Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

Pix 506E VPN Wizard PPTP Configuration - Connect but no traffic

Posted on 2004-04-19
4
Medium Priority
?
600 Views
Last Modified: 2013-11-16
I have a PIX 506E running software 6.3(3), with a pretty vanilla configuration.  I am trying to allow Windows clients PPTP access to the inside network.

I have 192.168.1.0/C as my inside network, single public IP as my outside network running NAT.

I configured 192.168.2.0/C as my PPTP pool, set up using the VPN Wizard in PDM (also tried this manually but no help).

I created users and can get connect and get an IP address, but cannot ping or otherwise exchange traffic with the inside network.

What's wrong?  Do I need to create a special access rule?  If so, what sort, and why didn't Mr. Wizard do this for me?

Relevant portions of configuration after "wizarding" it:

PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
access-list inside_outbound_nat0_acl permit ip any 192.168.2.0 255.255.255.128
mtu inside 1500
ip address outside 64.X.X.1 255.255.255.192
ip address inside 192.168.1.1 255.255.255.0
ip local pool pptp_pool 192.168.2.1-192.168.2.100
global (outside) 10 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 0 192.168.2.0 255.255.255.0 0 0
nat (inside) 10 0.0.0.0 0.0.0.0 0 0
vpdn group PPTP-VPDN-GROUP accept dialin pptp
vpdn group PPTP-VPDN-GROUP ppp authentication mschap
vpdn group PPTP-VPDN-GROUP ppp encryption mppe 40 required
vpdn group PPTP-VPDN-GROUP client configuration address local pptp_pool
vpdn group PPTP-VPDN-GROUP pptp echo 60
vpdn group PPTP-VPDN-GROUP client authentication local
vpdn username testuser password *********
vpdn enable outside
dhcpd address 192.168.1.2-192.168.1.100 inside

0
Comment
Question by:nickswanjan
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
4 Comments
 
LVL 23

Accepted Solution

by:
Tim Holman earned 500 total points
ID: 10866715
Make your VPN pool part of the local network - eg 192.168.1.240-250.
At the moment, it doesn't look like 192.168.2.0 knows where to go !! ;)
Also, get rid of this:

nat (inside) 0 192.168.2.0 255.255.255.0 0 0

as it's duplicated in the line above

and don't forget 'sysopt permit-connection pptp', as this opens up all the necessary ports on the PIX for PPTP to happen.

0
 
LVL 2

Expert Comment

by:jon47
ID: 10877133
An alternative would be to change the netmask on your internal lan to 255.255.252.0 (or a smaller netmask) so that 192.168.1 and 192.168.2 are both part of the same network.  But you'll have to change more than your firewall to achieve this.

If you don't need many simultaneous incoming vpn connections go for tim's solution.

Jon
0

Featured Post

Free learning courses: Active Directory Deep Dive

Get a firm grasp on your IT environment when you learn Active Directory best practices with Veeam! Watch all, or choose any amount, of this three-part webinar series to improve your skills. From the basics to virtualization and backup, we got you covered.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

During and after that shift to cloud, one area that still poses a struggle for many organizations is what to do with their department file shares.
As managed cloud service providers, we often get asked to intervene when cloud deployments go awry. Attracted by apparent ease-of-use, flexibility and low computing costs, companies quickly adopt leading public cloud platforms such as Amazon Web Ser…
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…
Suggested Courses

636 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question