Solved

Allow VPN Passthru Pix 506

Posted on 2004-10-22
2,025 Views
Last Modified: 2013-11-16
Hello Experts,

I have a Cisco Pix 506 that is installed in a hotel.  Guests traffic is passed through this firewall.  Many times I get people that try to connect to their work through a VPN.  How do I allow VPN connection out of my Cisco PIX 506?
0
Question by:Spank_IT
    10 Comments
     
    LVL 79

    Accepted Solution

    by:
    Several things to check.
      Are you using a single Public IP on the outside of the PIX for the global?
       Yes -- make sure you have 6.3(3) or higher
                Enable nat-transparency for IPSEC clients
                   isakmp nat-traversal 20
                Enable fixup pptp for Microsoft clients
                   fixup protocol pptp 1723
     
       No -- make sure you have enough addresses in the public IP pool to cover all inside clients

    0
     

    Author Comment

    by:Spank_IT
    Thank you for your response lrmoore.  I am using a single Static Public IP on the outside of the PIX.  I have 6.3(3).  I will add those two settings and let you know if it works.
    0
     

    Author Comment

    by:Spank_IT
    Do I have to make an acl that allows that too, or will the nat-transparency and fixup be enough to make it work?

    Thank you
    0
     
    LVL 79

    Expert Comment

    by:lrmoore
    That should be enough, at least for Microsoft clients.

    You might want to throw in a sysopt to be sure for IPSEC clients.

      sysopt ipsec pl-compatible
    0
     

    Author Comment

    by:Spank_IT
    I'm going to test this out then give you your points after it works.  Where do you get all your information's on VPN's.  I am fairly new to VPN's and would like to understand all the intricacies associated with them.  Where would be good place to start?

    0
     
    LVL 79

    Expert Comment

    by:lrmoore
    Here's a great resource with lot's of good links to other stuff..
    http://labmice.techtarget.com/networking/ipsec.htm

    0
     

    Author Comment

    by:Spank_IT
    What if the Pix does not have 6.1(1)?
    0
     
    LVL 79

    Expert Comment

    by:lrmoore
    If you have anything below 6.3(3), then you have to setup the NAT pool to have enough addresses so that each client can have a 1-1 NAT.
    Example, if your NAT pool is 12 addresses, then only the first 12 users will get 1-1 addresses and can use VPN. Lucky #13 gets internet access, but no VPN.
    0
     

    Author Comment

    by:Spank_IT
    I think with a 6.1(1) all you need to do is allow esp and ah protocols through the firewall and udp port 500 for isakmp with an access list.
    0
     

    Author Comment

    by:Spank_IT
    Do you know how to setup a client to site vpn with a cisco 2600 router?
    0

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone. Privacy Policy Terms of Use

    Featured Post

    Lean Six Sigma Project Manager Certification

    There are many schools of thought around successful project management, but few as highly regarded as the Six Sigma and Lean methods. With 37 hours of learning, this training will explain concrete processes for increasing efficiency and limiting wasted time and effort.

    Suggested Solutions

    There are many useful and sometimes not well documented or forgotten IOS or ASA/PIX commands. See IPE article here , there was also one on PacketU and on Cisco Tips & Tricks. Below are my favorites. I give also a few most often used for Cisco IPS an…
    The DROP (Spamhaus Don't Route Or Peer List) is a small list of IP address ranges that have been stolen or hijacked from their rightful owners. The DROP list is not a DNS based list.  It is designed to be downloaded as a file, with primary intention…
    With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…
    Hi everyone! This is Experts Exchange customer support.  This quick video will show you how to change your primary email address.  If you have any questions, then please Write a Comment below!

    877 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    20 Experts available now in Live!

    Get 1:1 Help Now