August 29, 2008 11:06pm pdt

Member Login

Hall of Fame

Yearly

1RobWill 348,183
2batry_boy 236,734
3lrmoore 165,453
4arnold 118,053
5dpk_wal 72,695
6mwecom... 67,324
7ebjers 44,300
8MrHusy 43,020
9mkielar 42,800
10Qlemo 39,883
11Voltz-dk 35,470
12Cyclops3... 34,840
13TechSoEasy 33,389
14tigermatt 31,325
15keith_ala... 27,046
16trinak96 26,315
17JFrederic... 21,480
18from_exp 21,275
19stuknhaw... 20,075
20rsivanandan 19,950
21rowansmith 19,875
22PeteLong 19,175
23johnb6767 19,122
242PiFL 18,725
25RPPreacher 17,950

	[x] Attachment Details

Howto Setup Microsoft VPN in firewall

Zones: Virtual Private Networking (VPN), Cisco PIX Firewall

Tags: Cisco, PIX, 515E

Hi

I want to setup microsoft VPN client to allow users to connect to business network. I know I can use the buildt in cisco vpn client in the firewall, but this is very complex to me. Can anyone help me with the code to allow my cisco firewall to pass trough the necessary traffic?

The VPN server will have local ip: 10.26.0.11

My config looks like this:

         
           
             1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119:
120:
121:
122:
123:
124:
125:
126:
127:
128:
129:
130:
131:
132:
133:
134:
135:
136:
137:
138:
139:
140:
141:
142:
143:
144:
145:
146:
147:
148:
149:
150:
151:
152:
153:
154:
155:
156:
157:
158:
159:
160:
161:
162:
163:
164:
165:
166:

           
           
             PIX Version 7.2(1) 
!
hostname ENSY-TY-FW
domain-name domain.com
enable password DGFJDGJDGJSDGW encrypted
names
!
interface Ethernet0
 nameif outside
 security-level 0
 ip address 81.XXX.XXX.38 255.255.255.252 
!
interface Ethernet1
 nameif inside
 security-level 100
 ip address 10.26.0.1 255.255.255.0 
!
passwd FAJDFJDGFJDFKE encrypted
boot system flash:/pix721.bin
ftp mode passive
clock timezone CEST 1
clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
dns server-group DefaultDNS
 domain-name domain.com
same-security-traffic permit intra-interface
access-list outside_20_cryptomap extended permit ip 10.26.0.0 255.255.255.0 10.230.0.0 255.255.255.0 
access-list inside_nat0_outbound extended permit ip 10.26.0.0 255.255.255.0 10.230.0.0 255.255.255.0 
access-list inside_access_in_1 extended permit ip any any 
access-list outside_in extended permit tcp any host 81.XXX.XXX.38 eq 3389 
access-list outside_in extended permit udp any host 81.XXX.XXX.38 eq 3389 
access-list outside_in extended permit tcp any eq pptp host 81.XXX.XXX.38eq pptp 
access-list outside_access_in_1 extended permit icmp any any echo-reply 
access-list 110 extended permit tcp any host 10.26.0.11 eq pptp 
pager lines 24
logging enable
logging console emergencies
logging monitor debugging
logging buffered debugging
logging asdm informational
mtu outside 1500
mtu inside 1500
no failover
monitor-interface outside
monitor-interface inside
asdm image flash:/asdm-521.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) tcp interface 3389 10.26.0.11 3389 netmask 255.255.255.255 
static (inside,outside) tcp 81.XXX.XXX.38 pptp 10.26.0.11 pptp netmask 255.255.255.255 
access-group outside_in in interface outside
access-group inside_access_in_1 in interface inside
route outside 0.0.0.0 0.0.0.0 81.XXX.XXX.38 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
group-policy DfltGrpPolicy attributes
 banner none
 wins-server none
 dns-server none
 dhcp-network-scope none
 vpn-access-hours none
 vpn-simultaneous-logins 3
 vpn-idle-timeout 30
 vpn-session-timeout none
 vpn-filter none
 vpn-tunnel-protocol IPSec l2tp-ipsec 
 password-storage disable
 ip-comp enable
 re-xauth enable
 group-lock value 82.XXX.XXX.49
 pfs disable
 ipsec-udp disable
 ipsec-udp-port 10000
 split-tunnel-policy tunnelall
 split-tunnel-network-list none
 default-domain none
 split-dns none
 intercept-dhcp 255.255.255.255 disable
 secure-unit-authentication disable
 user-authentication disable
 user-authentication-idle-timeout 30
 ip-phone-bypass disable
 leap-bypass disable
 nem disable
 backup-servers keep-client-config
 msie-proxy server none
 msie-proxy method no-modify
 msie-proxy except-list none
 msie-proxy local-bypass disable
 nac disable
 nac-sq-period 300
 nac-reval-period 36000
 nac-default-acl none
 address-pools none
 client-firewall none
 client-access-rule none
username admin password /kgJm52K8bWCSeZc encrypted privilege 15
username adcom password zM7mrScu7Fbm5HeJ encrypted privilege 15
aaa authentication enable console LOCAL 
aaa authentication ssh console LOCAL 
aaa authentication telnet console LOCAL 
http server enable
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac 
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac 
crypto map outside_map 20 match address outside_20_cryptomap
crypto map outside_map 20 set peer 82.XXX.XXX.49 
crypto map outside_map 20 set transform-set ESP-DES-SHA
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption des
 hash sha
 group 2
 lifetime 86400
crypto isakmp nat-traversal  20
 
 
tunnel-group 82.XXX.XXX.49 type ipsec-l2l
tunnel-group 82.XXX.XXX.49 ipsec-attributes
 pre-shared-key *
telnet 62.97.247.44 255.255.255.255 outside
telnet 10.26.0.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 10.26.0.100-10.26.0.254 inside
dhcpd dns 81.XXX.XXX.38. interface inside
!
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns migrated_dns_map_1
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns migrated_dns_map_1 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect netbios 
  inspect rsh 
  inspect rtsp 
  inspect skinny 
  inspect esmtp 
  inspect sqlnet 
  inspect sunrpc 
  inspect tftp 
  inspect sip 
  inspect xdmcp 
!
tftp-server inside 10.26.0.10 ensyconfig
ssl encryption des-sha1 rc4-md5
prompt hostname context 
Cryptochecksum:ba09938963664d9229489b1663f9e294

           
         

Start your free trial to view this solution

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

9.1

Question Stats

Zone: Software

Question Asked By: WhiteMafiosi

Solution Provided By: arnold

Participating Experts: 2

Solution Grade: A

Translate:

Loading Advertisement...

Open Discussion

Comment by _m3Rlin_

This article may help: http://www.m3rlin.org/wordpress/cisco-pix-515-pptp-problem/

20080723-EE-VQP-34 / EE_QW_2_20070628