX
ppp pap sent-username XXXXXXXX0 password 0 XXXXX
!
no ip forward-protocol nd
ip http server
ip http authentication local
no ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
!
ip dns server
no ip nat service sip udp port 5060
ip nat inside source list 101 interface Dialer0 overload
ip route 0.0.0.0 0.0.0.0 Dialer0 permanent
ip ssh version 2
!
dialer-list 1 protocol ip list 101
dialer-list 2 protocol ip permit
!
access-list 23 permit 192.168.66.0 0.0.0.255
access-list 100 permit udp any eq 5060 any
access-list 101 permit ip 192.168.66.0 0.0.0.255 any
access-list 101 permit ip host 192.168.66.0 any
access-list 101 permit ip 0.0.0.0 255.255.255.0 any
access-list 111 permit icmp any any administratively-prohibited
access-list 111 permit icmp any any echo-reply
access-list 111 permit icmp any any packet-too-big
access-list 111 permit icmp any any time-exceeded
access-list 111 permit icmp any any unreachable
access-list 111 permit udp any eq domain any
access-list 111 permit tcp any eq domain any
access-list 111 permit udp any eq ntp any
access-list 111 permit gre any any
access-list 111 deny ip any any log
!
control-plane
!
!
mgcp behavior rsip-range tgcp-only
mgcp behavior comedia-role none
mgcp behavior comedia-check-media-src disable
mgcp behavior comedia-sdp-force disable
!
mgcp profile default
!
!
!
!
!
!
line con 0
no modem enable
line aux 0
line 2
no activation-character
no exec
transport preferred none
transport input all
line 3
no exec
line vty 0 4
access-class 23 in
privilege level 15
login local
transport input telnet ssh
!
ntp server 185.40.174.21
!
end

Soo also der Cisco läuft jetzt sehr gut mit der PPPoE-Einwahl und ich denke auch etwas sicherer als mit meinen ersten Versuchen!

Vielen Dank schon mal bis hier für deine Nerven und Geduld!

Nun bräuchte ich noch eine SSH-Zugang über das WAN-interface (Dialer0 wenn ich das richtig verstanden habe?!), da ich dann nicht mehr ständig im Büro sein müsste um an ihm zu arbeiten.

Die SIP-Traces folgen morgen im laufe des Abends denke ich!

Nein alles ist nicht gelöst.

Also das Ping problem waren die Einträge im Dialer 0 "ip access-group 111 in" und " ip inspect myfw out".

Diese gesetzt und schon ging der Ping raus! (Hab mir auch gleich ne neue Brille bestellt!)

Dann habe ich jetzt wie gesagt noch das Zugangsproblem und mein SIP-Problem.

So also ich habe nun die o.g. Sachen eingefügt, habe aber immer noch keinen WAN-SSH Zugriff auf den Cisco?!

Und wegen dem Gelöst . . . das war einfach nur DUMMHEIT meinerseits sorry!

das steht im log wenn ich den Zugriff versuche:

Jan 29 17:05:14.091: %SEC-6-IPACCESSLOGP: list 111 denied tcp 109.73.18.50(61910) -> 109.73.18.248(22), 1 packet
Jan 29 17:05:23.084: %SEC-6-IPACCESSLOGP: list 111 denied tcp 109.73.18.50(55641) -> 109.73.18.248(22), 1 packet
Jan 29 17:05:25.628: %SEC-6-IPACCESSLOGDP: list 111 denied icmp 185.94.111.1 -> 109.73.18.248 (8/0), 1 packet
Jan 29 17:05:52.432: %SEC-6-IPACCESSLOGP: list 111 denied udp 185.130.5.224(48971) -> 109.73.18.248(53413), 1 packet

Hier nochmals zur Sicherheit meine komplette running:

version 15.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname Cisco887vaw
!
boot-start-marker
boot-end-marker
!
!
security authentication failure rate 3 log
security passwords min-length 6
no logging buffered
enable secret 5 $1$p/nc$8aTroUxaO4ukJ63Co1/qu1
!
no aaa new-model
memory-size iomem 10
clock timezone CET 1 0
clock summer-time CEST recurring last Sun Mar 2:00 last Sun Oct 3:00
service-module wlan-ap 0 bootimage autonomous
!
!
no ip source-route
no ip gratuitous-arps
!
!
!
!
!
ip dhcp binding cleanup interval 600
ip dhcp excluded-address 192.168.66.1 192.168.66.239
ip dhcp excluded-address 192.168.66.254
!
ip dhcp pool local
import all
network 192.168.66.0 255.255.255.0
default-router 192.168.66.1
dns-server 192.168.66.1
domain-name media-kontor.local
!
!
!
ip domain name media-kontor.local
ip name-server 185.40.174.19
ip name-server 109.73.31.212
ip inspect name myfw tcp
ip inspect name myfw udp
ip inspect name myfw sip
ip inspect name myfw rtsp
ip cef
no ipv6 cef
!
!
!
!
!
multilink bundle-name authenticated
!
password encryption aes
!
!
!
!
!
!
license udi pid CISCO887VGW-GNE-K9 sn FCZ1608C0FW
!
!
username admin privilege 15 secret 5 $1$svVc$TmyGi9WbMwx29FXsk1Zu81
!
!
!
!
!
controller VDSL 0
!
controller Cellular 0
!
!
!
!
!
!
!
!
!
!
!
!
interface Ethernet0
description $ETH-WAN$
no ip address
no ip route-cache
pppoe enable group global
pppoe-client dial-pool-number 2
!
interface FastEthernet0
no ip address
!
interface FastEthernet1
no ip address
!
interface FastEthernet2
no ip address
!
interface FastEthernet3
switchport access vlan 10
no ip address
!
interface wlan-ap0
no ip address
arp timeout 0
!
interface Wlan-GigabitEthernet0
no ip address
!
interface Cellular0
no ip address
encapsulation ppp
!
interface Vlan1
description local LAN
ip address 192.168.66.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
ip tcp adjust-mss 1452
!
interface Vlan10
no ip address
ip nat outside
ip virtual-reassembly in
pppoe enable group global
pppoe-client dial-pool-number 1
!
interface Dialer0
ip address negotiated
ip access-group 111 in
no ip redirects
ip mtu 1452
ip nat outside
ip inspect myfw out
ip virtual-reassembly in
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication chap pap callin
ppp chap hostname ppp-test-cisco
ppp chap password 7 143D333202103C7E0F7A3A3D213D543A
ppp pap sent-username ppp-test-cisco password 7 07250075401D0F503C40020407047808
!
interface Dialer2
ip address negotiated
ip mtu 1452
encapsulation ppp
dialer pool 2
dialer-group 2
ppp authentication chap pap callin
ppp chap hostname ppp-test-100
ppp chap password 7 095C5E19541112011F41557A7B
ppp pap sent-username ppp-test-100 password 7 051B161F6C584B1A0D4846425B
!
no ip forward-protocol nd
ip http server
ip http authentication local
no ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
!
ip dns server
no ip nat service sip udp port 5060
ip nat inside source list 101 interface Dialer0 overload
ip route 0.0.0.0 0.0.0.0 Dialer0 permanent
!
dialer-list 1 protocol ip list 101
dialer-list 2 protocol ip permit
!
access-list 23 permit 192.168.66.0 0.0.0.255
access-list 100 permit udp any eq 5060 any
access-list 101 permit ip 192.168.66.0 0.0.0.255 any
access-list 111 permit icmp any any administratively-prohibited
access-list 111 permit icmp any any echo-reply
access-list 111 permit icmp any any packet-too-big
access-list 111 permit icmp any any time-exceeded
access-list 111 permit icmp any any unreachable
access-list 111 permit udp any eq domain any
access-list 111 permit tcp any eq domain any
access-list 111 permit udp any eq ntp any
access-list 111 permit 22 any any
access-list 111 deny ip any any log
!
control-plane
!
!
mgcp behavior rsip-range tgcp-only
mgcp behavior comedia-role none
mgcp behavior comedia-check-media-src disable
mgcp behavior comedia-sdp-force disable
!
mgcp profile default
!
!
!
!
!
!
line con 0
no modem enable
line aux 0
line 2
no activation-character
no exec
transport preferred none
transport input all
line 3
no exec
line vty 0 4
access-class 23 in
privilege level 15
login local
transport input telnet ssh
!
ntp server 185.40.174.21 source Dialer0
!
end

So also habe nun auf deinen Rat hin IPSEC eingerichtet da du ja völlig recht hast!

Leider habe ich nun das Problem das ich zwar den Cisco erreiche per ssh aber keinen der clients z.b. Windows PC.
Was müsste ich nun noch einstellen damit das geht?

Aber erstmal einen riesen Dank an dich für die Hilfe bis hier her!

Ja die haben alle den Cisco als default GW.

Problem mit dem Ping habe ich gelöst! Das war zum einen die Firewall am Windows PC und zum anderen half der "ip nat inside eintrag" somit ging dann aller Traffic durch den Tunnel und nun klappt Ipsec sehr gut,

außer der DNS: Wenn ich am Macbook den Cisco 192.168.66.1 einstelle bekomme ich keinen seitenaufbau hin ---> nehme ich google geht es sofort? Was habe ich da verstellt oder vergessen am cisco?

Hier die Config: (Ich kann lesen, aber ich wollte dich noch fragen wie ich das mit der ACL und dem Zugriff via VPN besser lösen kann--->jetzt ist meine WAN IP drin aber die ändert sich ja alle 4-8 Tage laut unity?!)


version 15.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname Cisco887vaw
!
boot-start-marker
boot-end-marker
!
!
security authentication failure rate 3 log
security passwords min-length 6
no logging buffered
enable secret 5 $1$p/nc$8aTroUxaO4ukJ63Co1/qu1
!
aaa new-model
!
!
aaa authentication login clientauth local
aaa authorization network groupauth local
!
!
!
!
!
aaa session-id common
memory-size iomem 10
clock timezone CET 1 0
clock summer-time CEST recurring last Sun Mar 2:00 last Sun Oct 3:00
service-module wlan-ap 0 bootimage autonomous
!
!
no ip source-route
no ip gratuitous-arps
!
!
!
!
!
ip dhcp binding cleanup interval 600
ip dhcp excluded-address 192.168.66.1 192.168.66.239
ip dhcp excluded-address 192.168.66.254
!
ip dhcp pool local
import all
network 192.168.66.0 255.255.255.0
default-router 192.168.66.1
dns-server 192.168.66.1
domain-name media-kontor.local
!
!
!
ip domain name media-kontor.local
ip name-server 185.40.174.19
ip name-server 109.73.31.212
ip inspect name myfw tcp
ip inspect name myfw udp
ip inspect name myfw sip
ip inspect name myfw rtsp
ip cef
no ipv6 cef
!
!
!
!
!
multilink bundle-name authenticated
!
password encryption aes
!
!
!
!
!
!
license udi pid CISCO887VGW-GNE-K9 sn FCZ1608C0FW
!
!
username admin privilege 15 secret 5 $1$svVc$TmyGi9WbMwx29FXsk1Zu81
username vpn1 password 7 1418021B09082F7A7D7163
username vpngoup password 7 06091F3149420C485C4E42
!
!
!
!
!
controller VDSL 0
!
controller Cellular 0
!
!
!
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 2
!
crypto isakmp client configuration group vpngroup
key XXXXXXXXXXXXXXXX
dns 192.168.66.1
domain media-kontor.com.local
pool vpnpool
save-password
max-users 5
banner ^C Willkommen im VPN von MEDIA-KONTOR ^C
crypto isakmp profile VPNclient
description VPN Client Profil
match identity group vpngroup
client authentication list clientauth
isakmp authorization list groupauth
client configuration address respond
virtual-template 2
!
!
crypto ipsec transform-set myset esp-aes esp-sha-hmac
mode tunnel
!
!
crypto ipsec profile vpn-vti2
set transform-set myset
!
!
!
!
!
!
!
interface Ethernet0
description $ETH-WAN$
no ip address
no ip route-cache
pppoe enable group global
pppoe-client dial-pool-number 2
!
interface FastEthernet0
no ip address
!
interface FastEthernet1
no ip address
!
interface FastEthernet2
no ip address
!
interface FastEthernet3
switchport access vlan 10
no ip address
!
interface Virtual-Template2 type tunnel
description IPsec VPN Dialin
ip unnumbered Vlan1
ip virtual-reassembly in
tunnel mode ipsec ipv4
tunnel protection ipsec profile vpn-vti2
!
interface wlan-ap0
no ip address
arp timeout 0
!
interface Wlan-GigabitEthernet0
no ip address
!
interface Cellular0
no ip address
encapsulation ppp
!
interface Vlan1
description local LAN
ip address 192.168.66.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
ip tcp adjust-mss 1452
!
interface Vlan10
no ip address
ip nat outside
ip virtual-reassembly in
pppoe enable group global
pppoe-client dial-pool-number 1
!
interface Dialer0
ip address negotiated
ip access-group 111 in
no ip redirects
ip mtu 1452
ip nat outside
ip inspect myfw out
ip virtual-reassembly in
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication chap pap callin
ppp chap hostname ppp-test-cisco
ppp chap password 7 143D333202103C7E0F7A3A3D213D543A
ppp pap sent-username ppp-test-cisco password 7 07250075401D0F503C40020407047808
!
interface Dialer2
ip address negotiated
ip mtu 1452
encapsulation ppp
dialer pool 2
dialer-group 2
ppp authentication chap pap callin
ppp chap hostname ppp-test-100
ppp chap password 7 095C5E19541112011F41557A7B
ppp pap sent-username ppp-test-100 password 7 051B161F6C584B1A0D4846425B
!
ip local pool vpnpool 192.168.66.240 192.168.66.250
no ip forward-protocol nd
ip http server
ip http authentication local
no ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
!
ip dns server
no ip nat service sip udp port 5060
ip nat inside source list 101 interface Dialer0 overload
ip route 0.0.0.0 0.0.0.0 Dialer0 permanent
!
dialer-list 1 protocol ip list 101
dialer-list 2 protocol ip permit
!
access-list 23 permit 192.168.66.0 0.0.0.255
access-list 100 permit udp any eq 5060 any
access-list 101 permit ip 192.168.66.0 0.0.0.255 any
access-list 111 permit icmp any any administratively-prohibited
access-list 111 permit icmp any any echo-reply
access-list 111 permit icmp any any packet-too-big
access-list 111 permit icmp any any time-exceeded
access-list 111 permit icmp any any unreachable
access-list 111 permit udp any eq domain any
access-list 111 permit tcp any eq domain any
access-list 111 permit udp any eq ntp any
access-list 111 permit gre any any
access-list 111 permit udp host 178.25.29.217 any
!
!
!
control-plane
!
!
mgcp behavior rsip-range tgcp-only
mgcp behavior comedia-role none
mgcp behavior comedia-check-media-src disable
mgcp behavior comedia-sdp-force disable
!
mgcp profile default
!
!
!
!
!
!
line con 0
no modem enable
line aux 0
line 2
no activation-character
no exec
transport preferred none
transport input all
line 3
no exec
line vty 0 4
access-class 23 in
privilege level 15
transport input ssh
!
ntp server 185.40.174.21 source Dialer0
!
end

Vielen Dank! Hat geklappt mit ip nat inside!

Doch doch wird alles durch den Tunnel geschoben (vorerst!)

Nun habe ich nur noch das Problem:

Wenn ich einen IPSEC-VPN tunnel von einer beliebigen WAN-IP aufbauen möchte, muss ich dann in der

ACL 111 permit udp any any setzen oder geht das auch noch besser?
im Moment habe ich die WAN IP von meinem Homeoffice drin (access-list 111 permit udp host 178.25.29.217 any) ?!

Ich möchte quasi auch von unterwegs via Macbook auf des Netzwerk von dem Cisco kommen via 4G. (Bekomme da auch eine WAN-IP zugeteilt laut DTAG)

Dann denke ich auch das der Cisco erst einmal sicher läuft und ich dann beginnen kann mit der SIP - Config?! Sollte dem nicht so sein korrigiere mich bitte !

UND dann wollte ich nochmal den Hut ziehen für deine wahnsinns Kompetenz und Geduld mit mir!

So also der VPN-Tunnel geht nun richtig Prima mit den o.g Einträgen in der ACL! Vielen Dank nochmal!

Ja da ich öfter mal im dunklen tappe dacht ich mir ich passe das Bild mal an! :D

Nun aber zum eigentlichen Problem:

Ich habe nun nach einer Anleitung aus dem Netz den VOICE Service aktiviert, aber es tut sich rein gar nichts:

Cisco887vaw#sh sip-ua register status
Line peer expires(sec) reg survival P-Associ-URI
========== ============ === ======== ============
Cisco887vaw#

?! Hier muss es sich ja um ein grundlegendes Problem handeln . . .

Hier mal die komplette Conf:

version 15.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname Cisco887vaw
!
boot-start-marker
boot-end-marker
!
!
security authentication failure rate 3 log
security passwords min-length 6
no logging buffered
enable secret 5 $1$p/nc$8aTroUxaO4ukJ63Co1/qu1
!
aaa new-model
!
!
aaa authentication login clientauth local
aaa authorization network groupauth local
!
!
!
!
!
aaa session-id common
memory-size iomem 10
clock timezone CET 1 0
clock summer-time CEST recurring last Sun Mar 2:00 last Sun Oct 3:00
service-module wlan-ap 0 bootimage autonomous
!
!
no ip source-route
no ip gratuitous-arps
!
!
!
!
!
ip dhcp binding cleanup interval 600
ip dhcp excluded-address 192.168.66.1 192.168.66.239
ip dhcp excluded-address 192.168.66.254
!
ip dhcp pool local
import all
network 192.168.66.0 255.255.255.0
default-router 192.168.66.1
dns-server 192.168.66.1
domain-name media-kontor.local
!
!
!
ip domain name media-kontor.local
ip name-server 185.40.174.19
ip name-server 109.73.31.212
ip inspect name myfw tcp
ip inspect name myfw udp
ip inspect name myfw sip
ip inspect name myfw rtsp
ip ddns update method dyndns
HTTP
add http://XXXXXXXXXXXXXXXXXXXXXX@members.dyndns.org/nic/updatesystem=dyndn ...;
interval maximum 1 0 0 0
!
ip cef
no ipv6 cef
!
!
!
!
!
multilink bundle-name authenticated
!
password encryption aes
!
voice call send-alert
voice rtp send-recv
!
voice service voip
ip address trusted list
ipv4 0.0.0.0 0.0.0.0
allow-connections h323 to h323
allow-connections h323 to sip
allow-connections sip to h323
allow-connections sip to sip
supplementary-service h450.12
no supplementary-service sip moved-temporarily
no supplementary-service sip refer
sip
registrar server expires max 3600 min 3600
localhost dns:sipconnect.sipgate.de
sip-profiles 1000
!
voice class codec 1
codec preference 1 g711alaw
!
!
voice class sip-profiles 1000
request ANY sip-header From modify "(<.*(.*@)" "\2373198t0@"
request REGISTER sip-header To modify "(<.*(.*@)" "\2373198t0@"
!
!
!
!
!
!
license udi pid CISCO887VGW-GNE-K9 sn FCZ1608C0FW
!
!
username admin privilege 15 secret 5 XXXXXXXXXXXXXXXXXXXXXXXXXXXXX
username vpn1 password 7 XXXXXXXXXXXXXXXXXXXXXX
username vpngoup password 7 XXXXXXXXXXXXXXXXXXXXXXXX
!
!
!
!
!
controller VDSL 0
!
controller Cellular 0
!
!
!
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 2
!
crypto isakmp client configuration group vpngroup
key XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
dns 192.168.66.1
domain media-kontor.com.local
pool vpnpool
save-password
max-users 5
banner ^C Willkommen im VPN von MEDIA-KONTOR ^C
crypto isakmp profile VPNclient
description VPN Client Profil
match identity group vpngroup
client authentication list clientauth
isakmp authorization list groupauth
client configuration address respond
virtual-template 2
!
!
crypto ipsec transform-set myset esp-aes esp-sha-hmac
mode tunnel
!
!
crypto ipsec profile vpn-vti2
set transform-set myset
!
!
!
!
!
!
!
interface Ethernet0
description $ETH-WAN$
no ip address
no ip route-cache
pppoe enable group global
pppoe-client dial-pool-number 2
!
interface FastEthernet0
no ip address
!
interface FastEthernet1
no ip address
!
interface FastEthernet2
no ip address
!
interface FastEthernet3
switchport access vlan 10
no ip address
!
interface Virtual-Template2 type tunnel
description IPsec VPN Dialin
ip unnumbered Vlan1
ip nat inside
ip virtual-reassembly in
tunnel mode ipsec ipv4
tunnel protection ipsec profile vpn-vti2
!
interface wlan-ap0
no ip address
arp timeout 0
!
interface Wlan-GigabitEthernet0
no ip address
!
interface Cellular0
no ip address
encapsulation ppp
!
interface Vlan1
description local LAN
ip address 192.168.66.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
ip tcp adjust-mss 1452
!
interface Vlan10
no ip address
ip nat outside
ip virtual-reassembly in
pppoe enable group global
pppoe-client dial-pool-number 1
!
interface Dialer0
ip ddns update hostname 887cisc.dyndns.org
ip address negotiated
ip access-group 111 in
no ip redirects
ip mtu 1452
ip nat outside
ip inspect myfw out
ip virtual-reassembly in
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication chap pap callin
ppp chap hostname ppp-test-cisco
ppp chap password 7 143D333202103C7E0F7A3A3D213D543A
ppp pap sent-username ppp-test-cisco password 7 07250075401D0F503C40020407047808
!
interface Dialer2
ip address negotiated
ip mtu 1452
encapsulation ppp
dialer pool 2
dialer-group 2
ppp authentication chap pap callin
ppp chap hostname ppp-test-100
ppp chap password 7 095C5E19541112011F41557A7B
ppp pap sent-username ppp-test-100 password 7 051B161F6C584B1A0D4846425B
!
ip local pool vpnpool 192.168.66.240 192.168.66.250
no ip forward-protocol nd
ip http server
ip http authentication local
no ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
!
ip dns server
no ip nat service sip udp port 5060
ip nat inside source list 101 interface Dialer0 overload
ip route 0.0.0.0 0.0.0.0 Dialer0 permanent
!
dialer-list 1 protocol ip list 101
dialer-list 2 protocol ip permit
!
access-list 23 permit 192.168.66.0 0.0.0.255
access-list 100 permit udp any eq 5060 any
access-list 101 permit ip 192.168.66.0 0.0.0.255 any
access-list 111 permit icmp any any administratively-prohibited
access-list 111 permit icmp any any echo-reply
access-list 111 permit icmp any any packet-too-big
access-list 111 permit icmp any any time-exceeded
access-list 111 permit icmp any any unreachable
access-list 111 permit udp any eq domain any
access-list 111 permit tcp any eq domain any
access-list 111 permit udp any any eq isakmp
access-list 111 permit udp any any eq non500-isakmp
access-list 111 permit esp any any
access-list 111 permit udp any eq ntp any
!
!
!
control-plane
!
!
mgcp behavior rsip-range tgcp-only
mgcp behavior comedia-role none
mgcp behavior comedia-check-media-src disable
mgcp behavior comedia-sdp-force disable
!
mgcp profile default
!
!
!
!
dial-peer voice 1 voip
translation-profile outgoing PSTN_Outgoing
preference 1
service session
destination-pattern 0[0-9]T
session protocol sipv2
session target dns:sipconnect.sipgate.de
incoming called-number T
voice-class codec 1
voice-class sip dtmf-relay force rtp-nte
dtmf-relay rtp-nte
clid network-number 021178178994771
no vad
!
!
sip-ua
credentials username 2373198t0 password 7 13281E041C59142112112C2223 realm sipconnect.sipgate.de
keepalive target dns:sipconnect.sipgate.de
authentication username 2373198t0 password 7 13281E041C59142112112C2223
no remote-party-id
retry invite 5
retry register 10
timers connect 100
timers keepalive active 100
registrar dns:sipconnect.sipgate.de expires 600
sip-server dns:sipconnect.sipgate.de
connection-reuse
host-registrar
g729-annexb override
!
!
line con 0
no modem enable
line aux 0
line 2
no activation-character
no exec
transport preferred none
transport input all
line 3
no exec
line vty 0 4
access-class 23 in
privilege level 15
transport input ssh
!
ntp server 185.40.174.21 source Dialer0
!
end

Ja das habe ich nun mal gemacht:

Cisco887vaw#
Feb 10 10:15:18.542: -1/xxxxxxxxxxxx/SIP/Event/sipSPIEventInfo: Queued event from SIP SPI : SIPSPI_EV_DNS_RESOLVE
Feb 10 10:15:18.542:-1/xxxxxxxxxxxx/SIP/Error/httpish_msg_free:
Freeing NULL pointer!
Feb 10 10:15:19.042: -1/xxxxxxxxxxxx/SIP/Event/sipSPIEventInfo: Queued event from SIP SPI : SIPSPI_EV_DNS_RESOLVE
Feb 10 10:15:19.042:-1/xxxxxxxxxxxx/SIP/Error/_send_dns_fail:
DNS Query for sipconnect.sipgate.de failed
Feb 10 10:15:19.042: -1/xxxxxxxxxxxx/SIP/Error/httpish_msg_free:
Freeing NULL pointer!
Feb 10 10:15:25.930:-1/xxxxxxxxxxxx/SIP/Event/sipSPIEventInfo: Queued event from SIP SPI : SIPSPI_EV_DNS_RESOLVE
Feb 10 10:15:25.930: -1/xxxxxxxxxxxx/SIP/Error/_send_dns_fail:
DNS Query for sipconnect.sipgate.de failed
Feb 10 10:15:25.930:-1/xxxxxxxxxxxx/SIP/Error/sipDestroyContainerContext:
Corrupted/Freed Container=0x0
Feb 10 10:15:25.930: //-1/xxxxxxxxxxxx/SIP/Error/httpish_msg_free:
Freeing NULL pointer!

Nein ich denke mal nicht das er dies tut?! Wie kann ich das im debug sehen?

p.s. hab auch mal das sipconnect.sip ... duch die IP ersetzt kamen aber die selben fehler im log?!

Ja das habe ich Geschaut Ping geht hin und auch im nslookup ist er verfügbar mit entsprechender ip?!

So also den DNS Fehler habe ich nun behoben da fehlte ein ip domain lookup auf dem dialer 0.

Jetzt sieht der SIP-debug so aus?!

Cisco887vaw#
Feb 17 20:55:57.318: -1/xxxxxxxxxxxx/SIP/Event/sipSPIEventInfo: Queued event from SIP SPI : SIPSPI_EV_DNS_RESOLVE
Feb 17 20:55:57.414:-1/xxxxxxxxxxxx/SIP/Error/httpish_msg_free:
Freeing NULL pointer!
Feb 17 20:56:02.630: -1/xxxxxxxxxxxx/SIP/Event/sipSPIEventInfo: Queued event from SIP SPI : SIPSPI_EV_OUTBOUND_REGISTER
Feb 17 20:56:02.630:-1/xxxxxxxxxxxx/SIP/Event/sipSPIEventInfo: Queued event from SIP SPI : SIPSPI_EV_DNS_RESOLVE
Feb 17 20:56:02.726: -1/xxxxxxxxxxxx/SIP/Error/httpish_msg_free:
Freeing NULL pointer!
Feb 17 20:56:27.915:-1/xxxxxxxxxxxx/SIP/Event/sipSPIEventInfo: Queued event from SIP SPI : SIPSPI_EV_DNS_RESOLVE
Feb 17 20:56:28.011: -1/xxxxxxxxxxxx/SIP/Error/httpish_msg_free:
Freeing NULL pointer!
Feb 17 20:56:38.227:-1/xxxxxxxxxxxx/SIP/Error/sipDestroyContainerContext:
Corrupted/Freed Container=0x0
Feb 17 20:56:58.512: -1/xxxxxxxxxxxx/SIP/Event/sipSPIEventInfo: Queued event from SIP SPI : SIPSPI_EV_DNS_RESOLVE
Feb 17 20:56:58.608:-1/xxxxxxxxxxxx/SIP/Error/httpish_msg_free:

Dazu sei noch gesagt das es sich hier um einen Sipgate Trunking Anschluss handelt und da gibt Sipgate in den Accountdaten dieses sipconnect.sipgate.de vor?!

Könnte das vllt. ein Fimrware-Problem sein oder sonstiges? Ich kann mit diesem Freeing mist nichts anfangen?!

Keiner ne Idee was das sein könnte oder ich falsch mache?!

Ja habe ich gemacht und nix wirklich brauchbares gefunden, außer das:

"The error code you are getting is 483 i.e. to many hops and its related to the Max-Forwards header in sip messages."

Nur was haben die MAX-Forwards im header mit der SIP-Registrierung zu tun?

Hallo,

ich habe nun den Provider gewechselt und hänge auch nicht mehr per Funk dran sondern via VDSL2.
Der Provider sagt das eine SIP-Reg. bei Sipgate aus seinem Netz heraus definitiv möglich ist via VDSL2 und es da keinerlei Einschränkung gibt.

Der 887 ist auch online via VDSL2 der DynDNS läuft wunderbar und INET im allgemeinen läuft super.

Nun wieder zum leidigen Problem: SIPGATE Anmeldung schlägt fehl, der Techniker von SIPGATE meinte das die an Ihrem Server einen INVITE bekommen von meinem Cisco diesen dann beantworten via 5060 und auch 1x eine Antwort meines Ciscos bekommen darauf.

Dann aber wenn der Authentication Proxy gesendet wird von Sipgate und somit die Authentication abgefragt wird antwortet mein Cisco nicht auf 5060 sondern auf 58227. Dies ist laut SIPGATE der Fehler?!

Hier mal noch der Log :

Mar 9 17:03:40.149: -1/xxxxxxxxxxxx/SIP/Info/info/1024/httpish_msg_free: Freed msg=0x8C45E774
.Mar 9 17:03:44.149:-1/xxxxxxxxxxxx/SIP/Info/info/1024/httpish_msg_create: created msg=0x8C45E774 with refCount = 1
.Mar 9 17:03:44.149: -1/xxxxxxxxxxxx/SIP/Info/verbose/8192/sipSPISetDateHeader: Converting TimeZone CET to SIP default timezone = GMT
.Mar 9 17:03:44.149:22/000000000000/SIP/Info/info/2048/sipSPIGetExtensionCfg: SIP extension config:1, check sys cfg:1
.Mar 9 17:03:44.149: 22/000000000000/SIP/Info/info/4096/sipSPISendRegister: Associated container=0x8C87B1B4 to Register
.Mar 9 17:03:44.149:-1/xxxxxxxxxxxx/SIP/Info/verbose/8192/sipSPIAppHandleContainerBody: sipSPIAppHandleContainerBody len 0
.Mar 9 17:03:44.149: 22/000000000000/SIP/Transport/sipSPISendRegister: Sending REGISTER to the transport layer
.Mar 9 17:03:44.149:22/000000000000/SIP/Transport/sipSPIGetSwitchTransportFlag: Return the Global configuration, Switch Transport is FALSE
.Mar 9 17:03:44.149: 22/000000000000/SIP/Transport/sipSPITransportSendMessage: msg=0x8C45E774, addr=217.10.68.150, port=5160, sentBy_port=0, local_addr=, is_req=1, transport=1, switch=0, callBack=0x0
.Mar 9 17:03:44.149:-1/xxxxxxxxxxxx/SIP/Info/info/64/sip_profiles_application_modify_remove_header: Header before modification : From: <sip:2373198t0@sipconnect.sipgate.de>;tag=6CD0E0-857
.Mar 9 17:03:44.149: -1/xxxxxxxxxxxx/SIP/Info/critical/64/sip_profiles_application_modify_remove_header: SIP profiles application couldnt modify the header : From: <sip:2373198t0@sipconnect.sipgate.de>;tag=6CD0E0-857
.Mar 9 17:03:44.149:-1/xxxxxxxxxxxx/SIP/Info/info/64/sip_profiles_application_modify_remove_header: Header before modification : To: <sip:2373198t0@sipconnect.sipgate.de>
.Mar 9 17:03:44.149: -1/xxxxxxxxxxxx/SIP/Info/critical/64/sip_profiles_application_modify_remove_header: SIP profiles application couldnt modify the header : To: <sip:2373198t0@sipconnect.sipgate.de>
.Mar 9 17:03:44.149:22/000000000000/SIP/Info/info/2048/sipSPIGetExtensionCfg: SIP extension config:1, check sys cfg:1
.Mar 9 17:03:44.149: 22/000000000000/SIP/Transport/sipSPITransportSendMessage: Proceedable for sending msg immediately
.Mar 9 17:03:44.149:-1/xxxxxxxxxxxx/SIP/Transport/sipConnectionManagerGetConnection: connection required for raddr:217.10.68.150, rport:5160 with laddr:

.Mar 9 17:03:44.149: -1/xxxxxxxxxxxx/SIP/Transport/sipInstanceGetConnectionId: gcb=0x8DB78BA8 is already on connection=0x8A9E0404 context_list
.Mar 9 17:03:44.149:22/000000000000/SIP/Transport/sipTransportLogicSendMsg: Set to send the msg=0x8C45E774
.Mar 9 17:03:44.149: -1/xxxxxxxxxxxx/SIP/Transport/sipTransportPostSendMessage: Posting send for msg=0x8C45E774, addr=217.10.68.150, port=5160, local_addr=, connId=3 vrfid=0 for UDP
.Mar 9 17:03:44.149:-1/xxxxxxxxxxxx/SIP/Msg/ccsipDisplayMsg:
Sent:
REGISTER sip:sipconnect.sipgate.de:5160 SIP/2.0
Via: SIP/2.0/UDP 185.40.175.124:5060;branch=z9hG4bK1592B
From: <sip:2373198t0@sipconnect.sipgate.de>;tag=6CD0E0-857
To: <sip:2373198t0@sipconnect.sipgate.de>
Date: Wed, 09 Mar 2016 17:03:44 GMT
Call-ID: E07B5827-E54D11E5-8003C517-8013FBB8
User-Agent: Cisco-SIPGateway/IOS-15.4.3.M4
Max-Forwards: 70
Timestamp: 1457543024
CSeq: 6 REGISTER
Contact: <sip:2373198t0@185.40.175.124:5060>
Expires: 3600
Supported: path
Content-Length: 0


.Mar 9 17:03:44.149: -1/xxxxxxxxxxxx/SIP/Info/info/1024/httpish_msg_free: Freed msg=0x8C45E774
.Mar 9 17:03:48.149:-1/xxxxxxxxxxxx/SIP/Info/info/1024/httpish_msg_create: created msg=0x8C45E774 with refCount = 1
.Mar 9 17:03:48.149: -1/xxxxxxxxxxxx/SIP/Info/verbose/8192/sipSPISetDateHeader: Converting TimeZone CET to SIP default timezone = GMT
.Mar 9 17:03:48.149:22/000000000000/SIP/Info/info/2048/sipSPIGetExtensionCfg: SIP extension config:1, check sys cfg:1
.Mar 9 17:03:48.149: 22/000000000000/SIP/Info/info/4096/sipSPISendRegister: Associated container=0x8C87B1B4 to Register
.Mar 9 17:03:48.149:-1/xxxxxxxxxxxx/SIP/Info/verbose/8192/sipSPIAppHandleContainerBody: sipSPIAppHandleContainerBody len 0
.Mar 9 17:03:48.149: 22/000000000000/SIP/Transport/sipSPISendRegister: Sending REGISTER to the transport layer
.Mar 9 17:03:48.149:22/000000000000/SIP/Transport/sipSPIGetSwitchTransportFlag: Return the Global configuration, Switch Transport is FALSE
.Mar 9 17:03:48.149: 22/000000000000/SIP/Transport/sipSPITransportSendMessage: msg=0x8C45E774, addr=217.10.68.150, port=5160, sentBy_port=0, local_addr=, is_req=1, transport=1, switch=0, callBack=0x0
.Mar 9 17:03:48.149:-1/xxxxxxxxxxxx/SIP/Info/info/64/sip_profiles_application_modify_remove_header: Header before modification : From: <sip:2373198t0@sipconnect.sipgate.de>;tag=6CD0E0-857
.Mar 9 17:03:48.149: -1/xxxxxxxxxxxx/SIP/Info/critical/64/sip_profiles_application_modify_remove_header: SIP profiles application couldnt modify the header : From: <sip:2373198t0@sipconnect.sipgate.de>;tag=6CD0E0-857
.Mar 9 17:03:48.149:-1/xxxxxxxxxxxx/SIP/Info/info/64/sip_profiles_application_modify_remove_header: Header before modification : To: <sip:2373198t0@sipconnect.sipgate.de>
.Mar 9 17:03:48.149: -1/xxxxxxxxxxxx/SIP/Info/critical/64/sip_profiles_application_modify_remove_header: SIP profiles application couldnt modify the header : To: <sip:2373198t0@sipconnect.sipgate.de>
.Mar 9 17:03:48.149:22/000000000000/SIP/Info/info/2048/sipSPIGetExtensionCfg: SIP extension config:1, check sys cfg:1
.Mar 9 17:03:48.149: 22/000000000000/SIP/Transport/sipSPITransportSendMessage: Proceedable for sending msg immediately
.Mar 9 17:03:48.149:-1/xxxxxxxxxxxx/SIP/Transport/sipConnectionManagerGetConnection: connection required for raddr:217.10.68.150, rport:5160 with laddr:

.Mar 9 17:03:48.149: -1/xxxxxxxxxxxx/SIP/Transport/sipInstanceGetConnectionId: gcb=0x8DB78BA8 is already on connection=0x8A9E0404 context_list
.Mar 9 17:03:48.149:22/000000000000/SIP/Transport/sipTransportLogicSendMsg: Set to send the msg=0x8C45E774
.Mar 9 17:03:48.149: -1/xxxxxxxxxxxx/SIP/Transport/sipTransportPostSendMessage: Posting send for msg=0x8C45E774, addr=217.10.68.150, port=5160, local_addr=, connId=3 vrfid=0 for UDP
.Mar 9 17:03:48.149:-1/xxxxxxxxxxxx/SIP/Msg/ccsipDisplayMsg:
Sent:
REGISTER sip:sipconnect.sipgate.de:5160 SIP/2.0
Via: SIP/2.0/UDP 185.40.175.124:5060;branch=z9hG4bK1592B
From: <sip:2373198t0@sipconnect.sipgate.de>;tag=6CD0E0-857
To: <sip:2373198t0@sipconnect.sipgate.de>
Date: Wed, 09 Mar 2016 17:03:48 GMT
Call-ID: E07B5827-E54D11E5-8003C517-8013FBB8
User-Agent: Cisco-SIPGateway/IOS-15.4.3.M4
Max-Forwards: 70
Timestamp: 1457543028
CSeq: 6 REGISTER
Contact: <sip:2373198t0@185.40.175.124:5060>
Expires: 3600
Supported: path
Content-Length: 0


.Mar 9 17:03:48.149: -1/xxxxxxxxxxxx/SIP/Info/info/1024/httpish_msg_free: Freed msg=0x8C45E774
.Mar 9 17:03:52.149:22/000000000000/SIP/Error/act_sent_register_wait_100:
act_sent_register_wait_100: Out of retries
.Mar 9 17:03:52.149: -1/xxxxxxxxxxxx/SIP/Info/info/262144/sipSPIDecrementOverloadCount: Count:Local 0 Global 0
.Mar 9 17:03:52.149:22/000000000000/SIP/Error/ccsip_api_register_result_ind:
Message Code Class 4xx Method Code 100 received for REGISTER
.Mar 9 17:03:52.149: -1/xxxxxxxxxxxx/SIP/Info/verbose/262144/ccsipGetCCBFromRCB: Retrived CCB pointer [0x0]
.Mar 9 17:03:52.149:-1/xxxxxxxxxxxx/SIP/Info/verbose/4096/ccsip_spi_register_free_rcb: Freeing rcb [0x8C8EB5D4]
.Mar 9 17:03:52.149: -1/xxxxxxxxxxxx/SIP/Info/notify/262144/ccsip_register_reset_dns_cache: CCSIP_REGISTER:: registrar 0 DNS resolved addr reset
.Mar 9 17:03:52.149:-1/xxxxxxxxxxxx/SIP/Error/sipDestroyContainerContext:
Corrupted/Freed Container=0x0
.Mar 9 17:03:52.149: 22/000000000000/SIP/Error/ccsip_api_register_result_ind:
SIP Registration Retries Exhausted
.Mar 9 17:03:52.149:22/000000000000/SIP/Info/notify/262144/sipSPIRegPthruProcessResponse: Processing response w/ resp code == 408
.Mar 9 17:03:52.149: -1/xxxxxxxxxxxx/SIP/Info/verbose/262144/sipSPIGetRPCBFromRCB: Retreiving RCB [0x8C8E6DB8] from RPCB [0x0]
.Mar 9 17:03:52.149:22/000000000000/SIP/Info/critical/262144/sipSPIRegPthruProcessResponse: Error NO RPCB

.Mar 9 17:03:52.149: -1/xxxxxxxxxxxx/SIP/Info/info/2048/ccsipRegisterStartRCBTimer: Starting timer for pattern 2373198t0 for 180 seconds
.Mar 9 17:03:52.149:-1/xxxxxxxxxxxx/SIP/Info/verbose/4096/sipSPIDeleteContextFromTable: Context for key=[23] removed.
.Mar 9 17:03:52.149: 22/000000000000/SIP/Info/verbose/4096/sipSPIUdeleteCcbFromTable: Deleting from table. ccb=0x8DB78BA8 key=E07B5827-E54D11E5-8003C517-8013FBB8
.Mar 9 17:03:52.149:22/000000000000/SIP/Info/verbose/4096/sipSPIFlushEventBufferQueue: There are 0 events on the internal queue that are going to be free'd
.Mar 9 17:03:52.149: -1/xxxxxxxxxxxx/SIP/Transport/sipConnectionManagerUnregisterCtxtInConnection: gConnTab=0x8A9DF118, addr=217.10.68.150, port=5160, local_addr=, unregistering context=0x8DB78BA8
.Mar 9 17:03:52.149:-1/xxxxxxxxxxxx/SIP/Transport/sipInstancePurgeContextInConnection: Purging context gcb=0x8DB78BA8 from the connection=0x8A9E0404 context list
.Mar 9 17:03:52.149: 22/000000000000/SIP/Info/verbose/1/sipSPI_ipip_free_codec_profile: Codec Profiles Freed
.Mar 9 17:03:52.149:22/000000000000/SIP/Info/info/8192/sipSPIStopOverlapInfoTimer: Stopping Overlap Info Timer
.Mar 9 17:03:52.149: //22/000000000000/SIP/Info/verbose/4096/sipSPIUfreeOneCCB: Freeing ccb 0x8DB78BA8

p.s. Diese 5160 sollte ich laut SIPGATE Support ausprobieren für die Reg.?!

Line peer expires(sec) reg survival P-Associ-URI
========== ============ === ======== ============
2373198t0 -1 265 yes normal

DANKE!DANKE!DANKE!

Der Fehler war der SIP-ua Eintrag, Sipgate möchte da unbedingt ein retry invite stehen haben mit 2 als wert sonst kann man verzweifeln!

Nun fängt der Spaß aber richtig an:

Ich möchte nun meinen CUCM der in einem völlig anderen Netz (192.168.83.0) läuft mit dem CISCO887 verbinden via VPN.
Der 887 hat ja ein 192.168.66.0 Netz.
Ich möchte dies tun damit ich an dem 83.0 Standort die mit dem CUCM verbundenen und einwandfrei funktionierenden SIP-Phones endlich mit dem 887 an Standort B nutzen kann.

Funktioniert das und wenn ja gibt es irgendwo ne Anleitung?! Oder ist es besser den CUCM direkt via LAN an den 887 zu bringen? (Wäre ein sehr großer aufwand für mich, da an dem Standort wo mein CUCM läuft kein VDSL verfügbar ist sondern nur dieser Funkdreck--->müsste also den 887 wieder umbauen und neu einstellen für Funk )

Ach ja und nochmals ein riesiges DANKE an dich bis hier her.

Ja klar gibt es da ein Kommando:

authentication username 2373198t0 password 7 13281E041C59142112112C2223
no remote-party-id
retry invite 5 ------> aus der 5 ein 2 machen und schon ist man mit seinem Trunk online!


Und nun habe ich aber schon gleich das nächste Problem:
Also der Bintec Router RS123w ist nun mit dem Cisco 887 per VPN verbunden, aber ich kann nicht durch den Tunnel pingen?!

Habe den Cisco 887 nach dem Beispiel hier Cisco 880, 890 und ISR Router Konfiguration mit xDSL, Kabel oder FTTH Anschluss plus VPN und IP-TV SITE to SITE konfiguriert.

Netzwerk Standort A ist 192.168.83.0
Netzwerk Standort B ist 192.168.66.0

Und hier meine Cisco config:

crypto isakmp policy 10
encr aes 256
authentication pre-share
group 2
crypto isakmp key Geheim address WAN-IP Standort A

crypto ipsec transform-set vpn esp-aes esp-sha-hmac
mode tunnel

crypto map vpnpeer 10 ipsec-isakmp
description VPN Verbindung zu Standort A
set peer 178.25.27.36
set transform-set vpn
match address 107

interface Dialer2
ip ddns update hostname cisco887.ddns.net
ip ddns update no-ip
ip address negotiated
ip access-group 111 in
no ip redirects
ip mtu 1452
ip nat outside
ip inspect myfw out
ip virtual-reassembly in
encapsulation ppp
dialer pool 2
dialer-group 2
ppp authentication chap pap callin
ppp chap hostname Test
ppp chap password Geheim
ppp pap sent-username Geheim password Geheim
ppp ipcp dns request
ppp ipcp route default
crypto map vpnpeer

access-list 23 permit 192.168.66.0 0.0.0.255
access-list 100 permit udp any eq 5060 any
access-list 101 permit ip 192.168.66.0 0.0.0.255 any
access-list 107 permit ip 192.168.66.0 0.0.0.255 192.168.83.0 0.0.0.255
access-list 111 deny ip 192.168.66.0 0.0.0.255 192.168.83.0 0.0.0.255
access-list 111 remark CCP_ACL Category=17
access-list 111 remark Auto generated by CCP for NTP (123) 185.40.174.21
access-list 111 permit udp host 185.40.174.21 eq ntp any eq ntp
access-list 111 permit icmp any any administratively-prohibited
access-list 111 permit icmp any any echo-reply
access-list 111 permit icmp any any packet-too-big
access-list 111 permit icmp any any time-exceeded
access-list 111 permit icmp any any unreachable
access-list 111 permit udp any eq domain any
access-list 111 permit tcp any eq domain any
access-list 111 permit udp any any eq isakmp
access-list 111 permit udp any any eq non500-isakmp
access-list 111 permit esp any any
access-list 111 permit udp any eq ntp any

Ja das habe ich getan. Würde dir die Komplette config besser helfen meinen Fehler zu finden?

crypto isakmp policy 10
encr aes 256
authentication pre-share
group 2
crypto isakmp key Geheim address 178.25.27.36
!
crypto isakmp client configuration group vpngroup
key Geheim
dns 192.168.66.1
domain media-kontor.com.local
pool vpnpool
save-password
max-users 5
banner ^C Willkommen im VPN von MEDIA-KONTOR ^C
crypto isakmp profile VPNclient
description VPN Client Profil
match identity group vpngroup
client authentication list clientauth
isakmp authorization list groupauth
client configuration address respond
virtual-template 2
!
!
crypto ipsec transform-set myset esp-aes esp-sha-hmac
mode tunnel
crypto ipsec transform-set vpn esp-aes esp-sha-hmac
mode tunnel

crypto map vpnpeer 10 ipsec-isakmp
description VPN Verbindung zu Standort A
set peer 178.25.27.36
set transform-set vpn
match address 107

interface Virtual-Template2 type tunnel
description IPsec VPN Dialin
ip unnumbered Vlan1
ip nat inside
ip virtual-reassembly in
tunnel mode ipsec ipv4
tunnel protection ipsec profile vpn-vti2

interface Dialer2
ip ddns update hostname cisco887.ddns.net
ip ddns update no-ip
ip address negotiated
ip access-group 111 in
no ip redirects
ip mtu 1452
ip nat outside
ip inspect myfw out
ip virtual-reassembly in
encapsulation ppp
dialer pool 2
dialer-group 2
ppp authentication chap pap callin
ppp chap hostname
ppp chap password
ppp pap sent-username password
ppp ipcp dns request
ppp ipcp route default
crypto map vpnpeer

ip nat inside source route-map nonat interface Dialer2 overload

ip access-list extended vpnpeer
permit ip 192.168.66.0 0.0.0.255 192.168.83.0 0.0.0.255

route-map nonat permit 10
match ip address 111

access-list 23 permit 192.168.66.0 0.0.0.255
access-list 100 permit udp any eq 5060 any
access-list 101 permit ip 192.168.66.0 0.0.0.255 any
access-list 107 permit ip 192.168.66.0 0.0.0.255 192.168.83.0 0.0.0.255
access-list 111 deny ip 192.168.66.0 0.0.0.255 192.168.83.0 0.0.0.255
access-list 111 remark CCP_ACL Category=17
access-list 111 remark Auto generated by CCP for NTP (123) 185.40.174.21
access-list 111 permit udp host 185.40.174.21 eq ntp any eq ntp
access-list 111 permit icmp any any administratively-prohibited
access-list 111 permit icmp any any echo-reply
access-list 111 permit icmp any any packet-too-big
access-list 111 permit icmp any any time-exceeded
access-list 111 permit icmp any any unreachable
access-list 111 permit udp any eq domain any
access-list 111 permit tcp any eq domain any
access-list 111 permit udp any any eq isakmp
access-list 111 permit udp any any eq non500-isakmp
access-list 111 permit esp any any
access-list 111 permit udp any eq ntp any
access-list 111 permit ip host 8.23.224.120 any log-input DynDNS_perm

Herzlichen Dank!

Jetzt funktioniert alles und ich kann mich dem CUCM und dem debugs für die ersten Call-Versuche widmen.

Werde mich heute über den Tag auch nochmal mit den ACLs beschäftigen da meine ja nur Schrott war.

Eine letzte VPN-technische Frage hätte ich dann aber doch noch. . .

Wenn jetzt beide Standorte eine dyn. IP haben, ersetze ich dann einfach das ipv4 durch dns: und FQDN oder muss man da mehr beachten?

Moin Moin.

Also ich habe jetzt alles nach der o.g. Anleitung am Cisco eingestellt.

Aber sobald ich jetzt die IP vom Cisco am Bintec gegen den FQDN tausche baut sich der Tunnel zum Cisco ab und nie wieder auf.

Das meldet der Bintec:
08:00:17 INFO/IPSEC: P1: peer 6 (CISCO-STAT) sa 7841 (I): failed id fqdn(any:0,[0..15]=colbs.dyndns.org) -> id ipv4(any:0,[0..3]=185.40.175.228) (Authentication failed)

verstehe diese Meldung aber nicht, da ja nichts anders ist außer das er nun mit dem Cisco nicht über feste IPs sondern FQDN reden soll?!

Setze ich anstelle des FQDN wieder die IP dahinter im Bintec ist der Tunnel sofort wieder da?!

Das sagt der Cisco dazu sobald ich die FQDN Änderung mache:

Mar 26 07:52:12.981: ISAKMP (2193): received packet from 178.25.27.36 dport 4500 sport 37349 Global (R) QM_IDLE
Mar 26 07:52:12.981: ISAKMP: set new node -1415518332 to QM_IDLE
Mar 26 07:52:12.985: ISAKMP2193): processing HASH payload. message ID = 2879448964
Mar 26 07:52:12.985: ISAKMP2193): processing DELETE payload. message ID = 2879448964
Mar 26 07:52:12.985: ISAKMP2193):peer does not do paranoid keepalives.

Mar 26 07:52:12.985: ISAKMP2193):deleting SA reason "No reason" state (R) QM_IDLE (peer 178.25.27.36)
Mar 26 07:52:12.985: ISAKMP2193):deleting node -1415518332 error FALSE reason "Informational (in) state 1"
Mar 26 07:52:12.985: ISAKMP: set new node 2046037177 to QM_IDLE
Mar 26 07:52:12.985: ISAKMP2193): sending packet to 178.25.27.36 my_port 4500 peer_port 37349 (R) QM_IDLE
Mar 26 07:52:12.985: ISAKMP2193):Sending an IKE IPv4 Packet.
Mar 26 07:52:12.985: ISAKMP2193):purging node 2046037177
Mar 26 07:52:12.985: ISAKMP2193):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL
Mar 26 07:52:12.985: ISAKMP2193):Old State = IKE_P1_COMPLETE New State = IKE_DEST_SA

Mar 26 07:52:12.985: ISAKMP2193):deleting SA reason "No reason" state (R) QM_IDLE (peer 178.25.27.36)
Mar 26 07:52:12.985: ISAKMP: Unlocking peer struct 0x8CED02D4 for isadb_mark_sa_deleted(), count 0
Mar 26 07:52:12.985: ISAKMP: Deleting peer node by peer_reap for 178.25.27.36: 8CED02D4
Mar 26 07:52:12.989: ISAKMP2193):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
Mar 26 07:52:12.989: ISAKMP2193):Old State = IKE_DEST_SA New State = IKE_DEST_SA

Mar 26 07:52:12.989: ISAKMP (0): received packet from 178.25.27.36 dport 500 sport 820 Global (N) NEW SA
Mar 26 07:52:12.989: ISAKMP: Created a peer struct for 178.25.27.36, peer port 820
Mar 26 07:52:12.989: ISAKMP: New peer created peer = 0x8CED02D4 peer_handle = 0x80001107
Mar 26 07:52:12.989: ISAKMP: Locking peer struct 0x8CED02D4, refcount 1 for crypto_isakmp_process_block
Mar 26 07:52:12.989: ISAKMP: local port 500, remote port 820
Mar 26 07:52:12.989: ISAKMP: Find a dup sa in the avl tree during calling isadb_insert sa = 8D5A03B4
Mar 26 07:52:12.989: ISAKMP0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
Mar 26 07:52:12.989: ISAKMP0):Old State = IKE_READY New State = IKE_R_MM1

Mar 26 07:52:12.989: ISAKMP0): processing SA payload. message ID = 0
Mar 26 07:52:12.989: ISAKMP0): processing vendor id payload
Mar 26 07:52:12.989: ISAKMP0): vendor ID seems Unity/DPD but major 160 mismatch
Mar 26 07:52:12.989: ISAKMP0): processing vendor id payload
Mar 26 07:52:12.989: ISAKMP0): vendor ID seems Unity/DPD but major 176 mismatch
Mar 26 07:52:12.989: ISAKMP0): processing vendor id payload
Mar 26 07:52:12.989: ISAKMP0): vendor ID seems Unity/DPD but major 114 mismatch
Mar 26 07:52:12.989: ISAKMP0): processing vendor id payload
Mar 26 07:52:12.989: ISAKMP0): vendor ID seems Unity/DPD but major 157 mismatch
Mar 26 07:52:12.989: ISAKMP0): vendor ID is NAT-T v3
Mar 26 07:52:12.989: ISAKMP0): processing vendor id payload
Mar 26 07:52:12.989: ISAKMP0): vendor ID seems Unity/DPD but major 123 mismatch
Mar 26 07:52:12.989: ISAKMP0): vendor ID is NAT-T v2
Mar 26 07:52:12.989: ISAKMP0): processing vendor id payload
Mar 26 07:52:12.989: ISAKMP0): vendor ID seems Unity/DPD but major 164 mismatch
Mar 26 07:52:12.993: ISAKMP0): processing vendor id payload
Mar 26 07:52:12.993: ISAKMP0): vendor ID seems Unity/DPD but major 221 mismatch
Mar 26 07:52:12.993: ISAKMP0): processing vendor id payload
Mar 26 07:52:12.993: ISAKMP0): vendor ID seems Unity/DPD but major 215 mismatch
Mar 26 07:52:12.993: ISAKMP0): vendor ID is XAUTH
Mar 26 07:52:12.993: ISAKMP0): processing vendor id payload
Mar 26 07:52:12.993: ISAKMP0): vendor ID is DPD
Mar 26 07:52:12.993: ISAKMP0):found peer pre-shared key matching 178.25.27.36
Mar 26 07:52:12.993: ISAKMP0): local preshared key found
Mar 26 07:52:12.993: ISAKMP : Scanning profiles for xauth ... VPNclient
Mar 26 07:52:12.993: ISAKMP0): Authentication by xauth preshared
Mar 26 07:52:12.993: ISAKMP0):Checking ISAKMP transform 0 against priority 10 policy
Mar 26 07:52:12.993: ISAKMP: encryption AES-CBC
Mar 26 07:52:12.993: ISAKMP: keylength of 256
Mar 26 07:52:12.993: ISAKMP: hash SHA
Mar 26 07:52:12.993: ISAKMP: auth pre-share
Mar 26 07:52:12.993: ISAKMP: default group 2
Mar 26 07:52:12.993: ISAKMP: life type in seconds
Mar 26 07:52:12.993: ISAKMP: life duration (VPI) of 0x0 0x1 0x51 0x80
Mar 26 07:52:12.993: ISAKMP0):atts are acceptable. Next payload is 0
Mar 26 07:52:12.993: ISAKMP0):Acceptable atts:actual life: 86400
Mar 26 07:52:12.993: ISAKMP0):Acceptable atts:life: 0
Mar 26 07:52:12.993: ISAKMP0):Fill atts in sa vpi_length:4
Mar 26 07:52:12.993: ISAKMP0):Fill atts in sa life_in_seconds:86400
Mar 26 07:52:12.993: ISAKMP0):Returning Actual lifetime: 86400
Mar 26 07:52:12.993: ISAKMP0)::Started lifetime timer: 86400.

Mar 26 07:52:12.993: ISAKMP0): processing vendor id payload
Mar 26 07:52:12.993: ISAKMP0): vendor ID seems Unity/DPD but major 160 mismatch
Mar 26 07:52:12.993: ISAKMP0): processing vendor id payload
Mar 26 07:52:12.993: ISAKMP0): vendor ID seems Unity/DPD but major 176 mismatch
Mar 26 07:52:12.993: ISAKMP0): processing vendor id payload
Mar 26 07:52:12.993: ISAKMP0): vendor ID seems Unity/DPD but major 114 mismatch
Mar 26 07:52:12.993: ISAKMP0): processing vendor id payload
Mar 26 07:52:12.993: ISAKMP0): vendor ID seems Unity/DPD but major 157 mismatch
Mar 26 07:52:12.993: ISAKMP0): vendor ID is NAT-T v3
Mar 26 07:52:12.993: ISAKMP0): processing vendor id payload
Mar 26 07:52:12.993: ISAKMP0): vendor ID seems Unity/DPD but major 123 mismatch
Mar 26 07:52:12.993: ISAKMP0): vendor ID is NAT-T v2
Mar 26 07:52:12.993: ISAKMP0): processing vendor id payload
Mar 26 07:52:12.993: ISAKMP0): vendor ID seems Unity/DPD but major 164 mismatch
Mar 26 07:52:12.993: ISAKMP0): processing vendor id payload
Mar 26 07:52:12.993: ISAKMP0): vendor ID seems Unity/DPD but major 221 mismatch
Mar 26 07:52:12.993: ISAKMP0): processing vendor id payload
Mar 26 07:52:12.993: ISAKMP0): vendor ID seems Unity/DPD but major 215 mismatch
Mar 26 07:52:12.993: ISAKMP0): vendor ID is XAUTH
Mar 26 07:52:12.993: ISAKMP0): processing vendor id payload
Mar 26 07:52:12.993: ISAKMP0): vendor ID is DPD
Mar 26 07:52:12.993: ISAKMP0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
Mar 26 07:52:12.993: ISAKMP0):Old State = IKE_R_MM1 New State = IKE_R_MM1

Mar 26 07:52:12.997: ISAKMP0): constructed NAT-T vendor-03 ID
Mar 26 07:52:12.997: ISAKMP0): sending packet to 178.25.27.36 my_port 500 peer_port 820 (R) MM_SA_SETUP
Mar 26 07:52:12.997: ISAKMP0):Sending an IKE IPv4 Packet.
Mar 26 07:52:12.997: ISAKMP0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
Mar 26 07:52:12.997: ISAKMP0):Old State = IKE_R_MM1 New State = IKE_R_MM2

Mar 26 07:52:13.097: ISAKMP (0): received packet from 178.25.27.36 dport 500 sport 820 Global (R) MM_SA_SETUP
Mar 26 07:52:13.097: ISAKMP0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
Mar 26 07:52:13.097: ISAKMP0):Old State = IKE_R_MM2 New State = IKE_R_MM3

Mar 26 07:52:13.097: ISAKMP0): processing KE payload. message ID = 0
Mar 26 07:52:13.129: ISAKMP0): processing NONCE payload. message ID = 0
Mar 26 07:52:13.129: ISAKMP0):found peer pre-shared key matching 178.25.27.36
Mar 26 07:52:13.129: ISAKMP:received payload type 20
Mar 26 07:52:13.129: ISAKMP (2195): His hash no match - this node outside NAT
Mar 26 07:52:13.129: ISAKMP:received payload type 20
Mar 26 07:52:13.129: ISAKMP (2195): His hash no match - this node outside NAT
Mar 26 07:52:13.129: ISAKMP2195):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
Mar 26 07:52:13.129: ISAKMP2195):Old State = IKE_R_MM3 New State = IKE_R_MM3

Mar 26 07:52:13.133: ISAKMP2195): sending packet to 178.25.27.36 my_port 500 peer_port 820 (R) MM_KEY_EXCH
Mar 26 07:52:13.133: ISAKMP2195):Sending an IKE IPv4 Packet.
Mar 26 07:52:13.133: ISAKMP2195):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
Mar 26 07:52:13.133: ISAKMP2195):Old State = IKE_R_MM3 New State = IKE_R_MM4

Mar 26 07:52:13.237: ISAKMP (2195): received packet from 178.25.27.36 dport 4500 sport 37349 Global (R) MM_KEY_EXCH
Mar 26 07:52:13.237: ISAKMP2195):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
Mar 26 07:52:13.237: ISAKMP2195):Old State = IKE_R_MM4 New State = IKE_R_MM5

Mar 26 07:52:13.237: ISAKMP2195): processing ID payload. message ID = 0
Mar 26 07:52:13.237: ISAKMP (2195): ID payload
next-payload : 8
type : 2
FQDN name : colbs.dyndns.org
protocol : 0
port : 0
length : 24
Mar 26 07:52:13.237: ISAKMP0):: peer matches *none* of the profiles
Mar 26 07:52:13.237: ISAKMP2195): processing HASH payload. message ID = 0
Mar 26 07:52:13.237: ISAKMP2195): processing NOTIFY INITIAL_CONTACT protocol 1
spi 0, message ID = 0, sa = 0x8D5A03B4
Mar 26 07:52:13.237: ISAKMP2195):SA authentication status:
authenticated
Mar 26 07:52:13.237: ISAKMP2195):SA has been authenticated with 178.25.27.36
Mar 26 07:52:13.237: ISAKMP2195):Detected port floating to port = 37349
Mar 26 07:52:13.237: ISAKMP: Trying to find existing peer 185.40.175.228/178.25.27.36/37349/
Mar 26 07:52:13.237: ISAKMP2195):SA authentication status:
authenticated
Mar 26 07:52:13.237: ISAKMP2195): Process initial contact,
bring down existing phase 1 and 2 SA's with local 185.40.175.228 remote 178.25.27.36 remote port 37349
Mar 26 07:52:13.237: ISAKMP: Trying to insert a peer 185.40.175.228/178.25.27.36/37349/, and inserted successfully 8CED02D4.
Mar 26 07:52:13.237: ISAKMP2195):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
Mar 26 07:52:13.237: ISAKMP2195):Old State = IKE_R_MM5 New State = IKE_R_MM5

Mar 26 07:52:13.241: ISAKMP2195):SA is doing pre-shared key authentication using id type ID_IPV4_ADDR
Mar 26 07:52:13.241: ISAKMP (2195): ID payload
next-payload : 8
type : 1
address : 185.40.175.228
protocol : 17
port : 0
length : 12
Mar 26 07:52:13.241: ISAKMP2195):Total payload length: 12
Mar 26 07:52:13.241: ISAKMP2195): sending packet to 178.25.27.36 my_port 4500 peer_port 37349 (R) MM_KEY_EXCH
Mar 26 07:52:13.241: ISAKMP2195):Sending an IKE IPv4 Packet.
Mar 26 07:52:13.241: ISAKMP2195):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
Mar 26 07:52:13.241: ISAKMP2195):Old State = IKE_R_MM5 New State = IKE_P1_COMPLETE

Mar 26 07:52:13.241: ISAKMP2195):Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
Mar 26 07:52:13.241: ISAKMP2195):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE

Mar 26 07:52:13.301: ISAKMP (2195): received packet from 178.25.27.36 dport 4500 sport 37349 Global (R) QM_IDLE
Mar 26 07:52:13.301: ISAKMP: set new node -432545526 to QM_IDLE
Mar 26 07:52:13.301: ISAKMP2195): processing HASH payload. message ID = 3862421770
Mar 26 07:52:13.301: ISAKMP2195): processing DELETE payload. message ID = 3862421770
Mar 26 07:52:13.301: ISAKMP2195):peer does not do paranoid keepalives.

Mar 26 07:52:13.301: ISAKMP2195):deleting SA reason "No reason" state (R) QM_IDLE (peer 178.25.27.36)
Mar 26 07:52:13.301: ISAKMP2195):deleting node -432545526 error FALSE reason "Informational (in) state 1"
Mar 26 07:52:13.305: ISAKMP: set new node -745323587 to QM_IDLE
Mar 26 07:52:13.305: ISAKMP2195): sending packet to 178.25.27.36 my_port 4500 peer_port 37349 (R) QM_IDLE
Mar 26 07:52:13.305: ISAKMP2195):Sending an IKE IPv4 Packet.
Mar 26 07:52:13.305: ISAKMP2195):purging node -745323587
Mar 26 07:52:13.305: ISAKMP2195):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL
Mar 26 07:52:13.305: ISAKMP2195):Old State = IKE_P1_COMPLETE New State = IKE_DEST_SA

Mar 26 07:52:13.305: ISAKMP2195):deleting SA reason "No reason" state (R) QM_IDLE (peer 178.25.27.36)
Mar 26 07:52:13.305: ISAKMP: Unlocking peer struct 0x8CED02D4 for isadb_mark_sa_deleted(), count 0
Mar 26 07:52:13.305: ISAKMP: Deleting peer node by peer_reap for 178.25.27.36: 8CED02D4
Mar 26 07:52:13.305: ISAKMP2195):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
Mar 26 07:52:13.305: ISAKMP2195):Old State = IKE_DEST_SA New State = IKE_DEST_SA

Mar 26 07:52:13.309: ISAKMP (0): received packet from 178.25.27.36 dport 500 sport 820 Global (N) NEW SA
Mar 26 07:52:13.309: ISAKMP: Created a peer struct for 178.25.27.36, peer port 820
Mar 26 07:52:13.309: ISAKMP: New peer created peer = 0x8CED02D4 peer_handle = 0x80001A20
Mar 26 07:52:13.309: ISAKMP: Locking peer struct 0x8CED02D4, refcount 1 for crypto_isakmp_process_block
Mar 26 07:52:13.309: ISAKMP: local port 500, remote port 820
Mar 26 07:52:13.309: ISAKMP: Find a dup sa in the avl tree during calling isadb_insert sa = 8E6FE298
Mar 26 07:52:13.309: ISAKMP0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
Mar 26 07:52:13.309: ISAKMP0):Old State = IKE_READY New State = IKE_R_MM1

Mar 26 07:52:13.309: ISAKMP0): processing SA payload. message ID = 0
Mar 26 07:52:13.309: ISAKMP0): processing vendor id payload
Mar 26 07:52:13.309: ISAKMP0): vendor ID seems Unity/DPD but major 160 mismatch
Mar 26 07:52:13.309: ISAKMP0): processing vendor id payload
Mar 26 07:52:13.309: ISAKMP0): vendor ID seems Unity/DPD but major 176 mismatch
Mar 26 07:52:13.309: ISAKMP0): processing vendor id payload
Mar 26 07:52:13.309: ISAKMP0): vendor ID seems Unity/DPD but major 114 mismatch
Mar 26 07:52:13.309: ISAKMP0): processing vendor id payload
Mar 26 07:52:13.309: ISAKMP0): vendor ID seems Unity/DPD but major 157 mismatch
Mar 26 07:52:13.309: ISAKMP0): vendor ID is NAT-T v3
Mar 26 07:52:13.309: ISAKMP0): processing vendor id payload
Mar 26 07:52:13.309: ISAKMP0): vendor ID seems Unity/DPD but major 123 mismatch
Mar 26 07:52:13.309: ISAKMP0): vendor ID is NAT-T v2
Mar 26 07:52:13.309: ISAKMP0): processing vendor id payload
Mar 26 07:52:13.309: ISAKMP0): vendor ID seems Unity/DPD but major 164 mismatch
Mar 26 07:52:13.309: ISAKMP0): processing vendor id payload
Mar 26 07:52:13.309: ISAKMP0): vendor ID seems Unity/DPD but major 221 mismatch
Mar 26 07:52:13.309: ISAKMP0): processing vendor id payload
Mar 26 07:52:13.309: ISAKMP0): vendor ID seems Unity/DPD but major 215 mismatch
Mar 26 07:52:13.309: ISAKMP0): vendor ID is XAUTH
Mar 26 07:52:13.309: ISAKMP0): processing vendor id payload
Mar 26 07:52:13.309: ISAKMP0): vendor ID is DPD
Mar 26 07:52:13.309: ISAKMP0):found peer pre-shared key matching 178.25.27.36
Mar 26 07:52:13.309: ISAKMP0): local preshared key found
Mar 26 07:52:13.309: ISAKMP : Scanning profiles for xauth ... VPNclient
Mar 26 07:52:13.309: ISAKMP0): Authentication by xauth preshared
Mar 26 07:52:13.309: ISAKMP0):Checking ISAKMP transform 0 against priority 10 policy
Mar 26 07:52:13.309: ISAKMP: encryption AES-CBC
Mar 26 07:52:13.309: ISAKMP: keylength of 256
Mar 26 07:52:13.309: ISAKMP: hash SHA
Mar 26 07:52:13.313: ISAKMP: auth pre-share
Mar 26 07:52:13.313: ISAKMP: default group 2
Mar 26 07:52:13.313: ISAKMP: life type in seconds
Mar 26 07:52:13.313: ISAKMP: life duration (VPI) of 0x0 0x1 0x51 0x80
Mar 26 07:52:13.313: ISAKMP0):atts are acceptable. Next payload is 0
Mar 26 07:52:13.313: ISAKMP0):Acceptable atts:actual life: 86400
Mar 26 07:52:13.313: ISAKMP0):Acceptable atts:life: 0
Mar 26 07:52:13.313: ISAKMP0):Fill atts in sa vpi_length:4
Mar 26 07:52:13.313: ISAKMP0):Fill atts in sa life_in_seconds:86400
Mar 26 07:52:13.313: ISAKMP0):Returning Actual lifetime: 86400
Mar 26 07:52:13.313: ISAKMP0)::Started lifetime timer: 86400.

Moin Moin,

also ich habe es dank deiner Anleitung nun hinbekommen mit dem Dyn-IPSEC zum Bintec! Vielen Dank hierfür erst einmal!

Nun habe ich allerdings noch das lästige Telefonieproblem mit dem Cisco:

Und zwar meldet er sich bei keinem SIP-Provider mehr an.
es kommt immer nur:

Sent:
REGISTER sip:sip.easybell.de:5060 SIP/2.0
Via: SIP/2.0/UDP 185.40.175.249:5060;branch=z9hG4bK599EC
From: <sip:004936651794498@sip.easybell.de>;tag=18AD48E4-90F
To: <sip:004936651794498@sip.easybell.de>
Date: Sat, 16 Apr 2016 09:25:10 GMT
Call-ID: 1146AE00-2E011E6-8013E676-648F51FD
User-Agent: Cisco-SIPGateway/IOS-15.4.3.M4
Max-Forwards: 70
Timestamp: 1460798710
CSeq: 28 REGISTER
Contact: <sip:004936651794498@185.40.175.249:5060>
Expires: 3600
Supported: path
Content-Length: 0


Apr 16 09:25:10.469: -1/xxxxxxxxxxxx/SIP/Info/info/1024/httpish_msg_free: Freed msg=0x8D6A13B0
Apr 16 09:25:14.469:90/000000000000/SIP/Error/act_sent_register_wait_100:
act_sent_register_wait_100: Out of retries
Apr 16 09:25:14.469: -1/xxxxxxxxxxxx/SIP/Info/info/262144/sipSPIDecrementOverloadCount: Count:Local 0 Global 0
Apr 16 09:25:14.469:90/000000000000/SIP/Error/ccsip_api_register_result_ind:
Message Code Class 4xx Method Code 100 received for REGISTER
Apr 16 09:25:14.469: -1/xxxxxxxxxxxx/SIP/Info/verbose/262144/ccsipGetCCBFromRCB: Retrived CCB pointer [0x0]
Apr 16 09:25:14.469:-1/xxxxxxxxxxxx/SIP/Info/verbose/4096/ccsip_spi_register_free_rcb: Freeing rcb [0x8C7EF0FC]
Apr 16 09:25:14.469: -1/xxxxxxxxxxxx/SIP/Info/notify/262144/ccsip_register_reset_dns_cache: CCSIP_REGISTER:: registrar 0 DNS resolved addr reset
Apr 16 09:25:14.469:-1/xxxxxxxxxxxx/SIP/Error/sipDestroyContainerContext:
Corrupted/Freed Container=0x0
Apr 16 09:25:14.469: 90/000000000000/SIP/Error/ccsip_api_register_result_ind:
SIP Registration Retries Exhausted
Apr 16 09:25:14.469:90/000000000000/SIP/Info/notify/262144/sipSPIRegPthruProcessResponse: Processing response w/ resp code == 408
Apr 16 09:25:14.469: -1/xxxxxxxxxxxx/SIP/Info/verbose/262144/sipSPIGetRPCBFromRCB: Retreiving RCB [0x8D5349B0] from RPCB [0x0]
Apr 16 09:25:14.469:90/000000000000/SIP/Info/critical/262144/sipSPIRegPthruProcessResponse: Error NO RPCB


Die angezeigten Fehler habe ich schon bei google gesucht jedoch ohne erfolg!
Auf nachfrage bei meinem Sip-Provider warum der Reg nicht klappt sagte er mir: Ihr Cisco versucht sich zwar bei uns anzumelden aber beantwortet sich dann den request selbst?!

Nun bin ich wieder mal ratlos?! HILFE!
Ich habe auch versucht über Cisco etwas zu erreichen aber die leiten mich nur immer an Ihre Partner weiter, diesen habe ich schon Mails geschreiben aber keine Antwort erhalten.

Ja den kann ich sicher ausschliessen.
Habe lange mit dem Provider geprüft und gesucht und der sagte mir immer wieder nur:

Die anfrage kommt an deren Server an auch im richtigen Format, aber es sieht für ihn so aus als würde der Cisco sich selbst die antwort auf den request geben?!

Also ich habe nun alles probiert und alles ausgeschlossen. Nun wollte ich mich an den Support von Cisco wenden allerdings geht das ja nur über Partner ... habe dann auch 4 aus meinem PLZ angeschrieben und angerufen aber keiner möchte den 887 supporten?! Kennst du nen guten Cisco Fachhandel der mir da gegen Bares helfen kann?! Oder welchen Vertrag muss man abschließen damit Cisco selbst ein Auge darauf wirft?

Moin moin,

ich habe nun nach 5 Wochen hin und her, erfahren das der 887 den ich besitze keine CUBE-Funktion besitzt und somit eine VOIP-Anmeldung nicht gehen wird. Mir wurde ein neues Gerät angeboten und das Ticket geschlossen. Nun frage ich mich schon sehr ob man wirklich einen CISCO 887-CUBE besitzen muss um eine saubere VOIP-Anmeldung zu machen?!

P.s. : Wie bewerkstellige ich es das der CISCO mit 2 WANs zurecht kommt? Habe es über die metric versucht aber das klappt nicht da er mir dann immer den 1. WAN tot schaltet?! Mein Vorhaben ist Quasi das ich permanent über 2 ISPs online bin und das der CISCO sobald einer ausfällt sofort den anderen nimmt?! Ist das möglich?

Hallo,

also vielen Dank nochmal für deine Hilfe bis dato.
Der Cisco läuft mit 2 WAN Zugängen im Failover und einem Static-IPSEC tunnel zu nem Bintec. DANKE.


Eine Frage habe ich dann doch noch: Wenn ich nun über den Dialer XY zwei statische Tunnel (Mit dyn. IPs) laufen lassen möchte, was müsste ich da im CISCO konfigurieren damit das zu Schluss einwandfrei läuft?

Habe schon probiert einfach das selbe wie o.g nochmals zu konfigurieren und die namen bzw. keys zu ändern allerdings ohne gewünschten erfolg?!

UND: Wie schaffe ich es an dem fastethernet 3 einen Kabel-Deutschland Kabelanschluss via Modem zum laufen zu bringen?
Ich bekomm eine IP von Kabel/Vodafone aber kann trotz nat und route nichts pingen?!

Anbei nochmals meine jetzige Konfig: (Bitte Fehler oder Bullshit in der Config.nennen)

Building configuration...

Current configuration : 7376 bytes
!
! No configuration change since last restart
!
version 15.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Cisco887V
!
boot-start-marker
boot-end-marker
!
aqm-register-fnf
!
enable secret 5 43869684320302.
enable password 12346576
!
no aaa new-model
no process cpu extended history
no process cpu autoprofile hog
memory-size iomem 10
clock timezone CET 1 0
clock summer-time CEST recurring last Sun Mar 2:00 last Sun Oct 3:00
service-module wlan-ap 0 bootimage autonomous
!
!
!
!
!
ip dhcp binding cleanup interval 600
ip dhcp excluded-address 192.168.66.1 192.168.66.239
ip dhcp excluded-address 192.168.66.254
!
ip dhcp pool local
import all
network 192.168.66.0 255.255.255.0
default-router 192.168.66.1
dns-server 192.168.66.1
!
!
!
ip domain name media-kontor
ip name-server 8.8.8.8
ip inspect name myfw tcp
ip inspect name myfw udp
ip inspect name myfw sip
ip inspect name myfw rtsp
ip ddns update method dyndns
HTTP
add http://4387495780497409578@members.dyndns.org/nic/update?system=dyndns& ...;
interval maximum 1 0 0 0
!
ip cef
no ipv6 cef
!
!
!
!
!
multilink bundle-name authenticated
!
chat-script gsm "" "atdt*98*1#" TIMEOUT 180 "CONNECT"
!
!
!
!
!
!
license udi pid CISCO887VGW-GNE-K9 sn FCZ1608C0FW
!
!
username admin privilege 15 secret 5 12371398842693863476
username vpn1 password 7 12498230543986743986
username vpngoup password 7 2149436984363987436
!
!
!
!
!
controller VDSL 0
shutdown
!
controller Cellular 0
no cdp run
!
track 1 ip sla 1 reachability
!
ip tcp synwait-time 10
!
crypto keyring VPNMK
pre-shared-key address 0.0.0.0 0.0.0.0 key oppele1990#
!
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 2
!
crypto isakmp client configuration group vpngroup
key 11213245465
dns 192.168.66.1
domain media-kontor.com.local
pool vpnpool
save-password
max-users 5
banner ^C Willkommen im VPN von MEDIA-KONTOR ^C
crypto isakmp profile VPNclient
description VPN Client Profil
match identity group vpngroup
client authentication list clientauth
isakmp authorization list groupauth
client configuration address respond
virtual-template 2
crypto isakmp profile DynDialin
description VPNs mit dyn. IP
keyring VPNMK
match identity address 0.0.0.0
!
!
crypto ipsec transform-set myset esp-aes esp-sha-hmac
mode tunnel
!
!
crypto ipsec profile vpn-vti2
set transform-set myset
!
!
crypto dynamic-map BINTEC 10
set security-association lifetime seconds 86400
set transform-set myset
match address VPNMKDYN
!
!
crypto map VPN 1 ipsec-isakmp dynamic BINTEC
!
!
!
!
!
!
interface Ethernet0
no ip address
shutdown
!
interface FastEthernet0
no ip address
no cdp enable
!
interface FastEthernet1
no ip address
shutdown
no cdp enable
!
interface FastEthernet2
switchport access vlan 11
no ip address
no cdp enable
!
interface FastEthernet3
switchport access vlan 10
no ip address
no cdp enable
!
interface Virtual-Template2 type tunnel
description IPsec VPN Dialin
ip unnumbered Vlan1
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip nat inside
ip virtual-reassembly in
tunnel mode ipsec ipv4
tunnel protection ipsec profile vpn-vti2
!
interface wlan-ap0
description Internes Service Interface zum Management des internen WLAN APs
ip unnumbered Vlan1
no cdp enable
arp timeout 0
!
interface Wlan-GigabitEthernet0
description Internal switch interface connecting to the embedded AP
no ip address
no cdp enable
!
interface Cellular0
no ip address
ip nat outside
ip virtual-reassembly in
encapsulation ppp
dialer in-band
dialer pool-member 2
!
interface Vlan1
ip address 192.168.66.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
ip tcp adjust-mss 1452
!
interface Vlan10
no ip address
ip nat outside
ip virtual-reassembly in
pppoe enable group global
pppoe-client dial-pool-number 1
!
interface Vlan11
ip address dhcp
ip nat outside
ip access-group 111 in
ip inspect myfw out
ip virtual-reassembly in
!
interface Dialer0
ip ddns update hostname mkcisc.dyndns.org
ip ddns update dyndns
ip address negotiated
ip access-group 111 in
no ip redirects
no ip unreachables
ip mtu 1452
ip flow ingress
ip nat outside
ip inspect myfw out
ip virtual-reassembly in
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication chap callin
ppp chap hostname 2143523532
ppp chap password 0 32543863496
ppp ipcp dns request
ppp ipcp route default
no cdp enable
crypto map VPN
!
interface Dialer1
ip address negotiated
ip access-group 111 in
ip nat outside
ip inspect myfw out
ip virtual-reassembly in
encapsulation ppp
dialer pool 2
dialer idle-timeout 0
dialer string gsm
dialer persistent
ppp chap hostname tm
ppp chap password 0 tm
ppp ipcp dns request
ppp ipcp route default
no cdp enable
!
no ip forward-protocol nd
ip http server
ip http authentication local
no ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
!
ip dns server
no ip nat service sip udp port 5060
ip nat inside source route-map 3g-nat interface Dialer1 overload
ip nat inside source route-map cable-nat interface vlan 11 overload
ip nat inside source route-map adsl-nat interface Dialer0 overload
ip route 0.0.0.0 0.0.0.0 Dialer0 track 1
ip route 0.0.0.0 0.0.0.0 vlan 11 2
ip route 0.0.0.0 0.0.0.0 Dialer1 3
!
ip access-list extended VPNMKDYN
permit ip 192.168.66.0 0.0.0.255 192.168.83.0 0.0.0.255
!
ip sla auto discovery
ip sla 1
icmp-echo 8.8.8.8 source-interface Dialer0
frequency 5
ip sla schedule 1 life forever start-time now
no service-routing capabilities-manager
dialer-list 1 protocol ip list 101
!
route-map 3g-nat permit 10
match ip address 101
match interface Dialer1
!
route-map adsl-nat permit 10
match ip address 101
match interface Dialer0
!
route-map cable-nat permit 10
match ip address 101
match interface vlan 11
!
access-list 101 deny ip 192.168.66.0 0.0.0.255 192.168.83.0 0.0.0.255
access-list 101 permit ip 192.168.66.0 0.0.0.255 any
access-list 107 permit ip 192.168.66.0 0.0.0.255 192.168.83.0 0.0.0.255
access-list 111 permit icmp any any administratively-prohibited
access-list 111 permit icmp any any echo-reply
access-list 111 permit icmp any any packet-too-big
access-list 111 permit icmp any any time-exceeded
access-list 111 permit icmp any any unreachable
access-list 111 permit udp any eq domain any
access-list 111 permit tcp any eq domain any
access-list 111 permit udp any any eq isakmp
access-list 111 permit udp any any eq non500-isakmp
access-list 111 permit esp any any
access-list 111 permit udp any eq ntp any
access-list 111 permit ip host 204.13.248.111 any log-input DynDNS_perm
access-list 111 permit udp any eq bootpc any
!
control-plane
!
!
mgcp behavior rsip-range tgcp-only
mgcp behavior comedia-role none
mgcp behavior comedia-check-media-src disable
mgcp behavior comedia-sdp-force disable
!
mgcp profile default
!
!
!
!
!
alias exec zumwlanap service-module wlan-ap 0 session
banner login ^CWelcome MEDIA-KONTOR Admin^C
!
line con 0
exec-timeout 0 0
no modem enable
line aux 0
line 2
no activation-character
no exec
transport preferred none
transport input all
line 3
script dialer gsm
no exec
rxspeed 7200000
txspeed 5760000
line vty 0 4
access-class 23 in
privilege level 15
password 12453285329873
login local
transport input ssh
!
ntp server 130.149.17.8 source Dialer0
!
end

Moin, moin!

Also ich kaufe mir die Tage ne neue Brille! Habe alles richtig wie o.g. eingestellt und sofort Verbindung via Kabel!
DANKE.

Nun meine 1. Frage: Ist es normal das der Cisco887V nur 6,5 Mb/s durchlässt, wenn 100 eigentlich anliegen?(CPU bei Download mit 6,5 auf ca. 71%?!)

2. Frage: Ich habe es nun hinbekommen auf dem Dialer 0 zwei static ipsec Tunnel laufen zu lassen, beide verbinden sich auch und werden unter: show crypto session angezeigt. Allerdings bekomme ich nur durch den tunnel zu 192.168.83.0 einen ping druch?!
Zu der 192.168.36.0 geht nichts? Woran liegt das, bzw was habe ich wieder übersehen oder vergessen? (NAT? aber warum geht dann Netz 1 und Netz 2 mit selber Konfig. nicht?)

Hier die aktuelle config für die Tunnel:

crypto keyring VPNMK
pre-shared-key address 0.0.0.0 0.0.0.0 key

crypto isakmp policy 10
encr aes 256
authentication pre-share
group 2

crypto isakmp profile DynDialin
description VPNs mit dyn. IP
keyring VPNMK
match identity address 0.0.0.0


crypto ipsec transform-set myset esp-aes esp-sha-hmac
mode tunnel
!
!
crypto ipsec profile vpn-vti2
set transform-set myset
!
!
crypto dynamic-map BINTEC 10
set security-association lifetime seconds 86400
set transform-set myset
match address VPNMKDYN

crypto dynamic-map BINTEC 11
set security-association lifetime seconds 86400
set transform-set myset
match address VPNMKDYN1
!
!
crypto map VPN 1 ipsec-isakmp dynamic BINTEC

ip access-list extended VPNMKDYN
permit ip 192.168.66.0 0.0.0.255 192.168.83.0 0.0.0.255
ip access-list extended VPNMKDYN1
permit ip 192.168.66.0 0.0.0.255 192.168.36.0 0.0.0.255

access-list 100 deny ip 192.168.66.0 0.0.0.255 192.168.36.0 0.0.0.255
access-list 101 deny ip 192.168.66.0 0.0.0.255 192.168.83.0 0.0.0.255
access-list 101 permit ip 192.168.66.0 0.0.0.255 any
access-list 107 permit ip 192.168.66.0 0.0.0.255 192.168.83.0 0.0.0.255
access-list 108 permit ip 192.168.66.0 0.0.0.255 192.168.36.0 0.0.0.255
access-list 111 permit icmp any any administratively-prohibited
access-list 111 permit icmp any any echo-reply
access-list 111 permit icmp any any packet-too-big
access-list 111 permit icmp any any time-exceeded
access-list 111 permit icmp any any unreachable
access-list 111 permit udp any eq domain any
access-list 111 permit tcp any eq domain any
access-list 111 permit udp any any eq isakmp
access-list 111 permit udp any any eq non500-isakmp
access-list 111 permit esp any any
access-list 111 permit udp any eq ntp any
access-list 111 permit ip host 204.13.248.111 any log-input DynDNS_perm
access-list 111 permit udp any eq bootpc any


Crypto session current status

Interface: Dialer0
Session status: UP-ACTIVE
Peer: 146.52.233.242 port 64353
Session ID: 0
IKEv1 SA: local 79.246.213.38/4500 remote 146.52.133.242/64353 Active
IPSEC FLOW: permit ip 192.168.66.0/255.255.255.0 192.168.83.0/255.255.255.0
Active SAs: 2, origin: dynamic crypto map

Interface: Dialer0
Session status: UP-ACTIVE
Peer: 188.195.100.133 port 61213
Session ID: 0
IKEv1 SA: local 79.246.213.38/4500 remote 188.195.99.133/61213 Active
IPSEC FLOW: permit ip 192.168.66.0/255.255.255.0 192.168.36.0/255.255.255.0
Active SAs: 2, origin: dynamic crypto map