Hi,
I have PIX 515E version 7.2 and I'm trying to do the following:
Let vpn client (remote access) users to access site-to-site tunnel, inside network and internet through PIX. I can get it to tunnel either internet and not inside network and site-to-site vpn or inside and site-to-site but not internet. I'm stuck with this one.
Site-to-site vpn works fine for normal users and so does everything else. And for remote access users I can get it work like it did so that internet traffic is splitted out and other is tunneled and they can get into site-to-site tunnel also. But i need to get the internet traffic tunneled also.
I don't understand what's the problem. We have just upgraded the firmware from 6.3 to 7.2 to get this work and new syntax is also blurring me a bit.
Here's my stripped configuration (if I use vpnpool I can get to tunnels and inside network, if I use vpnpool2 I can only tunnel internet traffic from vpn client):
PIX Version 7.2(4)
!
hostname xxx
domain-name xxx.com
enable password xxx encrypted
passwd xxx encrypted
names
---
dns-guard
!
interface Ethernet0
nameif outside
security-level 0
ip address xxx.xx.xxx.xxx 255.255.255.240
!
interface Ethernet1
speed 100
duplex full
nameif inside
security-level 100
ip address 192.168.15.32 255.255.255.0
!
interface Ethernet2
speed 100
duplex full
nameif extranet
security-level 60
ip address 192.168.18.1 255.255.255.0
!
ftp mode passive
clock timezone EEST 2
clock summer-time EEDT recurring last Sun Mar 3:00 last Sun Oct 4:00
dns server-group DefaultDNS
domain-name xxx.com
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object-group service SSL tcp
port-object range https https
access-list nonat-inside extended permit ip 192.168.0.0 255.255.0.0 192.168.0.0 255.255.0.0
access-list nonat-extranet extended permit ip 192.168.0.0 255.255.0.0 192.168.0.0 255.255.0.0
-----
access-list inside extended permit ip any any
access-list netti ---
access-list unkari3-vpn extended permit ip 192.168.12.0 255.255.255.0 192.168.21.0 255.255.255.0
access-list unkari3-vpn extended permit ip 192.168.13.0 255.255.255.0 192.168.21.0 255.255.255.0
access-list unkari3-vpn extended permit ip 192.168.14.0 255.255.255.0 192.168.21.0 255.255.255.0
access-list unkari3-vpn extended permit ip 192.168.15.0 255.255.255.0 192.168.21.0 255.255.255.0
access-list unkari3-vpn extended permit ip 192.168.16.0 255.255.255.0 192.168.21.0 255.255.255.0
access-list unkari3-vpn extended permit ip 192.168.17.0 255.255.255.0 192.168.21.0 255.255.255.0
access-list unkari3-vpn extended permit ip 192.168.18.0 255.255.255.0 192.168.21.0 255.255.255.0
access-list unkari3-vpn extended permit ip 192.168.19.0 255.255.255.0 192.168.21.0 255.255.255.0
access-list splitti extended permit ip 192.168.21.0 255.255.255.0 192.168.15.0 255.255.255.0
access-list splitti extended permit ip 192.168.19.0 255.255.255.0 192.168.15.0 255.255.255.0
access-list splitti extended permit ip 192.168.17.0 255.255.255.0 192.168.15.0 255.255.255.0
access-list splitti extended permit ip 192.168.16.0 255.255.255.0 192.168.15.0 255.255.255.0
access-list splitti extended permit ip 192.168.15.0 255.255.255.0 192.168.15.0 255.255.255.0
access-list splitti extended permit ip 192.168.13.0 255.255.255.0 192.168.15.0 255.255.255.0
access-list splitti extended permit ip 192.168.12.0 255.255.255.0 192.168.15.0 255.255.255.0
pager lines 25
logging enable
logging buffered warnings
mtu outside 1500
mtu inside 1500
mtu extranet 1500
ip local pool vpnpool 192.168.15.230-192.168.15.
239
ip local pool vpnpool2 192.168.19.230-192.168.19.
239
icmp unreachable rate-limit 1 burst-size 1
asdm history enable
arp timeout 14400
nat-control
global (outside) 130 interface
nat (outside) 130 192.168.19.0 255.255.255.0
nat (inside) 0 access-list nonat-inside
nat (inside) 130 192.168.0.0 255.255.0.0
nat (inside) 0 0.0.0.0 0.0.0.0
nat (extranet) 0 access-list nonat-extranet
static (inside,outside) ..
---
access-group netti in interface outside
access-group inside in interface inside
route outside 0.0.0.0 0.0.0.0 xx.xx.xx.xx 1
route inside 192.168.12.0 255.255.255.0 192.168.15.1 1
route inside 192.168.13.0 255.255.255.0 192.168.15.1 1
route inside 192.168.14.0 255.255.255.0 192.168.15.1 1
route inside 192.168.16.0 255.255.255.0 192.168.15.1 1
route inside 192.168.17.0 255.255.255.0 192.168.15.1 1
route inside 192.168.23.0 255.255.255.0 192.168.15.1 1
route inside 192.168.19.0 255.255.255.0 192.168.15.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
--
crypto ipsec transform-set myset esp-3des esp-md5-hmac
crypto dynamic-map dynmap 10 set transform-set myset
crypto map mnova 10 ipsec-isakmp dynamic dynmap
crypto map mnova 25 match address unkari3-vpn
crypto map mnova 25 set peer "PIX506E"-->with name
crypto map mnova 25 set transform-set myset
crypto map mnova interface outside
crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 1800
crypto isakmp policy 30
authentication pre-share
encryption des
hash md5
group 1
lifetime 28800
crypto isakmp policy 50
authentication pre-share
encryption aes
hash md5
group 2
lifetime 7200
crypto isakmp policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp nat-traversal 20
crypto isakmp ipsec-over-tcp port 10000
telnet timeout 15
console timeout 0
group-policy test internal
group-policy test attributes
wins-server value 192.168.15.xx
dns-server value 192.168.15.xx xxx.xx.xx.xx
ipsec-udp enable
ipsec-udp-port 10000
split-tunnel-policy tunnelall
default-domain value xxx.com
address-pools value vpnpool2
tunnel-group DefaultL2LGroup ipsec-attributes
isakmp keepalive threshold 40 retry 2
tunnel-group DefaultRAGroup ipsec-attributes
isakmp keepalive threshold 40 retry 2
tunnel-group xx.xx.xx.xx (<--this is the pix 506E's outer IP) type ipsec-l2l
tunnel-group xx.xx.xx.xx ipsec-attributes
pre-shared-key *
tunnel-group test type ipsec-ra
tunnel-group test general-attributes
address-pool vpnpool2
default-group-policy test
tunnel-group test ipsec-attributes
pre-shared-key *
isakmp ikev1-user-authentication none
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns migrated_dns_map_1
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns migrated_dns_map_1
inspect ftp
inspect h323 h225
inspect h323 ras
inspect http
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:4d4fad0f694
9d0a1c81cf
6049459faf
a
Start Free Trial
