cdh4143
asked on
PIX to VPN Client, no traffic or pings - most of the time!
Dear All...
For the last few days I've been trying to get our PIX 501 -> Cisco VPN Client VPN going. The frustrating thing is that sometimes it works, and sometimes it doesn't work. I've read a lot of forum posts, and tried to follow Cisco's rather unfriendly information documents to get this up and running, but just don't seem to get anywhere.
I have users on laptops out and about who connect via 3G data cards or broadband connections. I want them to have split tunnel VPN. I have no problems making the VPN connection to the PIX, however getting anywhere beyond that is 90% of the time a problem. I have disabled all firewalls and added as many rules as I can to let any traffic through to the laptops... so that shouldn't be stopping things...
When the connection works I am able to ping the DNS server (192.168.1.103) and download emails. But when I can't ping anything on the internal network then I don't seem to be able to do anything to rescue it.
I'm sure this shoudln't be a tempormental solution, and there is just something configured incorrectly, so please could you have a look through my PIX config (some things are in xxx but it shouldn't be a problem).
I've read a lot about having the VPN clients on a different subnet, and I've read lots of suggestions where they told the person with the issue to just give the VPN DHCP pool a different address, given instructions, and then it hasn't worked... And where is the routing between those new IP addresses and the network taking place?
Another problem was that a user was on a connection last weekend that had a 255.0.0.0 subnet and I read many places saying that having that subnet would cause problems with the connection - but no one said how to fix it.
Something else, I noticed that when you click the statistics of the VPN connection on the client there are many bytes sent, but 0 received.
Also you'll see the addresses below that have 128 in them... I didn't enter 128 anywhere... so where did these come from?!
PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password encrypted
passwd encrypted
hostname pixfirewall
domain-name ciscopix.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list inside_acl permit tcp any interface outside eq 90
access-list inside_acl permit tcp any interface outside eq smtp
access-list inside_outbound_nat0_acl permit ip 192.168.1.0 255.255.255.0 192.168.1.128 255.255.255.128
access-list inside_outbound_nat0_acl permit ip interface inside 192.168.1.128 255.255.255.128
access-list inside_outbound_nat0_acl permit ip any 192.168.1.128 255.255.255.128
access-list outside_cryptomap_dyn_20 permit ip any 192.168.1.128 255.255.255.128
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside xxx.xxx.xxx.xxx 255.255.255.240
ip address inside 192.168.1.250 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool DHCP-GROUP 192.168.1.170-192.168.1.19
pdm location xxx.xxx.xxx.xxx 255.255.255.255 inside
pdm location xxx.xxx.xxx.xxx 255.255.255.255 inside
pdm location 192.168.40.0 255.255.255.0 inside
pdm location 192.168.1.128 255.255.255.128 outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp interface xx xxx.xxx.xxx.xxx xx netmask 255.255.255.255 0 0
static (inside,outside) tcp interface xx xxx.xxx.xxx.xxx xx netmask 255.255.255.255 0 0
access-group inside_acl in interface outside
route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx 1
route inside 192.168.40.0 255.255.255.0 192.168.1.230 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
isakmp enable outside
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup VPN-USERS address-pool DHCP-GROUP
vpngroup VPN-USERS dns-server 192.168.1.103 192.168.1.106
vpngroup VPN-USERS wins-server 192.168.1.103
vpngroup VPN-USERS default-domain OurDomain
vpngroup VPN-USERS split-tunnel outside_cryptomap_dyn_20
vpngroup VPN-USERS idle-time 1800
vpngroup VPN-USERS password ********
telnet 192.168.1.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.1.251-192.168.1.25
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
terminal width 80
Cryptochecksum:
Cisco client is v4.8.
Like I said, I know it works... and it has been working well... but I can't seem to keep it working all the time (I'm testing this on 4 different laptops on different connections, in different locations... and there is no pattern I can get yet)
This is quite an urgent problem as people are not able to access their company email.
Many thanks.
CH
For the last few days I've been trying to get our PIX 501 -> Cisco VPN Client VPN going. The frustrating thing is that sometimes it works, and sometimes it doesn't work. I've read a lot of forum posts, and tried to follow Cisco's rather unfriendly information documents to get this up and running, but just don't seem to get anywhere.
I have users on laptops out and about who connect via 3G data cards or broadband connections. I want them to have split tunnel VPN. I have no problems making the VPN connection to the PIX, however getting anywhere beyond that is 90% of the time a problem. I have disabled all firewalls and added as many rules as I can to let any traffic through to the laptops... so that shouldn't be stopping things...
When the connection works I am able to ping the DNS server (192.168.1.103) and download emails. But when I can't ping anything on the internal network then I don't seem to be able to do anything to rescue it.
I'm sure this shoudln't be a tempormental solution, and there is just something configured incorrectly, so please could you have a look through my PIX config (some things are in xxx but it shouldn't be a problem).
I've read a lot about having the VPN clients on a different subnet, and I've read lots of suggestions where they told the person with the issue to just give the VPN DHCP pool a different address, given instructions, and then it hasn't worked... And where is the routing between those new IP addresses and the network taking place?
Another problem was that a user was on a connection last weekend that had a 255.0.0.0 subnet and I read many places saying that having that subnet would cause problems with the connection - but no one said how to fix it.
Something else, I noticed that when you click the statistics of the VPN connection on the client there are many bytes sent, but 0 received.
Also you'll see the addresses below that have 128 in them... I didn't enter 128 anywhere... so where did these come from?!
PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password encrypted
passwd encrypted
hostname pixfirewall
domain-name ciscopix.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list inside_acl permit tcp any interface outside eq 90
access-list inside_acl permit tcp any interface outside eq smtp
access-list inside_outbound_nat0_acl permit ip 192.168.1.0 255.255.255.0 192.168.1.128 255.255.255.128
access-list inside_outbound_nat0_acl permit ip interface inside 192.168.1.128 255.255.255.128
access-list inside_outbound_nat0_acl permit ip any 192.168.1.128 255.255.255.128
access-list outside_cryptomap_dyn_20 permit ip any 192.168.1.128 255.255.255.128
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside xxx.xxx.xxx.xxx 255.255.255.240
ip address inside 192.168.1.250 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool DHCP-GROUP 192.168.1.170-192.168.1.19
pdm location xxx.xxx.xxx.xxx 255.255.255.255 inside
pdm location xxx.xxx.xxx.xxx 255.255.255.255 inside
pdm location 192.168.40.0 255.255.255.0 inside
pdm location 192.168.1.128 255.255.255.128 outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp interface xx xxx.xxx.xxx.xxx xx netmask 255.255.255.255 0 0
static (inside,outside) tcp interface xx xxx.xxx.xxx.xxx xx netmask 255.255.255.255 0 0
access-group inside_acl in interface outside
route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx 1
route inside 192.168.40.0 255.255.255.0 192.168.1.230 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
isakmp enable outside
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup VPN-USERS address-pool DHCP-GROUP
vpngroup VPN-USERS dns-server 192.168.1.103 192.168.1.106
vpngroup VPN-USERS wins-server 192.168.1.103
vpngroup VPN-USERS default-domain OurDomain
vpngroup VPN-USERS split-tunnel outside_cryptomap_dyn_20
vpngroup VPN-USERS idle-time 1800
vpngroup VPN-USERS password ********
telnet 192.168.1.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.1.251-192.168.1.25
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
terminal width 80
Cryptochecksum:
Cisco client is v4.8.
Like I said, I know it works... and it has been working well... but I can't seem to keep it working all the time (I'm testing this on 4 different laptops on different connections, in different locations... and there is no pattern I can get yet)
This is quite an urgent problem as people are not able to access their company email.
Many thanks.
CH
ASKER
Re: the VPN pool, I didn't ever enter .128 as a number though... I wanted the range to be between 192.168.1.170 192.168.1.199
The PIX we have does have a 10 user VPN limit, however the max number of users on this currently is 4.
The PIX we have does have a 10 user VPN limit, however the max number of users on this currently is 4.
It could possibly be that your inside subnet is 192.168.1.0/24 and that is a very common IP range. So if you connect in from a broadband connection that hands out IP addresses in that range you won't be able to access your work subnet. I wouldn't think that would be the case with those 3G connections but that's something you might want to take a look at.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Set that up and it works fine now.
Many thanks.
Many thanks.
The intermittent problem may be the fact that a PIX 501 is limited to 10 connections. Do you have 10 internal users? Is it possible that the internal clients are exceeding your connection license limitation?