Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 611
  • Last Modified:

Pix 506E VPN Wizard PPTP Configuration - Connect but no traffic

I have a PIX 506E running software 6.3(3), with a pretty vanilla configuration.  I am trying to allow Windows clients PPTP access to the inside network.

I have 192.168.1.0/C as my inside network, single public IP as my outside network running NAT.

I configured 192.168.2.0/C as my PPTP pool, set up using the VPN Wizard in PDM (also tried this manually but no help).

I created users and can get connect and get an IP address, but cannot ping or otherwise exchange traffic with the inside network.

What's wrong?  Do I need to create a special access rule?  If so, what sort, and why didn't Mr. Wizard do this for me?

Relevant portions of configuration after "wizarding" it:

PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
access-list inside_outbound_nat0_acl permit ip any 192.168.2.0 255.255.255.128
mtu inside 1500
ip address outside 64.X.X.1 255.255.255.192
ip address inside 192.168.1.1 255.255.255.0
ip local pool pptp_pool 192.168.2.1-192.168.2.100
global (outside) 10 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 0 192.168.2.0 255.255.255.0 0 0
nat (inside) 10 0.0.0.0 0.0.0.0 0 0
vpdn group PPTP-VPDN-GROUP accept dialin pptp
vpdn group PPTP-VPDN-GROUP ppp authentication mschap
vpdn group PPTP-VPDN-GROUP ppp encryption mppe 40 required
vpdn group PPTP-VPDN-GROUP client configuration address local pptp_pool
vpdn group PPTP-VPDN-GROUP pptp echo 60
vpdn group PPTP-VPDN-GROUP client authentication local
vpdn username testuser password *********
vpdn enable outside
dhcpd address 192.168.1.2-192.168.1.100 inside

0
nickswanjan
Asked:
nickswanjan
1 Solution
 
Tim HolmanCommented:
Make your VPN pool part of the local network - eg 192.168.1.240-250.
At the moment, it doesn't look like 192.168.2.0 knows where to go !! ;)
Also, get rid of this:

nat (inside) 0 192.168.2.0 255.255.255.0 0 0

as it's duplicated in the line above

and don't forget 'sysopt permit-connection pptp', as this opens up all the necessary ports on the PIX for PPTP to happen.

0
 
jon47Commented:
An alternative would be to change the netmask on your internal lan to 255.255.252.0 (or a smaller netmask) so that 192.168.1 and 192.168.2 are both part of the same network.  But you'll have to change more than your firewall to achieve this.

If you don't need many simultaneous incoming vpn connections go for tim's solution.

Jon
0

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now