We help IT Professionals succeed at work.

Pix 515 Setup Help Needed

melron12
melron12 asked
on
Medium Priority
313 Views
Last Modified: 2013-11-16
We have a Pix 515 Firewall.  We want to be able to set it up for remote vpn access using ipsec.  

Outside IP address is X.X.X.1 255.255.255.248
Inside IP address is 192.168.1.X

IP POOL for VPN 192.100.1.1 - 192.100.1.255
These are the things that I know.  I need some help with the rest of the setup and I do not have access to sample configs on Cisco.

Any help would be helpful
Comment
Watch Question

Sr Software Engineer
CERTIFIED EXPERT
Commented:
Here's a start.  Also, change your vpn pool, its a public IP range.  
I'll use: 192.169.100.1-192.168.100.254
ip pool local vpnpool 192.168.100.1-192.168.100.254 mask 255.255.255.0
check syntax for above command to make sure
then add
access-list nonat permit ip 192.168.1.0 255.255.255.0 192.168.100.0 255.255.255.0
access-list splitvpn permit ip 192.168.1.0 255.255.255.0 192.168.100.0 255.255.255.0
nat (inside) 0 access-list nonat
sysopt connection permit-ipsec
isakmp enable outside
isakmp policy 10 authen pre-share
isakmp policy 10 encrypt 3des
isakmp policy 10 hash md5
isakmp policy 10 group 2
crypto ipsec transform-set esp-3des-md5 esp-3des esp-md5-hmac
crypto dynamic-map dynmap 10 set transform-set esp-3des-md5
crypto map outsidemap 10 ipsec-isakmp dynamic dynmap
crypto map outsidemap interface outside

now are you running version 6.X or 7.X - there are other options but these should get you going
for 6.X
vpngroup <username> password <password>
vpngroup <username> split-tunnel splitvpn
vpngroup <username> address-pool vpnpool

for 7.x
have to get back to you as you have to create a group policy and then create a tunnel-group, this is because vpngroup is deprecated in 7.X

you might want to double check the syntax but this should give you a good start

Not the solution you were looking for? Getting a personalized solution is easy.

Ask the Experts

Author

Commented:
I get connected via vpn....I recieve ip address....and I am not able to browse the inside network
Cyclops3590Sr Software Engineer
CERTIFIED EXPERT

Commented:
you did do the split-tunnel right?

can you post the config file you have (sanitized of course)

Author

Commented:
I can not browse the internal network.... but I can not browse the internet on my remote computer.

Thanks

Cyclops3590Sr Software Engineer
CERTIFIED EXPERT

Commented:
please post your config so I can see what is wrong.

thank you

Author

Commented:
Correction

I can browse the internal network.... but I can not browse the internet on my remote computer
Cyclops3590Sr Software Engineer
CERTIFIED EXPERT

Commented:
okay, then I"ll need two things. first your pix config and second on the remote machine, after you setup the vpn what does the route table say
in windows
route print
Access more of Experts Exchange with a free account
Thanks for using Experts Exchange.

Create a free account to continue.

Limited access with a free account allows you to:

  • View three pieces of content (articles, solutions, posts, and videos)
  • Ask the experts questions (counted toward content limit)
  • Customize your dashboard and profile

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.