Link to home
Start Free TrialLog in
Avatar of rkekos
rkekos

asked on

Quick PIX 515e VPN Question

I'm currently trying to get our VPN setup using a PIX 515e and PPTP authentication (Windows XP logins).  The connection seems to establish just fine and I can get to any site but nothing WITHIN my network, nothing works ping, http, etc.  Any help would be appreciated.
Avatar of Les Moore
Les Moore
Flag of United States of America image

You'll have to post your config, but most important is
  ip address inside 192.168.x.1 255.255.255.0  <== make sure x does not equal 0 or 1
  ip local pool WORD <start ip> <end ip>
  access-list nat_0 permit ip <local subnet> <mask> <pool subnet> <mask>
  nat (inside) 0 access-list nat_o

 Then all of your vpdn config.

Assuming that your local pool is a different subnet than the inside LAN, on the client you have two choices:
1) check the box [x] Use Default Gateway on remote network
2) manually set a route every time you connect
   c:\>route add <lan subnet> mask <mask> <ip received by vpn client>

One workaround is to use maskable sub-groups (not masks) of the LAN for the VPN clients.
Example:
  Local LAN is 192.168.122.0 using addresses .1 - 127 mask 255.255.255.0
  VPN Pool is 192.168.122.193-.254  <no mask specifified>
Now the nat0 access list can make more sense, yet they still appear within the same "real" mask.
   access-list nat_0 permit ip 192.168.122.0 255.255.255.128 192.168.122.192 255.255.255.192
Avatar of rkekos
rkekos

ASKER

Thanks for the help lrmoore ... here's some of my info:

ip address outside 208.42.237.126 255.255.255.248
ip address inside 69.24.64.1 255.255.240.0
...
...
vpdn group MyVPN accept dialin pptp
vpdn group MyVPN ppp authentication pap
vpdn group MyVPN ppp authentication chap
vpdn group MyVPN ppp authentication mschap
vpdn group MyVPN ppp encryption mppe auto required
vpdn group MyVPN client configuration address local VPN
vpdn group MyVPN client configuration dns 69.24.64.251
vpdn group MyVPN pptp echo 60
vpdn group MyVPN client authentication local
vpdn username UserVPN password ************
vpdn enable outside
vpdn enable inside
I'll need to see more of the config. ..
Avatar of rkekos

ASKER

Thanks ... like what?  Here's some more info:

nameif ethernet0 outside security0
nameif ethernet1 inside security100
access-list 101 permit tcp any any
access-list 101 permit udp any any
access-list 101 permit icmp any any
access-list 101 permit tcp 69.24.64.224 255.255.255.252 any
access-list 101 permit ip 69.24.64.224 255.255.255.252 any
access-list inside_outbound_nat0_acl permit ip any 69.24.64.224 255.255.255.252
access-list outside_cryptomap_dyn_20 permit ip any 69.24.64.224 255.255.255.252
ip address outside 208.42.237.126 255.255.255.248
ip address inside 69.24.64.1 255.255.240.0
ip verify reverse-path interface outside
ip verify reverse-path interface inside
ip audit name Attack attack action alarm drop reset
ip audit name Info info action alarm
ip audit interface outside Info
ip audit interface outside Attack
ip audit interface inside Info
ip audit interface inside Attack
ip audit info action alarm
ip audit attack action alarm drop reset
ip local pool VPN 69.24.64.225-69.24.64.226
nat (inside) 0 access-list inside_outbound_nat0_acl
static (inside,outside) 69.24.64.0 69.24.64.0 netmask 255.255.240.0 0 0
access-group 101 in interface outside
route outside 0.0.0.0 0.0.0.0 64.78.145.81 0
route outside 0.0.0.0 0.0.0.0 208.42.237.121 1
vpdn group GearHost accept dialin pptp
vpdn group GearHost ppp authentication pap
vpdn group GearHost ppp authentication chap
vpdn group GearHost ppp authentication mschap
vpdn group GearHost ppp encryption mppe auto required
vpdn group GearHost client configuration address local VPN
vpdn group GearHost client configuration dns 69.24.64.210
vpdn group GearHost pptp echo 60
vpdn group GearHost client authentication local
vpdn username VPNUser password ******
vpdn enable outside
vpdn enable inside
vpnclient server 69.24.64.1
vpnclient mode network-extension-mode
vpnclient vpngroup something password ******
vpnclient username something password ******
First thing to rule out:
  given  >ip address inside 69.24.64.1
Is this the default gateway setting or all the hosts on the lan that you are trying to connec to?

Holy cow, Batman! You've completely bypassed all the security that the PIX should be providing you!
>static (inside,outside) 69.24.64.0 69.24.64.0 netmask 255.255.240.0 0 0
>access-list 101 permit tcp any any
>access-list 101 permit udp any any
>access-list 101 permit icmp any any

You don't need to enable vpdn on the inside:
   >vpdn enable inside

You have competing default gateways out:
  >route outside 0.0.0.0 0.0.0.0 64.78.145.81 0  <- I would remove this
  >route outside 0.0.0.0 0.0.0.0 208.42.237.121 1  <- keep this


Avatar of rkekos

ASKER

69.24.64.1 is our default gateway for all the internal network equipment.  All our equipment internal is on a /19 of that block.

:-) We don't use this PIX for any security right now (that's what I'll be working on next month).  We're migrating to PIX from our current firewall and ids systems.

Thanks for the note on vpdn (inside) and the competing gateway out...
It appears that all the pieces are in place..
Have you tried setting up the client - check the box [x] Use Default Gateway on remote network?

Try setting up a global, just for kicks, even though you are not using NAT at all yet...

global (outside) 1 interface
Avatar of rkekos

ASKER

When I check the box [x] Use Default Gateway on remote network I can't get anything from my network or anyone else.  When I uncheck the box I get everything BUT my own network (69.24.64.0/19).
Avatar of rkekos

ASKER

Also the global (outside) 1 interface command didn't work either.
ASKER CERTIFIED SOLUTION
Avatar of Les Moore
Les Moore
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of rkekos

ASKER

This is nat though?  Is that what I want?
This is NOT using NAT. The configuration items below bypass NAT between the local subnet and the VPN client subnet:

>access-list inside_outbound_nat0_acl permit ip 69.24.64.0 255.255.240.0 192.168.123.224 255.255.255.252
>nat (inside) 0 access-list inside_outbound_nat0_acl
Avatar of rkekos

ASKER

I was referring to "ip local pool VPNTEST 192.168.123.225-192.168.123.226" or was this just an example to replace with my real IP range?  Sorry I wish I knew more about this!  Yes I am testing this from a remote location as well :-).
What this does is set up a completely different IP address range that you can use for VPN clients, different from your local LAN, and it does not have to be a public IP range. You can use exactly what I posted. You don't have to nat between the local lan and the VPN clients because the traffic does not need to be translated because it only traverses the secure tunnel...
Avatar of rkekos

ASKER

Very neat.  That seems to have worked but with a problem I think.  When setup without checking the "Use Default Gateway on remote network" option it seems everything goes over just fine on my local office IP, even when talking with computers within our 69.24.64.0/19 range.  If I uncheck that box then I can't get to anything.  My question is can I setup my VPN to talk over my office connection (no VPN) to all computers outside my network but when talking with any computers within my network go over the VPN tunnel.  When using the Cisco client this was easy to setup ... I must be missing something.
Avatar of rkekos

ASKER

Another quick note ... when I do check the "Use Default Gateway on remote network" I CAN get into any machine within my network but no machine outside of it (ie www.google.com).  When unchecked I get to everything (internal or not) but over my office IP (is it working and just encrypting when talking with an internal computer)?
OK, now we have exactly as I expected. Now you have just the opposite condition, with "use default getaway" checked, you can now get to anything on your remote network, just not anything else.
uncheck it and you get to everything except your remote network...

Now we have a conundrum..
Yes, it is so much easier to just use the Cisco VPN client with "split-tunneling"
Microsoft has no such feature. It's all or nothing.

Do you have anything like this in your config?
   sysopt noproxyarp inside


Avatar of rkekos

ASKER

Geez ... that should of been my first question then.  This way users can get the performance (no encryption) when viewing any non-internal network but use the VPN only when accessing internal resources.  If this is the case then maybe I should just stick with the cisco client.  I didn't want to because I like using built in Windows features.

No I don't have anything related to "sysopt noproxyarp inside".

Well thanks for all the help.  With all this it sounds like I need to go back to using the cisco client.  I'll award the points and thanks very much lrmoore for your help, your very helpful and patient!!!
Glad to help. Sometimes using the built-in features is the best solution, but not always.
You do have another option - use IPSEC policies on workstations that terminate on the PIX....
This uses native Windows and IPSEC encryption to tunnel traffic to a remote network, while all the normal Internet activity bypasses the tunnel.
Background for the policy feature...
http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a00800b12b5.shtml

I have actually implemented this feature from Win2000 Server and from XP client to PIX FW and I know it works.

Still, I think that for remote users, the VPN client is the way to go. So much simpler to set up..