Advertisement

06.04.2008 at 10:22AM PDT, ID: 23457548
[x]
Attachment Details

Need VPN Client to Access the DMZ

Asked by sdesmarais in Cisco PIX Firewall, IPSec Security Protocol

Tags: Cisco, pix, 515E

Hi to all experts
Hardware Cisco Pix 515E
Need to allow vpn clients (cliengt version 4.0.5C) to access my DMZ machines. Interface names are standard inside, outside, DMZ .
Inside Subnet - 192.168.1.0
DMZ Subnet - 192.168.10.0
VPN IP Pool = 192.168.200.0
I have tried this solution,bout it did not work.
http://www.experts-exchange.com/Security/Software_Firewalls/Enterprise_Firewalls/Cisco_PIX_Firewall/Q_23232827.html
I am using PDM UI.
Here is my config:
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz1 security4
enable password xxxxxxxxxxxxxxxx encrypted
passwd xxxxxxxxxxxxxxxxx encrypted
hostname PIX
domain-name xxxxx.com
clock timezone EST -5
clock summer-time EDT recurring
fixup protocol dns maximum-length 1280
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 192.168.10.26 SRV-NS3-DMZ
name 192.168.1.14 SRV-SQL2
name 192.168.1.15 SRV-BCK1
name 192.168.1.5 SRV-SQL1
name 192.168.1.31 SRV-EXCH2
name 192.168.1.24 SRV-DC3
name 192.168.10.24 BARRACUDA
name 192.168.1.71 XEROX
name 192.168.1.16 SRV-APACH1
name 192.168.10.56 SRV-SQL3-DMZ
name 192.168.10.55 SRV-NS2-DMZ
name 192.168.1.9 srv-sql4
name 192.168.1.3 SRV-DC2
name 192.168.1.2 SRV-DC1
name 192.168.10.30 SRV-NS5-DMZ
access-list acl_outbound permit udp any any
access-list outside deny ip 0.0.0.0 255.0.0.0 any
access-list outside deny ip 10.0.0.0 255.0.0.0 any
access-list outside deny ip 127.0.0.0 255.0.0.0 any
access-list outside deny ip 172.16.0.0 255.240.0.0 any
access-list outside deny ip 169.254.0.0 255.255.0.0 any
access-list outside deny ip 192.0.2.0 255.255.255.0 any log 4
access-list outside permit ip 192.168.200.0 255.255.255.0 any log
access-list outside permit icmp 192.168.200.0 255.255.255.0 any log
access-list outside deny ip 192.168.0.0 255.255.0.0 any
access-list outside deny ip 224.0.0.0 224.0.0.0 any
access-list outside permit icmp any any time-exceeded
access-list outside permit icmp any any echo-reply
access-list outside permit tcp any host xxx.254.226.34 eq smtp
access-list outside permit tcp any host xxx.254.226.34 eq https
access-list outside permit tcp any host xxx.254.226.35 eq https
access-list outside permit tcp any host xxx.254.226.35 eq www
access-list outside permit tcp any host xxx.254.226.34 eq www
access-list outside permit tcp any host xxx.254.226.34 eq ftp
access-list outside permit tcp any host xxx.254.226.34 eq ftp-data
access-list outside permit tcp any host xxx.254.226.38 eq smtp
access-list outside permit tcp any host xxx.254.226.38 eq domain
access-list outside permit udp any host xxx.254.226.38 eq domain
access-list inside deny ip any 0.0.0.0 255.0.0.0
access-list inside deny ip any 10.0.0.0 255.0.0.0
access-list inside deny ip any 127.0.0.0 255.0.0.0
access-list inside deny ip any 169.254.0.0 255.255.0.0
access-list inside deny ip any 192.0.2.0 255.255.255.0
access-list inside deny ip any 224.0.0.0 224.0.0.0
access-list inside permit icmp 192.168.1.0 255.255.255.0 any
access-list inside permit ip 192.168.1.0 255.255.255.0 192.168.200.0 255.255.255.0
access-list inside permit ip 192.168.1.0 255.255.255.0 192.168.10.0 255.255.255.0
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq www
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq https
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 3389
access-list inside permit udp 192.168.1.0 255.255.255.0 any eq isakmp
access-list inside permit udp 192.168.1.0 255.255.255.0 any eq 4500
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 5900
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 5000
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 3724
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 11999
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 43594
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 43595
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 17185
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 8080
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 8003
access-list inside permit udp 192.168.1.0 255.255.255.0 any eq 2300
access-list inside permit udp 192.168.1.0 255.255.255.0 any eq 2301
access-list inside permit udp 192.168.1.0 255.255.255.0 any eq 6073
access-list inside permit udp 192.168.1.0 255.255.255.0 any eq 1863
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 1863
access-list inside permit udp 192.168.1.0 255.255.255.0 any eq 5190
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 6891
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 6892
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 6893
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 6894
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 6895
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 6896
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 6897
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 6898
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 6899
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 6900
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 3101
access-list inside permit udp 192.168.1.0 255.255.255.0 any eq 6901
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 6901
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq nntp
access-list inside permit udp 192.168.1.0 255.255.255.0 any eq 64520
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 28800
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 28801
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 28802
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 28803
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 28804
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 28805
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 9009
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq ftp
access-list inside permit udp 192.168.1.0 255.255.255.0 host 66.46.213.82 eq 5060
access-list inside permit udp 192.168.1.0 255.255.255.0 host 66.46.213.82 eq 5080
access-list inside permit udp 192.168.1.0 255.255.255.0 host 66.46.213.84 eq 5060
access-list inside permit udp 192.168.1.0 255.255.255.0 host 66.46.213.86 eq 5060
access-list inside permit udp host SRV-DC1 any eq domain
access-list inside permit tcp host SRV-DC1 any eq domain
access-list inside permit udp host SRV-DC1 any eq ntp
access-list inside permit tcp host SRV-DC2 any eq 123
access-list inside permit tcp host SRV-EXCH2 host SRV-NS3-DMZ eq smtp
access-list inside permit tcp host XEROX host SRV-NS3-DMZ eq smtp
access-list inside permit udp host SRV-DC2 any eq domain
access-list inside permit tcp host SRV-DC2 any eq domain
access-list inside permit udp host SRV-DC2 any eq ntp
access-list inside permit tcp 192.168.200.0 255.255.255.0 any
access-list dmz1 deny ip any 0.0.0.0 255.0.0.0
access-list dmz1 deny ip any 10.0.0.0 255.0.0.0
access-list dmz1 deny ip any 127.0.0.0 255.0.0.0
access-list dmz1 deny ip any 172.16.0.0 255.240.0.0
access-list dmz1 deny ip any 169.254.0.0 255.255.0.0
access-list dmz1 deny ip any 192.168.0.0 255.255.255.0
access-list dmz1 deny ip any 224.0.0.0 224.0.0.0
access-list dmz1 permit tcp 192.168.10.0 255.255.255.0 any eq www
access-list dmz1 permit tcp 192.168.10.0 255.255.255.0 any eq https
access-list dmz1 permit tcp 192.168.10.0 255.255.255.0 host SRV-DC1 eq 1025
access-list dmz1 permit udp 192.168.10.0 255.255.255.0 host SRV-DC1 eq domain
access-list dmz1 permit tcp 192.168.10.0 255.255.255.0 host SRV-DC1 eq domain
access-list dmz1 permit tcp 192.168.10.0 255.255.255.0 host SRV-DC1 eq ldap
access-list dmz1 permit udp 192.168.10.0 255.255.255.0 host SRV-DC1 eq 389
access-list dmz1 permit tcp 192.168.10.0 255.255.255.0 host SRV-DC1 eq 135
access-list dmz1 permit tcp 192.168.10.0 255.255.255.0 host SRV-DC1 eq 445
access-list dmz1 permit udp 192.168.10.0 255.255.255.0 host SRV-DC1 eq netbios-dgm
access-list dmz1 permit tcp 192.168.10.0 255.255.255.0 host SRV-DC2 eq 1025
access-list dmz1 permit udp 192.168.10.0 255.255.255.0 host SRV-DC2 eq domain
access-list dmz1 permit tcp 192.168.10.0 255.255.255.0 host SRV-DC2 eq domain
access-list dmz1 permit udp 192.168.10.0 255.255.255.0 host SRV-DC1 eq ntp
access-list dmz1 permit udp 192.168.10.0 255.255.255.0 host SRV-DC2 eq ntp
access-list dmz1 permit icmp any 192.168.0.0 255.255.0.0 time-exceeded
access-list dmz1 permit icmp any 192.168.0.0 255.255.0.0 echo-reply
access-list dmz1 permit icmp host SRV-NS5-DMZ host SRV-DC1 echo
access-list dmz1 permit icmp host SRV-NS2-DMZ host SRV-DC1 echo
access-list dmz1 permit icmp host SRV-NS3-DMZ host SRV-DC1 echo
access-list dmz1 permit icmp host SRV-SQL3-DMZ host SRV-DC1 echo
access-list dmz1 permit icmp host SRV-NS5-DMZ host SRV-DC2 echo
access-list dmz1 permit icmp host SRV-NS2-DMZ host SRV-DC2 echo
access-list dmz1 permit icmp host SRV-NS3-DMZ host SRV-DC2 echo
access-list dmz1 permit icmp host SRV-SQL3-DMZ host SRV-DC2 echo
access-list dmz1 permit tcp host SRV-NS3-DMZ any eq smtp
access-list dmz1 permit tcp host BARRACUDA any eq smtp
access-list dmz1 permit udp host SRV-NS5-DMZ host SRV-DC1 eq 389
access-list dmz1 permit udp host SRV-NS2-DMZ host SRV-DC1 eq 389
access-list dmz1 permit udp host SRV-NS3-DMZ host SRV-DC1 eq 389
access-list dmz1 permit udp host SRV-SQL3-DMZ host SRV-DC1 eq 389
access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-DC1 eq ldap
access-list dmz1 permit tcp host SRV-NS2-DMZ host SRV-DC1 eq ldap
access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC1 eq ldap
access-list dmz1 permit tcp host SRV-SQL3-DMZ host SRV-DC1 eq ldap
access-list dmz1 permit udp host SRV-NS5-DMZ host SRV-DC1 eq 88
access-list dmz1 permit udp host SRV-NS2-DMZ host SRV-DC1 eq 88
access-list dmz1 permit udp host SRV-NS3-DMZ host SRV-DC1 eq 88
access-list dmz1 permit udp host SRV-SQL3-DMZ host SRV-DC1 eq 88
access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-DC1 eq 88
access-list dmz1 permit tcp host SRV-NS2-DMZ host SRV-DC1 eq 88
access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC1 eq 88
access-list dmz1 permit tcp host SRV-SQL3-DMZ host SRV-DC1 eq 88
access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC1 eq 135
access-list dmz1 permit tcp host SRV-NS2-DMZ host SRV-DC1 eq 135
access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-DC1 eq 135
access-list dmz1 permit tcp host SRV-SQL3-DMZ host SRV-DC1 eq 135
access-list dmz1 permit udp host SRV-SQL3-DMZ host SRV-DC1 eq 135
access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-DC1 eq 137
access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC1 eq 137
access-list dmz1 permit tcp host SRV-NS2-DMZ host SRV-DC1 eq 445
access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC1 eq 445
access-list dmz1 permit tcp host SRV-SQL3-DMZ host SRV-DC1 eq 445
access-list dmz1 permit tcp host SRV-NS2-DMZ host SRV-DC1 eq 1212
access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC1 eq 1212
access-list dmz1 permit tcp host SRV-SQL3-DMZ host SRV-DC1 eq 1212
access-list dmz1 permit tcp host SRV-NS2-DMZ host SRV-DC1 eq 3268
access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC1 eq 3268
access-list dmz1 permit tcp host SRV-SQL3-DMZ host SRV-DC1 eq 3268
access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-EXCH2 eq 691
access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-SQL2 eq 1433
access-list dmz1 permit tcp host SRV-NS5-DMZ host srv-sql4 eq 1433
access-list dmz1 permit tcp host SRV-NS5-DMZ host srv-sql4 eq 6112
access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-SQL2 eq 6112
access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-SQL1 eq 1433
access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-SQL1 eq 6112
access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-BCK1 range 10000 10020
access-list dmz1 permit tcp host SRV-NS2-DMZ host SRV-BCK1 range 10000 10020
access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-BCK1 range 10000 10020
access-list dmz1 permit tcp host SRV-SQL3-DMZ host SRV-BCK1 range 10000 10020
access-list dmz1 permit udp host SRV-NS5-DMZ host SRV-DC2 eq 389
access-list dmz1 permit udp host SRV-NS2-DMZ host SRV-DC2 eq 389
access-list dmz1 permit udp host SRV-NS3-DMZ host SRV-DC2 eq 389
access-list dmz1 permit udp host SRV-SQL3-DMZ host SRV-DC2 eq 389
access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-DC2 eq ldap
access-list dmz1 permit tcp host SRV-NS2-DMZ host SRV-DC2 eq ldap
access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC2 eq ldap
access-list dmz1 permit tcp host SRV-SQL3-DMZ host SRV-DC2 eq ldap
access-list dmz1 permit udp host SRV-NS5-DMZ host SRV-DC2 eq 88
access-list dmz1 permit udp host SRV-NS2-DMZ host SRV-DC2 eq 88
access-list dmz1 permit udp host SRV-NS3-DMZ host SRV-DC2 eq 88
access-list dmz1 permit udp host SRV-SQL3-DMZ host SRV-DC2 eq 88
access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-DC2 eq 88
access-list dmz1 permit tcp host SRV-NS2-DMZ host SRV-DC2 eq 88
access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC2 eq 88
access-list dmz1 permit tcp host SRV-SQL3-DMZ host SRV-DC2 eq 88
access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC2 eq 135
access-list dmz1 permit tcp host SRV-NS2-DMZ host SRV-DC2 eq 135
access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-DC2 eq 135
access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC2 eq 445
access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC2 eq 1212
access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC2 eq 3268
access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-DC1 eq 8000
access-list dmz1 permit tcp host SRV-NS2-DMZ host SRV-DC1 eq 8000
access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC1 eq 8000
access-list dmz1 permit tcp host SRV-SQL3-DMZ host SRV-DC1 eq 8000
access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-DC1 eq domain
access-list dmz1 permit udp host SRV-NS5-DMZ host SRV-DC1 eq domain
access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-DC2 eq https
access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-DC2 eq domain
access-list dmz1 permit udp host SRV-NS5-DMZ host SRV-DC2 eq domain
access-list dmz1 permit tcp host SRV-NS2-DMZ host SRV-DC2 eq https
access-list dmz1 permit tcp host SRV-NS2-DMZ range 27000 27009 host SRV-DC2 range 27000 27009
access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC2 eq https
access-list dmz1 permit tcp host SRV-SQL3-DMZ host SRV-DC2 eq https
access-list dmz1 permit tcp host BARRACUDA host SRV-DC1 eq ldap
access-list dmz1 permit tcp host BARRACUDA host SRV-DC2 eq ldap
access-list vpnclientacl permit ip any 192.168.200.0 255.255.255.0
pager lines 24
logging on
logging timestamp
logging monitor warnings
logging buffered debugging
logging trap warnings
logging history debugging
logging host inside SRV-DC1
logging host inside SRV-DC2
icmp deny any outside
mtu outside 1500
mtu inside 1500
mtu dmz1 1500
ip address outside xxx.254.226.37 255.255.255.248
ip address inside 192.168.1.1 255.255.255.0
ip address dmz1 192.168.10.1 255.255.255.0
ip audit info action reset
ip audit attack action reset
ip local pool vpnclientip 192.168.200.64-192.168.200.127
pdm location xxx.46.213.82 255.255.255.255 outside
pdm location xxx.46.213.84 255.255.255.255 outside
pdm location xxx.46.213.86 255.255.255.255 outside
pdm location SRV-SQL1 255.255.255.255 inside
pdm location SRV-SQL2 255.255.255.255 inside
pdm location SRV-BCK1 255.255.255.255 inside
pdm location SRV-APACH1 255.255.255.255 inside
pdm location SRV-DC3 255.255.255.255 inside
pdm location SRV-EXCH2 255.255.255.255 inside
pdm location 192.168.1.121 255.255.255.255 inside
pdm location BARRACUDA 255.255.255.255 inside
pdm location 192.168.10.0 255.255.255.0 inside
pdm location 192.168.0.0 255.255.0.0 inside
pdm location SRV-NS3-DMZ 255.255.255.255 dmz1
pdm location 0.0.0.0 255.0.0.0 outside
pdm location 10.0.0.0 255.0.0.0 outside
pdm location xxx.95.179.130 255.255.255.255 outside
pdm location 127.0.0.0 255.0.0.0 outside
pdm location xxx.254.0.0 255.255.0.0 outside
pdm location xxx.16.0.0 255.240.0.0 outside
pdm location BARRACUDA 255.255.255.255 outside
pdm location 192.168.200.0 255.255.255.0 outside
pdm location 192.168.0.0 255.255.0.0 outside
pdm location 224.0.0.0 224.0.0.0 outside
pdm location BARRACUDA 255.255.255.255 dmz1
pdm location XEROX 255.255.255.255 inside
pdm location 192.168.0.0 255.255.255.0 inside
pdm location 192.0.2.0 255.255.255.0 outside
pdm location SRV-NS2-DMZ 255.255.255.255 dmz1
pdm location SRV-SQL3-DMZ 255.255.255.255 dmz1
pdm location xx.200.240.249 255.255.255.255 outside
pdm location xx.200.240.248 255.255.255.255 outside
pdm location SRV-APACH1 255.255.255.255 dmz1
pdm location srv-sql4 255.255.255.255 inside
pdm location SRV-DC2 255.255.255.255 inside
pdm location SRV-DC1 255.255.255.255 inside
pdm location 192.168.10.25 255.255.255.255 dmz1
pdm location SRV-NS5-DMZ 255.255.255.255 dmz1
pdm location 192.168.10.50 255.255.255.255 dmz1
pdm location 192.168.200.0 255.255.255.0 inside
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list vpnclientacl
nat (inside) 1 192.168.1.0 255.255.255.0 0 0
nat (inside) 1 192.168.200.0 255.255.255.0 0 0
nat (dmz1) 1 192.168.10.0 255.255.255.0 0 0
static (dmz1,outside) tcp xxx.254.226.34 https SRV-NS3-DMZ https netmask 255.255.255.255 500 50
static (dmz1,outside) tcp xxx.254.226.34 smtp BARRACUDA smtp netmask 255.255.255.255 500 50
static (dmz1,outside) tcp xxx.254.226.34 ftp SRV-NS5-DMZ ftp netmask 255.255.255.255 0 0
static (dmz1,outside) tcp xxx.254.226.34 ftp-data SRV-NS5-DMZ ftp-data netmask 255.255.255.255 0 0
static (dmz1,outside) tcp xxx.254.226.34 www SRV-NS5-DMZ www netmask 255.255.255.255 0 0
static (dmz1,outside) tcp xxx.254.226.35 https SRV-NS2-DMZ https netmask 255.255.255.255 0 0
static (dmz1,outside) tcp xxx.254.226.35 www SRV-NS2-DMZ www netmask 255.255.255.255 0 0
static (inside,dmz1) 192.168.0.0 192.168.0.0 netmask 255.255.0.0 500 50
access-group outside in interface outside
access-group inside in interface inside
access-group dmz1 in interface dmz1
route outside 0.0.0.0 0.0.0.0 xx.254.226.33 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server RADIUS (inside) host SRV-DC2 fkP8cd43 timeout 5
aaa-server RADIUS (inside) host SRV-DC1 fkP8cd43 timeout 5
aaa-server LOCAL protocol local
ntp server SRV-DC1 source inside prefer
http server enable
http SRV-BCK1 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community xin9rax
no snmp-server enable traps
floodguard enable
service resetinbound
service resetoutside
crypto ipsec transform-set vpnclientset esp-3des esp-sha-hmac
crypto dynamic-map dyn-vpn 30 set transform-set vpnclientset
crypto map pixmap 30 ipsec-isakmp dynamic dyn-vpn
crypto map pixmap client authentication RADIUS
crypto map pixmap interface outside
isakmp enable outside
isakmp nat-traversal 20
isakmp policy 30 authentication pre-share
isakmp policy 30 encryption 3des
isakmp policy 30 hash md5
isakmp policy 30 group 2
isakmp policy 30 lifetime 86400
vpngroup vpnrad1 address-pool vpnclientip
vpngroup vpnrad1 dns-server SRV-DC1 SRV-DC2
vpngroup vpnrad1 wins-server SRV-DC1 SRV-DC2
vpngroup vpnrad1 default-domain xxxxx.com
vpngroup vpnrad1 idle-time 28800
vpngroup vpnrad1 max-time 28800
vpngroup vpnrad1 password xxxxxxxxx
telnet SRV-BCK1 255.255.255.255 inside
telnet timeout 30
ssh SRV-BCK1 255.255.255.255 inside
ssh timeout 20
console timeout 0
terminal width 80
Cryptochecksum:xxxxxxxxxxxxxxxxxxxxxx
: end



ThanksStart Free Trial
[+][-]06.04.2008 at 08:32PM PDT, ID: 21716192

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]06.04.2008 at 09:09PM PDT, ID: 21716311

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]06.05.2008 at 12:03AM PDT, ID: 21716910

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]06.05.2008 at 05:17AM PDT, ID: 21718441

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]06.05.2008 at 07:48AM PDT, ID: 21720107

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]06.05.2008 at 08:01AM PDT, ID: 21720313

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]06.05.2008 at 06:43PM PDT, ID: 21725598

View this solution now by starting your 7-day free trial. Setting up your free trial is quick, easy, and secure. We will return you to this solution, unlocked, when you're done.

 

About this solution

Zones: Cisco PIX Firewall, IPSec Security Protocol
Tags: Cisco, pix, 515E
Sign Up Now!
Solution Provided By: batry_boy
Participating Experts: 1
Solution Grade: A
 
 
[+][-]06.11.2008 at 11:13AM PDT, ID: 21762679

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]06.13.2008 at 06:31PM PDT, ID: 21783683

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]06.13.2008 at 06:40PM PDT, ID: 21783703

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
 
Loading Advertisement...
20080716-EE-VQP-32 / EE_QW_2_20070628