Accessing PIX 515 (6.3.3) using PIX Device Manager (PDM 3.0) over VPN (PPTP)

Hi there,

I have an up and running Cisco PIX 515 (Failover) configuration. I am able to access the inside network via VPN (PPTP) but I am unable to configure the PIX using the device manager, if connected via the vpn. In fact i don't even see which ip to connect to

outside network:

inside network:

pix inside ip:

pix outside ip:

I am able to configure the pix using the pdm via the outside interface (from as well as using the inside interface (from If i establish the vpn tunnel i am able to ping a host inside the 'inside network' ( but unable to ping/see the inside interface ( as I would expect it to.

the relevant configuration:
PIX Version 6.3(3)
interface ethernet0 100full
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
hostname pix1
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
access-list inside_outbound_nat0_acl permit ip vpn
pager lines 24
logging on
logging console notifications
logging trap warnings
mtu outside 1500
mtu inside 1500
ip address outside
ip address inside
ip audit info action alarm
ip audit attack action alarm
ip local pool vpn_pool
failover timeout 0:00:00
failover poll 15
failover ip address outside
failover ip address inside
pdm location inside
pdm location outside
pdm history enable
arp timeout 14400
nat (inside) 0 access-list inside_outbound_nat0_acl
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
route outside 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http outside
http inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-pptp
crypto ipsec transform-set esp-des-md5 esp-des esp-md5-hmac
isakmp enable outside
telnet timeout 5
ssh timeout 5
management-access outside
console timeout 0
vpdn group vpn accept dialin pptp
vpdn group vpn ppp authentication mschap
vpdn group vpn client configuration address local vpn_pool
vpdn group vpn pptp echo 60
vpdn group vpn client authentication local
vpdn enable outside
terminal width 80

I guess I am missing something obvious :-(

Any ideas ?
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

I'm not sure I understand your question but I'll answer it for what I believe you may want to do???

If you want to manage your PIX using PDM from inside or outside to the following:

#config t
#http server enable  --> This starts a scaled down webserver process on your PIX
#http <client_ip_address> <subnet_mask> <interface_name>

here's an example of the command above
If you have a public address (say: and you want to access the PIX from the outside interface do this:
#http outside

If you have a private address on the inside you want to use (say any workstation on do this:
#http inside

This should do the trick! Now if you want to use PDM once VPN'd in that's a little different  and can be discussed further if need be.

OptivoTomAuthor Commented:
Thanks so far...

accessing the PIX from private and public addresses is (allready ;-)) working... so using PDM is possible.


I am not able to use PDM to connect to the PIX via the VPN... so i would really appreciate if you have any more ideas regarding that issue.

>unable to ping/see the inside interface ( as I would expect it to.
You should not expect to. It is a 'feature' of the PIX.

What you want is to designate the inside address as a Management Access Interface:
 management-access inside
Check the Configuration tab, System Properties, Administration/ Management Interface

This is sort of what you're talking about, minus the lan-lan tunnel...??

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
OptivoTomAuthor Commented:
After all the Solution consisted of two things:

First of all it is not supported to use PDM via a VPN based on PPTP... only IPSec is supported :-( I guess becuase there are some known issues regarding security and PPTP.

After setting up IPSec everything behaved as it was supposed to be and of course the management-access had to be switched to inside.


It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Fonts Typography

From novice to tech pro — start learning today.