Accessing PIX 515 (6.3.3) using PIX Device Manager (PDM 3.0) over VPN (PPTP)

Posted on 2003-11-11
Medium Priority
Last Modified: 2013-12-03
Hi there,

I have an up and running Cisco PIX 515 (Failover) configuration. I am able to access the inside network via VPN (PPTP) but I am unable to configure the PIX using the device manager, if connected via the vpn. In fact i don't even see which ip to connect to

outside network:

inside network:

pix inside ip:

pix outside ip:

I am able to configure the pix using the pdm via the outside interface (from as well as using the inside interface (from If i establish the vpn tunnel i am able to ping a host inside the 'inside network' ( but unable to ping/see the inside interface ( as I would expect it to.

the relevant configuration:
PIX Version 6.3(3)
interface ethernet0 100full
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
hostname pix1
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
access-list inside_outbound_nat0_acl permit ip vpn
pager lines 24
logging on
logging console notifications
logging trap warnings
mtu outside 1500
mtu inside 1500
ip address outside
ip address inside
ip audit info action alarm
ip audit attack action alarm
ip local pool vpn_pool
failover timeout 0:00:00
failover poll 15
failover ip address outside
failover ip address inside
pdm location inside
pdm location outside
pdm history enable
arp timeout 14400
nat (inside) 0 access-list inside_outbound_nat0_acl
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
route outside 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http outside
http inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-pptp
crypto ipsec transform-set esp-des-md5 esp-des esp-md5-hmac
isakmp enable outside
telnet timeout 5
ssh timeout 5
management-access outside
console timeout 0
vpdn group vpn accept dialin pptp
vpdn group vpn ppp authentication mschap
vpdn group vpn client configuration address local vpn_pool
vpdn group vpn pptp echo 60
vpdn group vpn client authentication local
vpdn enable outside
terminal width 80

I guess I am missing something obvious :-(

Any ideas ?
Question by:OptivoTom
  • 2

Expert Comment

ID: 9724260
I'm not sure I understand your question but I'll answer it for what I believe you may want to do???

If you want to manage your PIX using PDM from inside or outside to the following:

#config t
#http server enable  --> This starts a scaled down webserver process on your PIX
#http <client_ip_address> <subnet_mask> <interface_name>

here's an example of the command above
If you have a public address (say: and you want to access the PIX from the outside interface do this:
#http outside

If you have a private address on the inside you want to use (say any workstation on do this:
#http inside

This should do the trick! Now if you want to use PDM once VPN'd in that's a little different  and can be discussed further if need be.


Author Comment

ID: 9724449
Thanks so far...

accessing the PIX from private and public addresses is (allready ;-)) working... so using PDM is possible.


I am not able to use PDM to connect to the PIX via the VPN... so i would really appreciate if you have any more ideas regarding that issue.

LVL 79

Accepted Solution

lrmoore earned 375 total points
ID: 9724839
>unable to ping/see the inside interface ( as I would expect it to.
You should not expect to. It is a 'feature' of the PIX.

What you want is to designate the inside address as a Management Access Interface:
 management-access inside
Check the Configuration tab, System Properties, Administration/ Management Interface

This is sort of what you're talking about, minus the lan-lan tunnel...??

Author Comment

ID: 9745924
After all the Solution consisted of two things:

First of all it is not supported to use PDM via a VPN based on PPTP... only IPSec is supported :-( I guess becuase there are some known issues regarding security and PPTP.

After setting up IPSec everything behaved as it was supposed to be and of course the management-access had to be switched to inside.



Featured Post

Cyber Threats to Small Businesses (Part 2)

The evolving cybersecurity landscape presents SMBs with a host of new threats to their clients, their data, and their bottom line. In part 2 of this blog series, learn three quick processes Webroot’s CISO, Gary Hayslip, recommends to help small businesses beat modern threats.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Let’s face it: one of the reasons your organization chose a SaaS solution (whether Microsoft Dynamics 365, Netsuite or SAP) is that it is subscription-based. The upkeep is done. Or so you think.
Considering cloud tradeoffs and determining the right mix for your organization.
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…
Suggested Courses
Course of the Month16 days, 14 hours left to enroll

862 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question