Solved

Cisco static VPN working - now dynamic clients cannot connect

Posted on 2004-08-11
4
641 Views
Last Modified: 2012-06-27
I have two Cisco PIX 501s with a static VPN up and running.  Now dynamic clients - Cisco VPN 4.0.3 and MS vpn clients cannot connect from internet.  They connected before static VPN was up.  Reason code 412.  Any ideas?

Thanks
Richard
0
Comment
Question by:rnicolaus
  • 2
4 Comments
 
LVL 36

Expert Comment

by:grblades
Comment Utility
Hi rnicolaus,
Can you post your configuration so I can have a look.
0
 
LVL 6

Author Comment

by:rnicolaus
Comment Utility
sorry, here's the config:


Building configuration...
: Saved
:
PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password CLMaWgGXS98Vph1v encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname Location1
domain-name ourdomainname
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 192.168.100.0 dynOutside
access-list inside_outbound_nat0_acl permit ip dynOutside 255.255.255.0 dynOutside 255.255.255.0
access-list inside_outbound_nat0_acl permit ip any dynOutside 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 192.168.1.0 255.255.255.0 dynOutside 255.255.255.0
access-list 101 permit ip 192.168.1.0 255.255.255.0 dynOutside 255.255.255.0
access-list 101 permit ip any dynOutside 255.255.255.0
access-list outside_cryptomap_dyn_20 permit ip any dynOutside 255.255.255.0
access-list 102 permit ip 192.168.1.0 255.255.255.0 dynOutside 255.255.255.0
access-list 102 permit ip any dynOutside 255.255.255.0
access-list 103 permit ip 192.168.1.0 255.255.255.0 10.0.0.0 255.255.255.0
access-list 103 permit ip 192.168.1.0 255.255.255.0 dynOutside 255.255.255.0
access-list 104 permit ip 192.168.1.0 255.255.255.0 10.0.0.0 255.255.255.0
pager lines 24
logging on
logging buffered errors
logging trap notifications
icmp permit any inside
mtu outside 1500
mtu inside 1500
ip address outside xxx.xxx.xxx.82 255.255.255.248
ip address inside 192.168.1.1 255.255.255.0
ip verify reverse-path interface outside
ip audit info action alarm
ip audit attack action alarm
ip local pool ippool 192.168.100.1-192.168.100.254
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list 103
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.81 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
sysopt connection permit-pptp
crypto ipsec transform-set myset esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set strong esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5
crypto dynamic-map outside_dyn_map 40 set transform-set ESP-3DES-MD5
crypto dynamic-map inside_dyn_map 20 set transform-set ESP-3DES-MD5
crypto dynamic-map dynmap 10 set transform-set myset
crypto dynamic-map dynmap 30 set transform-set myset
crypto dynamic-map outside_dyn_map_1 20 match address outside_cryptomap_dyn_20
crypto dynamic-map outside_dyn_map_1 20 set transform-set myset
crypto dynamic-map outside_dyn_map_1 40 set transform-set myset
crypto map inside_map 65535 ipsec-isakmp dynamic inside_dyn_map
crypto map inside_map interface inside
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map mymap 10 ipsec-isakmp dynamic dynmap
crypto map mymap1 10 ipsec-isakmp dynamic dynmap
crypto map location2 10 ipsec-isakmp
crypto map location2 10 match address 104
crypto map location2 10 set peer xxx.xxx.xxx.81
crypto map location2 10 set transform-set strong
crypto map location2 interface outside
isakmp enable outside
isakmp enable inside
isakmp key ******** address xxx.xxx.xxx.81 netmask 255.255.255.255
isakmp identity address
isakmp policy 8 authentication pre-share
isakmp policy 8 encryption 3des
isakmp policy 8 hash sha
isakmp policy 8 group 1
isakmp policy 8 lifetime 86400
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
vpngroup vpnuser address-pool ippool
vpngroup vpnuser dns-server 192.168.1.100
vpngroup vpnuser wins-server 192.168.1.100
vpngroup vpnuser default-domain ourdomain
vpngroup vpnuser idle-time 1800
vpngroup vpnuser password ********
telnet 192.168.1.0 255.255.255.255 inside
telnet timeout 5
ssh timeout 5
console timeout 0
vpdn group PPTP-VPDN-GROUP accept dialin pptp
vpdn group PPTP-VPDN-GROUP ppp authentication mschap
vpdn group PPTP-VPDN-GROUP ppp encryption mppe auto
vpdn group PPTP-VPDN-GROUP client configuration address local ippool
vpdn group PPTP-VPDN-GROUP pptp echo 60
vpdn group PPTP-VPDN-GROUP client authentication local
vpdn group vpnuser2 accept dialin l2tp
vpdn group vpnuser2 ppp authentication pap
vpdn group vpnuser2 ppp authentication chap
vpdn group vpnuser2 ppp authentication mschap
vpdn group vpnuser2 client configuration address local ippool
vpdn group vpnuser2 client authentication local
vpdn group vpnuser2 l2tp tunnel hello 60
vpdn username vpnuser2 password *********
vpdn enable outside
vpdn enable inside
dhcpd address 192.168.1.2-192.168.1.33 inside
dhcpd dns 192.168.1.100
dhcpd wins 192.168.1.100
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd domain ourdomain
dhcpd auto_config outside
terminal width 80
Cryptochecksum:27eaf9a8cd8e63c913d29e690c25edd9
: end
[OK]

0
 
LVL 36

Accepted Solution

by:
grblades earned 250 total points
Comment Utility
Firstly I suggest removing some of the unused configuration to make it easier to read and avoid any problems with it interfering with other machines. Remove the following lines :-

crypto ipsec transform-set myset esp-3des esp-md5-hmac
crypto dynamic-map outside_dyn_map 40 set transform-set ESP-3DES-MD5
crypto dynamic-map inside_dyn_map 20 set transform-set ESP-3DES-MD5
crypto dynamic-map dynmap 10 set transform-set myset
crypto dynamic-map dynmap 30 set transform-set myset
crypto dynamic-map outside_dyn_map_1 20 match address outside_cryptomap_dyn_20
crypto dynamic-map outside_dyn_map_1 20 set transform-set myset
crypto dynamic-map outside_dyn_map_1 40 set transform-set myset
crypto map inside_map 65535 ipsec-isakmp dynamic inside_dyn_map
crypto map inside_map interface inside
crypto map mymap 10 ipsec-isakmp dynamic dynmap
crypto map mymap1 10 ipsec-isakmp dynamic dynmap

Add the following to the configuration as it appears to be missing

crypto map outside_map interface outside
0
 
LVL 3

Expert Comment

by:snoopy13
Comment Utility
Hi,

You can also remove any part of the access-list that refers to client or lan to lan VPN connection, these are not needed the sysopt permit ipsec takes care of that. Below is a smple of a worming configuration.

crypto ipsec transform-set set2 esp-3des esp-sha-hmac
crypto dynamic-map dynmap1 99 set transform-set set2 (VPN client)

Lan to Lan config

access-list frankfurt permit ip 169.x.x.0 255.255.255.0 192.168.20.0 255.255.255.0
access-list no-nat permit ip 169.x.x.0 255.255.255.0 192.168.20.0 255.255.255.0
nat (inside) 0 access-list no-nat

crypto map vpn-traffic 1 ipsec-isakmp

crypto map vpn-traffic 1 match address frankfurt (this access-list must be different than client access-list if there is going to be one)

crypto map vpn-traffic 1 set peer x.x.x.x

crypto map vpn-traffic 1 set transform-set set2

crypto map vpn-traffic 1 set security-association lifetime seconds 3600 kilobytes 4608000

VPN client
crypto map vpn-traffic 120 ipsec-isakmp dynamic dynmap1

crypto map vpn-traffic client configuration address initiate


isakmp identity address

isakmp policy 1 authentication pre-share

isakmp policy 1 encryption 3des

isakmp policy 1 hash sha

isakmp policy 1 group 2

isakmp policy 1 lifetime 86400

isakmp policy 10 authentication pre-share

isakmp policy 10 encryption 3des

isakmp policy 10 hash md5

isakmp policy 10 group 1

isakmp policy 10 lifetime 28800

isakmp key testvpn address x.x.x.x netmask 255.255.255.255 (lan to lan)

crypto map vpn-traffic interface outside

isakmp enable outside



0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

Preface Having the need * to contact many different companies with different infrastructures * do remote maintenance in their network required us to implement a more flexible routing solution. As RAS, PPTP, L2TP and VPN Client connections are no…
Juniper VPN devices are a popular alternative to using Cisco products. Last year I needed to set up an international site-to-site VPN over the Internet, but the client had high security requirements -- FIPS 140. What and Why of FIPS 140 Federa…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now