the Video Camera server is listening on 80, 4050, 5550, and 55502
the public IP of the destination PIX where the VideoCamera server is behind of is 67.203.xxx.xxx
Main Topics
Browse All TopicsI have two sites, both on PIX 506 and VPN configured. I also have a video camera software that needs to connect to the remote IP host so I can view the images thru VPN. Everything works fine when I'm not at my primary site behind that PIX. When I go somewhere else, VPN connects fine, I launch the application, enter the IP (192.168.100.99) and am able to logon and all is OK. But when I'm behind the PIX in the office VPN connects fine but the application says it can't connect to the server, so since everything works fine outside the PIX office network there must be some misconfiguratin on the PIX. I have attached the sanitzed PIX config below
Please advise
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
I would setup a syslog server and the PIX to strem out syslog data. If the PIX is dropping the packets for any reason, the syslog will have a record of it.
Here's the cisco how to on the syslog, its very easy to setup.
http://www.cisco.com/en/US
There are plenty of free syslog servers.... try kiwi http://www.kiwisyslog.com/
The pix may either be dropping this from an ACL or even from one of the fixups. The syslog should help.
As a test, you can also remove the fixups from the pix config during troubleshooting to see if that's the cause.
thank you for all your help, I configured the syslog and it pointed me to the problem with protocol 50 being blocked so I also searched EE and found this post http://www.experts-exchang
access-list 101 permit esp any interface outside
access-group 101 in interface outside
That did the trick
Thank you!!!
One more follow up questions,
I forgot to say it also needs fixup protocol esp-ike
I tested it at home with no VPN configured on the PIX. One of the sites however has VPN configured and I can't enable fixup prtoocol esp-ike because one f the interfaces has IKE enabled, once I disabled it temporarrily it works. Is there a work around it?
Thank you
sorry for that
added: access-list outside_access_in permit esp any interface outside
and tried adding
fixup protocol esp-ike
but it wouldn't let me as there is VPN configured on this PIX and PDM said that I need to disabled IKE on the outside interface, so I went to Configuration -> VPN -> IKE -> Policies and disabled IKE for the outside interface, but that breaks our site to site VPN but allows to to connect to the remote app
so I wonder what is the way around this to have fixup protocol esp-ike turned on and IKE enabled on outside interface
full config attached
Thank you
The third line here is not needed and is never used becaus line 2 is there...
access-list inside_access_in permit icmp any any
access-list inside_access_in permit ip any any
access-list inside_access_in permit ip 172.1.2.0 255.255.255.0 xxxxxxxx 255.255.255.0
Just remove it by using.....
no access-list inside_access_in permit ip 172.1.2.0 255.255.255.0 xxxxxxxx 255.255.255.0
Also see your other thread.
This URL will help you if its LAN to LAN VPN you are trying to use.
http://www.cisco.com/en/US
This URL on the other hand will help you if its remote access VPN Client software you are using.
http://www.cisco.com/en/US
Business Accounts
Answer for Membership
by: MikeKanePosted on 2009-10-06 at 11:48:01ID: 25508386
What protocol or port are you connecting to on the outside from inside this pix?
Also, what ip are you connecting to... if its public, just give me the 1st octet.