Pix 506E VPN Wizard PPTP Configuration - Connect but no traffic

I have a PIX 506E running software 6.3(3), with a pretty vanilla configuration.  I am trying to allow Windows clients PPTP access to the inside network.

I have 192.168.1.0/C as my inside network, single public IP as my outside network running NAT.

I configured 192.168.2.0/C as my PPTP pool, set up using the VPN Wizard in PDM (also tried this manually but no help).

I created users and can get connect and get an IP address, but cannot ping or otherwise exchange traffic with the inside network.

What's wrong?  Do I need to create a special access rule?  If so, what sort, and why didn't Mr. Wizard do this for me?

Relevant portions of configuration after "wizarding" it:

PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
access-list inside_outbound_nat0_acl permit ip any 192.168.2.0 255.255.255.128
mtu inside 1500
ip address outside 64.X.X.1 255.255.255.192
ip address inside 192.168.1.1 255.255.255.0
ip local pool pptp_pool 192.168.2.1-192.168.2.100
global (outside) 10 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 0 192.168.2.0 255.255.255.0 0 0
nat (inside) 10 0.0.0.0 0.0.0.0 0 0
vpdn group PPTP-VPDN-GROUP accept dialin pptp
vpdn group PPTP-VPDN-GROUP ppp authentication mschap
vpdn group PPTP-VPDN-GROUP ppp encryption mppe 40 required
vpdn group PPTP-VPDN-GROUP client configuration address local pptp_pool
vpdn group PPTP-VPDN-GROUP pptp echo 60
vpdn group PPTP-VPDN-GROUP client authentication local
vpdn username testuser password *********
vpdn enable outside
dhcpd address 192.168.1.2-192.168.1.100 inside

LVL 3
nickswanjanAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Tim HolmanCommented:
Make your VPN pool part of the local network - eg 192.168.1.240-250.
At the moment, it doesn't look like 192.168.2.0 knows where to go !! ;)
Also, get rid of this:

nat (inside) 0 192.168.2.0 255.255.255.0 0 0

as it's duplicated in the line above

and don't forget 'sysopt permit-connection pptp', as this opens up all the necessary ports on the PIX for PPTP to happen.

0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
jon47Commented:
An alternative would be to change the netmask on your internal lan to 255.255.252.0 (or a smaller netmask) so that 192.168.1 and 192.168.2 are both part of the same network.  But you'll have to change more than your firewall to achieve this.

If you don't need many simultaneous incoming vpn connections go for tim's solution.

Jon
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Software Firewalls

From novice to tech pro — start learning today.