asked on

Cisco VPN Client 4.0.3 to PIX 515 connection fails

I am trying to setup a connection between the Cisco VPN client and a PIX 515E firewall. I have already successfully setup one using the same client machine to a PIX 501 running 6.3. I started with the VPN configuration from that machine and worked my way backwards to supported encryption standards, etc . . .

I don't have easy access to the client machine or the ability to attempt a VPN connection, so it's been difficult to troubleshoot.

Here are the pertinent sections of the PIX 515 configuration. IP addresses have been changed for privacy.

PIX Version 6.1(3)
...
access-list 102 permit ip 10.5.5.0 255.255.255.0 10.5.6.0 255.255.255.240
...
ip address outside A.B.C.125 255.255.255.192
ip address inside 10.5.5.190 255.255.255.0
...
ip local pool vpnpool 10.5.6.1-10.5.6.15
...
global (outside) 1 A.B.C.115-65.169.203.119 netmask A.B.C.192
global (outside) 1 A.B.C.114
nat (inside) 0 access-list 102
...
sysopt connection permit-ipsec
no sysopt route dnat
crypto ipsec transform-set trmset1 esp-des esp-md5-hmac
crypto dynamic-map dynmap 10 set transform-set trmset1
crypto map mymap 10 ipsec-isakmp dynamic dynmap
crypto map mymap interface outside
isakmp enable outside
isakmp identity address
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
vpngroup blah address-pool vpnpool
vpngroup blah dns-server 10.5.5.136 10.5.5.134
vpngroup blah default-domain blah.net
vpngroup blah split-tunnel 102
vpngroup blah idle-time 1800
vpngroup blah password ********

VPN Client connection attempts are to A.B.C.125.

All other aspects of the firewall work fine. As I said above, the same client machine is able to connect to a PIX 501 without any problems.
I debugged the connection attempt and the Phase 1 portion never succeeded.

Also, the 515 firewall is behind a Cisco router, but I do not have any type of access to that.

Thanks for the input.

Tim Holman

If the PIX 501 and 515 configurations are the same, then you shouldn't have any problems.
However, the Cisco router might be blocking ports ? You need UDP 10000 open...
Does the 515 have a private address (ie subject to NAT??)
What you have so far looks OK, but could we see the whole config please ?

PS - Do yourself a favour and pick up a free 3DES license ! - http://www.cisco.com/pcgi-bin/Software/FormManager/formgenerator.pl

averyb

ASKER

Here is the full config on the firewall.
The configurations are the same between the 515 and the 501, except that the 501 uses AES. The crypto settings are different as a result.

i need to run it by my manager before gettting 3DES. I'll need to provide his contact info to get it, so I want him to be aware of it.

The client that I have been testing with is at the location specified by D.E.F.122. That user can access the remote network (A.B.C.x) subject to the access-lists. The D.E.F.122 is the global pool IP for that network (uses PAT).

The router could be blocking ports. I don't know.

PIX Version 6.1(3)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 intf2 security10
nameif ethernet3 intf3 security15
nameif ethernet4 intf4 security20
nameif ethernet5 intf5 security25
enable password passwd ****** encrypted
hostname doh
domain-name blah.net
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
access-list 101 deny udp any any eq 135
access-list 101 deny tcp any any eq 135
access-list 101 deny tcp any any eq 137
access-list 101 deny udp any any eq netbios-ns
access-list 101 deny udp any any eq 139
access-list 101 deny tcp any any eq 139
access-list 101 deny tcp any any eq 445
access-list 101 deny udp any any eq 445
access-list 101 deny tcp any any eq 593
access-list 101 permit tcp host A.B.C.142 host D.E.F.122 eq whatever
access-list 101 permit icmp 192.168.1.0 255.255.255.252 any
access-list 102 permit ip 10.5.5.0 255.255.255.0 10.5.6.0 255.255.255.240
pager lines 24
logging buffered debugging
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto shutdown
interface ethernet3 auto shutdown
interface ethernet4 auto shutdown
interface ethernet5 auto shutdown
mtu outside 1500
mtu inside 1500
mtu intf2 1500
mtu intf3 1500
mtu intf4 1500
mtu intf5 1500
ip address outside A.B.C.125 255.255.255.192
ip address inside 10.5.5.190 255.255.255.0
ip address intf2 127.0.0.1 255.255.255.255
ip address intf3 127.0.0.1 255.255.255.255
ip address intf4 127.0.0.1 255.255.255.255
ip address intf5 127.0.0.1 255.255.255.255
ip audit info action alarm
ip audit attack action alarm
ip local pool vpnpool 10.5.6.1-10.5.6.15
no failover
failover timeout 0:00:00
failover poll 15
failover ip address outside 0.0.0.0
failover ip address inside 0.0.0.0
failover ip address intf2 0.0.0.0
failover ip address intf3 0.0.0.0
failover ip address intf4 0.0.0.0
failover ip address intf5 0.0.0.0
pdm history enable
arp timeout 14400
global (outside) 1 A.B.C.115-A.B.C.119 netmask 255.255.255.192
global (outside) 1 A.B.C.114
nat (inside) 0 access-list 102
nat (inside) 1 10.5.5.136 255.255.255.255 0 0
nat (inside) 1 10.5.5.142 255.255.255.255 0 0
nat (inside) 1 10.5.5.134 255.255.255.255 0 0
static (inside,outside) A.B.C.122 10.5.5.137 netmask 255.255.255.255 0 0
static (inside,outside) A.B.C.124 10.5.5.142 netmask 255.255.255.255 0 0
access-group 101 in interface outside
route outside 0.0.0.0 0.0.0.0 A.B.C.126 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
tftp-server inside 10.5.5.142 root
floodguard enable
sysopt connection permit-ipsec
no sysopt route dnat
crypto ipsec transform-set trmset1 esp-des esp-md5-hmac
crypto dynamic-map dynmap 10 set transform-set trmset1
crypto map mymap 10 ipsec-isakmp dynamic dynmap
crypto map mymap interface outside
isakmp enable outside
isakmp identity address
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
vpngroup blah address-pool vpnpool
vpngroup blah dns-server 10.5.5.136 10.5.5.134
vpngroup blah default-domain blah.net
vpngroup blah split-tunnel 102
vpngroup blah idle-time 1800
vpngroup blah password ********
telnet 0.0.0.0 0.0.0.0 inside
telnet 192.168.253.1 255.255.255.255 inside
telnet A.B.C.143 255.255.255.255 inside
telnet 192.168.253.1 255.255.255.255 intf2
telnet A.B.C.143 255.255.255.255 intf2
telnet 192.168.253.1 255.255.255.255 intf3
telnet A.B.C.143 255.255.255.255 intf3
telnet 192.168.253.1 255.255.255.255 intf4
telnet A.B.C.143 255.255.255.255 intf4
telnet 192.168.253.1 255.255.255.255 intf5
telnet A.B.C.143 255.255.255.255 intf5
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 5
terminal width 80
Cryptochecksum:5213b3be487f2d17a182a985c19d55ce
doh(config)#

ASKER CERTIFIED SOLUTION

Tim Holman

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

averyb

ASKER

Darn good point. I hadn't thought of that. That is one big difference between the two PIX's that I am connecting to.

I'll get the free license and post back the results.

averyb

ASKER

I am having problems getting the 6.3 Pix OS. Since your comment sent me down this road, I wanted to go ahead and award the points.

Thanks again.