Solved

Pix 506E VPN Wizard PPTP Configuration - Connect but no traffic

Posted on 2004-04-19
4
575 Views
Last Modified: 2013-11-16
I have a PIX 506E running software 6.3(3), with a pretty vanilla configuration.  I am trying to allow Windows clients PPTP access to the inside network.

I have 192.168.1.0/C as my inside network, single public IP as my outside network running NAT.

I configured 192.168.2.0/C as my PPTP pool, set up using the VPN Wizard in PDM (also tried this manually but no help).

I created users and can get connect and get an IP address, but cannot ping or otherwise exchange traffic with the inside network.

What's wrong?  Do I need to create a special access rule?  If so, what sort, and why didn't Mr. Wizard do this for me?

Relevant portions of configuration after "wizarding" it:

PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
access-list inside_outbound_nat0_acl permit ip any 192.168.2.0 255.255.255.128
mtu inside 1500
ip address outside 64.X.X.1 255.255.255.192
ip address inside 192.168.1.1 255.255.255.0
ip local pool pptp_pool 192.168.2.1-192.168.2.100
global (outside) 10 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 0 192.168.2.0 255.255.255.0 0 0
nat (inside) 10 0.0.0.0 0.0.0.0 0 0
vpdn group PPTP-VPDN-GROUP accept dialin pptp
vpdn group PPTP-VPDN-GROUP ppp authentication mschap
vpdn group PPTP-VPDN-GROUP ppp encryption mppe 40 required
vpdn group PPTP-VPDN-GROUP client configuration address local pptp_pool
vpdn group PPTP-VPDN-GROUP pptp echo 60
vpdn group PPTP-VPDN-GROUP client authentication local
vpdn username testuser password *********
vpdn enable outside
dhcpd address 192.168.1.2-192.168.1.100 inside

0
Comment
Question by:nickswanjan
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
4 Comments
 
LVL 23

Accepted Solution

by:
Tim Holman earned 125 total points
ID: 10866715
Make your VPN pool part of the local network - eg 192.168.1.240-250.
At the moment, it doesn't look like 192.168.2.0 knows where to go !! ;)
Also, get rid of this:

nat (inside) 0 192.168.2.0 255.255.255.0 0 0

as it's duplicated in the line above

and don't forget 'sysopt permit-connection pptp', as this opens up all the necessary ports on the PIX for PPTP to happen.

0
 
LVL 2

Expert Comment

by:jon47
ID: 10877133
An alternative would be to change the netmask on your internal lan to 255.255.252.0 (or a smaller netmask) so that 192.168.1 and 192.168.2 are both part of the same network.  But you'll have to change more than your firewall to achieve this.

If you don't need many simultaneous incoming vpn connections go for tim's solution.

Jon
0

Featured Post

DevOps Toolchain Recommendations

Read this Gartner Research Note and discover how your IT organization can automate and optimize DevOps processes using a toolchain architecture.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
WARNING:   If you follow the instructions here, you will wipe out your VTP and VLAN configurations.  Make sure you have backed up your switch!!! I recently had some issues with a few low-end Cisco routers (RV325) and I opened a case with Cisco TA…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…

729 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question