I have been attempting to set up IPSec on my PIX. I have the config to the point where I can connect to my PIX through my Cisco VPN Client. Once I connect I can not reach any of the servers inside my PIX. I'm not sure what I am missing or have misconfigured.
User Access Verification
Password:
Password:
Type help or '?' for a list of available commands.
helm-pix01config> enable
Password: *****
helm-pix01config# show conf
: Saved
: Written by enable_15 at 11:15:40.200 UTC Tue Oct 3 2006
PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
interface ethernet1 vlan2 logical
interface ethernet1 vlan3 logical
interface ethernet1 vlan4 logical
interface ethernet1 vlan5 logical
interface ethernet1 vlan6 logical
interface ethernet1 vlan7 logical
interface ethernet1 vlan8 logical
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif vlan2 intf2 security99
nameif vlan3 intf3 security99
nameif vlan4 intf4 security99
nameif vlan5 intf5 security99
nameif vlan6 intf6 security99
nameif vlan7 intf7 security99
nameif vlan8 intf8 security99
enable password oooiaMGBnEVQBlXY encrypted
passwd oooiaMGBnEVQBlXY encrypted
hostname mypix01
domain-name none
fixup protocol dns maximum-length 1024
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol pptp 1723
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 66.45.1.87 www
name 66.45.1.88 h1app
name 66.45.1.91 h1app-test
name 66.45.1.90 h1app-db
name 63.204.158.135 lana
name 63.204.158.131 rachel
name 66.179.234.114 vit1-db
name 66.179.234.113 vit1-app
name 66.179.234.115 sbk1-app
name 66.179.234.116 sbk1-db
name 66.45.1.93 sales01
name 66.45.1.94 hQA
name 66.179.234.117 CServ1s-app
name 66.179.234.118 CServ1s-db
name 66.45.1.92 stage01
name 66.45.1.89 pgihc-app
name 66.179.143.225 sbux-stage
name 66.179.143.226 instill-sales
name 66.179.143.227 csc-stage
name 63.224.134.121 jude
name 66.45.1.86 BrokerNet
name 66.179.143.228 Otis-app
name 66.179.143.229 Otis-db
name 67.90.66.10 helmoffice
name 69.48.213.4 otisstage
name 69.48.213.7 dcbstage01
name 66.179.143.230 vitstage01
name 69.48.213.6 CServ1-SAP
object-group network Inflow
description Servers @ Inflow
network-object www 255.255.255.255
network-object h1app 255.255.255.255
network-object pgihc-app 255.255.255.255
network-object h1app-db 255.255.255.255
network-object h1app-test 255.255.255.255
network-object stage01 255.255.255.255
network-object sales01 255.255.255.255
network-object hQA 255.255.255.255
network-object vit1-app 255.255.255.255
network-object vit1-db 255.255.255.255
network-object sbk1-app 255.255.255.255
network-object sbk1-db 255.255.255.255
network-object sbux-stage 255.255.255.255
network-object csc-stage 255.255.255.255
network-object Otis-app 255.255.255.255
network-object Otis-db 255.255.255.255
network-object otisstage 255.255.255.255
network-object dcbstage01 255.255.255.255
network-object vitstage01 255.255.255.255
network-object CServ1-SAP 255.255.255.255
object-group network VPN-Access
network-object 192.168.1.0 255.255.255.0
network-object 192.168.2.0 255.255.255.0
network-object 192.168.3.0 255.255.255.0
network-object 192.168.4.0 255.255.255.0
network-object 192.168.5.0 255.255.255.0
network-object 192.168.6.0 255.255.255.0
network-object 192.168.7.0 255.255.255.0
network-object 192.168.8.0 255.255.255.0
object-group network network-object
network-object 69.48.231.4 255.255.255.255
object-group network inflow
access-list inbound1 permit tcp any any eq www
access-list inbound1 permit tcp any any eq https
access-list inbound1 permit icmp any any echo-reply
access-list inbound1 permit icmp any any time-exceeded
access-list inbound1 permit icmp any any echo
access-list inbound1 permit icmp any any unreachable
access-list inbound1 permit udp any any eq domain
access-list inbound1 permit ip host 65.90.202.160 any
access-list inbound1 permit ip object-group Inflow any
access-list inbound1 permit tcp any host sales01 eq smtp
access-list inbound1 permit ip host helmoffice any
access-list inbound1 permit ip host 67.90.66.11 any
access-list inbound1 permit ip host 67.90.66.12 any
access-list inbound1 permit ip host 67.90.66.13 any
access-list inbound1 permit ip host 67.90.66.14 any
access-list inbound1 deny ip host 82.127.73.97 any
access-list inbound1 deny ip host 61.0.65.188 any
access-list inbound1 deny ip host 83.152.50.228 any
access-list inbound1 permit tcp any host www eq ftp
access-list inbound1 permit tcp any host 69.48.231.3 eq 99
access-list inbound1 permit tcp any host 69.48.231.3 eq 5100
access-list inbound1 permit tcp any host www eq 99
access-list inbound1 permit tcp any host www eq 5100
access-list vpn-camp permit ip 192.168.1.0 255.255.255.0 192.168.99.0 255.255.25
5.0
access-list vpn-camp permit ip 192.168.5.0 255.255.255.0 192.168.99.0 255.255.25
5.0
pager lines 48
logging on
logging standby
logging buffered critical
logging trap informational
logging queue 1024
logging host inside 192.168.1.50 17/1468
mtu outside 1500
mtu inside 1500
ip address outside 66.45.1.84 255.255.255.240
ip address inside 192.168.1.1 255.255.255.0
ip address intf2 192.168.2.1 255.255.255.0
ip address intf3 192.168.3.1 255.255.255.0
ip address intf4 192.168.4.1 255.255.255.0
ip address intf5 192.168.5.1 255.255.255.0
ip address intf6 192.168.6.1 255.255.255.0
ip address intf7 192.168.7.1 255.255.255.0
ip address intf8 192.168.8.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool camp-vpn-pool 192.168.99.1-192.168.99.25
4
no failover
failover timeout 0:00:00
failover poll 15
no failover ip address outside
no failover ip address inside
no failover ip address intf2
no failover ip address intf3
no failover ip address intf4
no failover ip address intf5
no failover ip address intf6
no failover ip address intf7
no failover ip address intf8
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list vpn-camp
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
nat (intf5) 0 access-list vpn-camp
static (inside,intf2) 192.168.1.0 192.168.1.0 netmask 255.255.255.0 0 0
static (inside,intf3) 192.168.1.0 192.168.1.0 netmask 255.255.255.0 0 0
static (inside,intf4) 192.168.1.0 192.168.1.0 netmask 255.255.255.0 0 0
static (intf2,outside) vit1-app 192.168.2.10 netmask 255.255.255.255 0 0
static (intf2,outside) vit1-db 192.168.2.20 netmask 255.255.255.255 0 0
static (intf3,outside) h1app 192.168.3.10 netmask 255.255.255.255 0 0
static (intf3,outside) h1app-test 192.168.3.30 netmask 255.255.255.255 0 0
static (intf3,outside) h1app-db 192.168.3.20 netmask 255.255.255.255 0 0
static (intf4,outside) sbk1-app 192.168.4.100 netmask 255.255.255.255 0 0
static (intf4,outside) sbk1-db 192.168.4.20 netmask 255.255.255.255 0 0
static (inside,outside) sales01 192.168.1.25 netmask 255.255.255.255 0 0
static (inside,outside) hQA 192.168.1.30 netmask 255.255.255.255 0 0
static (inside,intf5) 192.168.1.0 192.168.1.0 netmask 255.255.255.0 0 0
static (intf5,outside) CServ1s-app 192.168.5.10 netmask 255.255.255.255 0 0
static (intf5,outside) CServ1s-db 192.168.5.20 netmask 255.255.255.255 0 0
static (inside,outside) stage01 192.168.1.35 netmask 255.255.255.255 0 0
static (inside,intf6) 192.168.1.0 192.168.1.0 netmask 255.255.255.0 0 0
static (intf6,outside) pgihc-app 192.168.6.10 netmask 255.255.255.255 0 0
static (intf4,outside) sbux-stage 192.168.4.30 netmask 255.255.255.255 0 0
static (inside,outside) instill-sales 192.168.1.40 netmask 255.255.255.255 0 0
static (intf5,outside) csc-stage 192.168.5.30 netmask 255.255.255.255 0 0
static (inside,intf7) 192.168.1.0 192.168.1.0 netmask 255.255.255.0 0 0
static (intf7,outside) Otis-app 192.168.7.10 netmask 255.255.255.255 0 0
static (intf7,outside) Otis-db 192.168.7.20 netmask 255.255.255.255 0 0
static (inside,outside) www 192.168.1.50 netmask 255.255.255.255 0 0
static (intf7,outside) otisstage 192.168.7.50 netmask 255.255.255.255 0 0
static (inside,intf8) 192.168.1.0 192.168.1.0 netmask 255.255.255.0 0 0
static (intf8,outside) dcbstage01 192.168.8.30 netmask 255.255.255.255 0 0
static (intf2,outside) vitstage01 192.168.2.30 netmask 255.255.255.255 0 0
static (intf5,outside) CServ1-SAP 192.168.5.50 netmask 255.255.255.255 0 0
access-group inbound1 in interface outside
conduit permit icmp any any
conduit permit gre any any
route outside 0.0.0.0 0.0.0.0 xxx.xxx.1.81 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set myset esp-des esp-md5-hmac
crypto dynamic-map dynmap 10 set transform-set myset
crypto map mymap 10 ipsec-isakmp dynamic dynmap
crypto map mymap interface outside
isakmp enable outside
isakmp identity address
isakmp client configuration address-pool local camp-vpn-pool outside
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
vpngroup CampVPN address-pool camp-vpn-pool
vpngroup CampVPN split-tunnel vpn-camp
vpngroup CampVPN idle-time 1800
vpngroup CampVPN password ********
telnet 192.168.1.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
terminal width 80
Cryptochecksum:6e6342d8ab9
82f36341fa
c8dd723c3a
5
helm-pix01config#
Start Free Trial
