Solved

Accessing PIX 515 (6.3.3) using PIX Device Manager (PDM 3.0) over VPN (PPTP)

Posted on 2003-11-11
4
3,450 Views
Last Modified: 2013-12-03
Hi there,

I have an up and running Cisco PIX 515 (Failover) configuration. I am able to access the inside network via VPN (PPTP) but I am unable to configure the PIX using the device manager, if connected via the vpn. In fact i don't even see which ip to connect to

outside network:
192.168.1.0 255.255.255.0

inside network:
10.0.1.0 255.255.255.0

pix inside ip:
10.0.1.1

pix outside ip:
192.168.1.21

I am able to configure the pix using the pdm via the outside interface (from 192.168.1.20) as well as using the inside interface (from 10.0.1.10). If i establish the vpn tunnel i am able to ping a host inside the 'inside network' (10.0.1.10) but unable to ping/see the inside interface (10.0.1.1) as I would expect it to.

the relevant configuration:
PIX Version 6.3(3)
interface ethernet0 100full
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
hostname pix1
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
access-list inside_outbound_nat0_acl permit ip 10.0.1.0 255.255.255.0 vpn 255.255.255.0
pager lines 24
logging on
logging console notifications
logging trap warnings
mtu outside 1500
mtu inside 1500
ip address outside 192.168.1.21 255.255.255.0
ip address inside 10.0.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool vpn_pool 10.0.3.1-10.0.3.255
failover
failover timeout 0:00:00
failover poll 15
failover ip address outside 192.168.1.23
failover ip address inside 10.0.1.2
pdm location 192.168.1.20 255.255.255.255 inside
pdm location 10.0.1.0 255.255.255.0 outside
pdm history enable
arp timeout 14400
nat (inside) 0 access-list inside_outbound_nat0_acl
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 192.168.1.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 192.168.1.20 255.255.255.255 outside
http 10.0.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-pptp
crypto ipsec transform-set esp-des-md5 esp-des esp-md5-hmac
isakmp enable outside
telnet timeout 5
ssh timeout 5
management-access outside
console timeout 0
vpdn group vpn accept dialin pptp
vpdn group vpn ppp authentication mschap
vpdn group vpn client configuration address local vpn_pool
vpdn group vpn pptp echo 60
vpdn group vpn client authentication local
vpdn enable outside
terminal width 80

I guess I am missing something obvious :-(

Any ideas ?
0
Comment
Question by:OptivoTom
  • 2
4 Comments
 

Expert Comment

by:cdhansen10
ID: 9724260
I'm not sure I understand your question but I'll answer it for what I believe you may want to do???

If you want to manage your PIX using PDM from inside or outside to the following:

#en
#config t
#http server enable  --> This starts a scaled down webserver process on your PIX
#http <client_ip_address> <subnet_mask> <interface_name>

here's an example of the command above
If you have a public address (say: 10.5.10.5) and you want to access the PIX from the outside interface do this:
#http 10.5.10.5 255.255.255.255 outside

If you have a private address on the inside you want to use (say any workstation on 192.168.1.0) do this:
#http 192.168.1.0 255.255.255.0 inside

This should do the trick! Now if you want to use PDM once VPN'd in that's a little different  and can be discussed further if need be.

-Craig
0
 

Author Comment

by:OptivoTom
ID: 9724449
Thanks so far...

accessing the PIX from private and public addresses is (allready ;-)) working... so using PDM is possible.

BUT

I am not able to use PDM to connect to the PIX via the VPN... so i would really appreciate if you have any more ideas regarding that issue.

Tom
0
 
LVL 79

Accepted Solution

by:
lrmoore earned 125 total points
ID: 9724839
>unable to ping/see the inside interface (10.0.1.1) as I would expect it to.
You should not expect to. It is a 'feature' of the PIX.

What you want is to designate the inside address as a Management Access Interface:
 management-access inside
Check the Configuration tab, System Properties, Administration/ Management Interface


This is sort of what you're talking about, minus the lan-lan tunnel...??
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a0080094497.shtml
0
 

Author Comment

by:OptivoTom
ID: 9745924
After all the Solution consisted of two things:

First of all it is not supported to use PDM via a VPN based on PPTP... only IPSec is supported :-( I guess becuase there are some known issues regarding security and PPTP.

After setting up IPSec everything behaved as it was supposed to be and of course the management-access had to be switched to inside.

thanks,

Tom
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

Cisco Pix/ASA hairpinning The term, hairpinning, comes from the fact that the traffic comes from one source into a router or similar device, makes a U-turn, and goes back the same way it came. Visualize this and you will see something that looks …
The DROP (Spamhaus Don't Route Or Peer List) is a small list of IP address ranges that have been stolen or hijacked from their rightful owners. The DROP list is not a DNS based list.  It is designed to be downloaded as a file, with primary intention…
Excel styles will make formatting consistent and let you apply and change formatting faster. In this tutorial, you'll learn how to use Excel's built-in styles, how to modify styles, and how to create your own. You'll also learn how to use your custo…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now