We help IT Professionals succeed at work.

Cisco IPSEC VPN on Pix 501 - IAS cannot auth to Exchange Server

tmostowy asked
Medium Priority
Last Modified: 2008-03-04
I can connect to my VPN, it forces the XAUTH and lets me in when I enter user@mydomain.local.  
Problem is, I still have to authenticate when typing start, run \\servername but it lets me in.  
Big problem is when I open Outlook, try to authenticate using the same credentials and it will not let me.  Here is my config...
PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password xxxxxxxxxxxxxxxxxxxx encrypted
passwd xxxxxxxxxxxxxxxxxxx encrypted
hostname xxxxxxxxxxx
domain-name xxx.local
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
access-list 101 permit tcp any any eq ftp
access-list 101 permit tcp any any eq 3389
access-list 101 permit icmp any any echo-reply
access-list 101 permit tcp any any eq pop3
access-list 101 permit tcp any any eq www
access-list 101 permit tcp any any eq smtp
access-list 101 permit tcp any any eq 2525
access-list 101 permit tcp any any eq 3101
access-list 101 permit tcp any any eq 2505
access-list 120 permit ip
access-list splittunnel permit ip
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside xxx.xxx.xxx.xxx
ip address inside
ip audit info action alarm
ip audit attack action alarm
ip local pool vpnpool
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list 120
nat (inside) 1 0 0
static (inside,outside) tcp interface 3389 3389 netmask 0 0
static (inside,outside) tcp interface telnet telnet netmask 0 0
static (inside,outside) tcp interface smtp smtp netmask 0 0
static (inside,outside) tcp interface pop3 pop3 netmask 0 0
static (inside,outside) tcp interface www www netmask 0 0
static (inside,outside) tcp interface 2525 2525 netmask 0 0
static (inside,outside) tcp interface 2505 2505 netmask 0 0
access-group 101 in interface outside
route outside xxx.xxx.xxx.xxx
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
aaa-server partnerauth protocol radius
aaa-server partnerauth max-failed-attempts 3
aaa-server partnerauth deadtime 10
aaa-server partnerauth (inside) host xxxxxxxxxx timeout 5
aaa authentication ssh console LOCAL
http server enable
http outside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set strong esp-aes esp-md5-hmac
crypto dynamic-map dynamic 10 set transform-set strong
crypto map vpn 20 ipsec-isakmp dynamic dynamic
crypto map vpn client authentication partnerauth
crypto map vpn interface outside
isakmp enable outside
isakmp identity address
isakmp keepalive 10
isakmp nat-traversal 20
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption aes
isakmp policy 10 hash sha
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
vpngroup AvL-VPN address-pool vpnpool
vpngroup AvL-VPN dns-server
vpngroup AvL-VPN default-domain xxxxxx.local
vpngroup AvL-VPN split-tunnel splittunnel
vpngroup AvL-VPN split-dns xxxxxx.local
vpngroup AvL-VPN idle-time 28800
vpngroup AvL-VPN password ********
telnet inside
telnet timeout 10
ssh outside
ssh timeout 10
console timeout 0
Watch Question

The problem isn't with the PIX, this is an Outlook/Exchange issue.  Perhaps you're trying to use an older Outlook version that may not be correctly authenticating to Exchange? ie, Outlook 2000 trying to authenticate to an Exchange 2003 server?  

I'd highly suggest opening a question in the Exchange topic area:



Strange, the issue was resolved when i made the workstation a domain member.  Then when I went remote, and logged onto my WS with the same username/pass as the domain, the authentication worked.  I think the problem is reolved.

Best, Todd


Yes.  Please close.  I cannot seem to find a way to close my own cases.
PAQed with points refunded (250)

Community Support Moderator

Not the solution you were looking for? Getting a personalized solution is easy.

Ask the Experts
Access more of Experts Exchange with a free account
Thanks for using Experts Exchange.

Create a free account to continue.

Limited access with a free account allows you to:

  • View three pieces of content (articles, solutions, posts, and videos)
  • Ask the experts questions (counted toward content limit)
  • Customize your dashboard and profile

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.


Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.