Solved

Pix 506E VPN Wizard PPTP Configuration - Connect but no traffic

Posted on 2004-04-19
4
533 Views
Last Modified: 2013-11-16
I have a PIX 506E running software 6.3(3), with a pretty vanilla configuration.  I am trying to allow Windows clients PPTP access to the inside network.

I have 192.168.1.0/C as my inside network, single public IP as my outside network running NAT.

I configured 192.168.2.0/C as my PPTP pool, set up using the VPN Wizard in PDM (also tried this manually but no help).

I created users and can get connect and get an IP address, but cannot ping or otherwise exchange traffic with the inside network.

What's wrong?  Do I need to create a special access rule?  If so, what sort, and why didn't Mr. Wizard do this for me?

Relevant portions of configuration after "wizarding" it:

PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
access-list inside_outbound_nat0_acl permit ip any 192.168.2.0 255.255.255.128
mtu inside 1500
ip address outside 64.X.X.1 255.255.255.192
ip address inside 192.168.1.1 255.255.255.0
ip local pool pptp_pool 192.168.2.1-192.168.2.100
global (outside) 10 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 0 192.168.2.0 255.255.255.0 0 0
nat (inside) 10 0.0.0.0 0.0.0.0 0 0
vpdn group PPTP-VPDN-GROUP accept dialin pptp
vpdn group PPTP-VPDN-GROUP ppp authentication mschap
vpdn group PPTP-VPDN-GROUP ppp encryption mppe 40 required
vpdn group PPTP-VPDN-GROUP client configuration address local pptp_pool
vpdn group PPTP-VPDN-GROUP pptp echo 60
vpdn group PPTP-VPDN-GROUP client authentication local
vpdn username testuser password *********
vpdn enable outside
dhcpd address 192.168.1.2-192.168.1.100 inside

0
Comment
Question by:nickswanjan
4 Comments
 
LVL 23

Accepted Solution

by:
Tim Holman earned 125 total points
ID: 10866715
Make your VPN pool part of the local network - eg 192.168.1.240-250.
At the moment, it doesn't look like 192.168.2.0 knows where to go !! ;)
Also, get rid of this:

nat (inside) 0 192.168.2.0 255.255.255.0 0 0

as it's duplicated in the line above

and don't forget 'sysopt permit-connection pptp', as this opens up all the necessary ports on the PIX for PPTP to happen.

0
 
LVL 2

Expert Comment

by:jon47
ID: 10877133
An alternative would be to change the netmask on your internal lan to 255.255.252.0 (or a smaller netmask) so that 192.168.1 and 192.168.2 are both part of the same network.  But you'll have to change more than your firewall to achieve this.

If you don't need many simultaneous incoming vpn connections go for tim's solution.

Jon
0

Featured Post

VMware Disaster Recovery and Data Protection

In this expert guide, you’ll learn about the components of a Modern Data Center. You will use cases for the value-added capabilities of Veeam®, including combining backup and replication for VMware disaster recovery and using replication for data center migration.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Outgoing Call restriction in Cisco UC560 2 70
Cisco ACS 5.4 "management" proc stuck in Restarting 2 38
By pass website on ASA for Websense 4 53
nexus filter logs 3 28
The DROP (Spamhaus Don't Route Or Peer List) is a small list of IP address ranges that have been stolen or hijacked from their rightful owners. The DROP list is not a DNS based list.  It is designed to be downloaded as a file, with primary intention…
Use of TCL script on Cisco devices:  - create file and merge it with running configuration to apply configuration changes
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…

920 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now