Solved

Cisco PIX reconfigure inside IP range help required!

Posted on 2007-11-26
20
276 Views
Last Modified: 2010-04-09
Hi,

should be a quick one, forgive me for not knowing this...

This Cisco PIX 501 is currently set to have an inside IP of 192.168.16.253

I want to change it to 192.168.20.253 because at the moment it's going to conflict with the LAN subnet. What commands do I use to make this change and is it a quick thing to do?

Here is the current config:

PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password 1iwWUtCZbeXI9x7r encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname londonpix
domain-name ciscopix.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 192.168.16.2 mail
name 192.168.1.0 Munich-Lan
name 192.168.15.0 munich
name 212.202.225.34 munichpix
object-group service Webmail tcp
  description Secure webmail access
  port-object eq www
  port-object eq https
  port-object eq smtp
access-list inside_outbound_nat0_acl permit ip any 192.168.17.10 255.255.255.254
access-list inside_outbound_nat0_acl permit ip 192.168.16.0 255.255.255.0 munich 255.255.255.0
access-list split_T permit ip 192.168.16.0 255.255.255.0 192.168.17.0 255.255.255.0
access-list outside_access_in remark Remoteweb workplace
access-list outside_access_in permit tcp any eq 4125 any eq 4125
access-list outside_access_in permit tcp any interface outside object-group Webmail
access-list outside_cryptomap_20 permit ip 192.168.16.0 255.255.255.0 munich 255.255.255.0
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 217.144.147.66 255.255.255.252
ip address inside 192.168.16.253 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool remote 192.168.17.10-192.168.17.21 mask 255.255.255.0
pdm location 192.168.16.0 255.255.255.255 inside
pdm location 192.168.16.0 255.255.255.0 inside
pdm location Munich-Lan 255.255.255.0 inside
pdm location mail 255.255.255.255 inside
pdm location 192.168.17.10 255.255.255.254 outside
pdm location Munich-Lan 255.255.255.255 outside
pdm location munich 255.255.255.0 outside
pdm location munichpix 255.255.255.255 outside
pdm location 0.0.0.0 255.255.255.255 outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp interface smtp mail smtp netmask 255.255.255.255 0 0
static (inside,outside) tcp interface www mail www netmask 255.255.255.255 0 0
static (inside,outside) tcp interface https mail https netmask 255.255.255.255 0 0
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 217.144.147.65 1
route outside munich 255.255.255.0 217.144.147.65 1
route outside munichpix 255.255.255.255 217.144.147.66 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http Munich-Lan 255.255.255.0 inside
http 192.168.16.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
sysopt connection permit-pptp
sysopt connection permit-l2tp
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 20 ipsec-isakmp
crypto map outside_map 20 match address outside_cryptomap_20
crypto map outside_map 20 set peer munichpix
crypto map outside_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
isakmp enable outside
isakmp key ******** address 212.202.225.48 netmask 255.255.255.255 no-xauth no-config-mode
isakmp key ******** address munichpix netmask 255.255.255.255 no-xauth no-config-mode
isakmp key ******** address 0.0.0.0 netmask 255.255.255.255 no-xauth no-config-mode
isakmp log 1
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup users address-pool remote
vpngroup users dns-server 217.144.147.66
vpngroup users split-tunnel split_T
vpngroup users idle-time 1800
vpngroup users password ********
telnet 0.0.0.0 255.255.255.255 outside
telnet timeout 5
ssh timeout 5
console timeout 0
vpdn group users accept dialin l2tp
vpdn group users ppp authentication pap
vpdn group users client configuration address local remote
vpdn group users client authentication local
vpdn group users l2tp tunnel hello 300
vpdn username magnus password *********
dhcpd address 192.168.16.1-192.168.16.10 inside
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
username lmiles password C2KmXgyDJjL27vvz encrypted privilege 5
username dvago password WXHm1TBh5B6VgDIo encrypted privilege 5
username nlarsen password QtvepTrpg8fR1r86 encrypted privilege 5
username sfallgren password j75viSdKsDioff67 encrypted privilege 5
username treiss password 84cqV/yi9n6c6nuT encrypted privilege 5
username jcgas password uTOiBOn/rmqRSV.v encrypted privilege 5
username akoch password 8KaL7ZAowyWxZxhN encrypted privilege 5
username magnus password qu7pouLeRTTVAQBg encrypted privilege 15
username eyblood password whhCrfoivSj9zJwC encrypted privilege 5
vpnclient server 217.144.147.66
vpnclient mode client-mode
vpnclient vpngroup users password ********
terminal width 80
Cryptochecksum:84c96b4ddd7c308187771c7222aa69e6
: end
londonpix(config)#
0
Comment
Question by:magnus911
  • 13
  • 7
20 Comments
 
LVL 36

Expert Comment

by:grblades
Comment Utility
Yes it is easy to do but what are you going to do about the mail server and the VPN users?
Is there going to be a router between the inside interface and the 192.168.16.x network?

Depending what you are going to do about the mail server and VPN will depend on what additional config changes are required after changing the IP address.
0
 
LVL 1

Author Comment

by:magnus911
Comment Utility
I'm not doing anything to them - I still want the mail forwarded to 192.168.16.2 and for the VPN users to be assigned addresses on a different subnet when they sign in...
They have all modified their HOSTS file so that 192.168.16.2 = sbs2003...
Basically, at the moment the SBS has 2 NICS, the wan of which has a public static ip which is the mx server. Now there is the PIX, either I switch over to just one NIC which means messing around with the default gateway on all the clients, or I change the subnet of PIX inside eth?
Or am I totally off the mark?
0
 
LVL 1

Author Comment

by:magnus911
Comment Utility
maybe i'm not being clear, sorry.
The SBS has a LAN nic which is 192.168.16.2, so the wan nic which will be connected to the PIX should be on a different subnet - i'm suggesting 192.168.20.x

that way only the sbs is on the same subnet as the PIX and all LAN internet traffic will route through the SBS onto the PIX...

If i do this, will i only have to change the config on the PIX to reflect that subnet change or is it more compllicated?

Thanks!
0
 
LVL 36

Expert Comment

by:grblades
Comment Utility
Lets assume the sbs server will be on the 192.168.20.2 IP address.

1) First we need to change the PIX IP address.
ip address inside 192.168.20.253 255.255.255.0

2) Change the DHCP and also change the start range as you dont want it issuing 192.168.20.2 to some other machine.
no dhcpd address 192.168.16.1-192.168.16.10 inside
dhcpd address 192.168.20.3-192.168.20.10 inside

3) Switch the static NAT entry to go to the different IP address.
no name 192.168.16.2
name 192.168.20.2 mail
no static (inside,outside) tcp interface smtp 192.168.16.2 smtp netmask 255.255.255.255 0 0
no static (inside,outside) tcp interface www 192.168.16.2 www netmask 255.255.255.255 0 0
no static (inside,outside) tcp interface https 192.168.16.2 https netmask 255.255.255.255 0 0
static (inside,outside) tcp interface smtp 192.168.20.2 smtp netmask 255.255.255.255 0 0
static (inside,outside) tcp interface www 192.168.20.2 www netmask 255.255.255.255 0 0
static (inside,outside) tcp interface https 192.168.20.2 https netmask 255.255.255.255 0 0

4) Add a route to the LAN network via the SBS server.
route inside 192.168.16.0 255.255.255.0 192.168.20.2 1

5) Add to the access-lists so vpn traffic can also flow between the 192.168.20.x network to the other sites/users.
access-list inside_outbound_nat0_acl permit ip 192.168.20.0 255.255.255.0 munich 255.255.255.0
access-list split_T permit ip 192.168.20.0 255.255.255.0 192.168.17.0 255.255.255.0
access-list outside_cryptomap_20 permit ip 192.168.20.0 255.255.255.0 munich 255.255.255.0

6) Save the config and give the PIX a reload so that the xlate tables and VPN get refreshed. There are a couple of commands you can enter to do this but as you are changing the IP etc... you are going to have downtime anyway so the extra minute for a reboot wont matter.


Give that a go and let me know if you have any problems. Its a few changes so I might have missed something which should hopefully be clear if I can see the config after the changes are made.

P.S I would advise against posting the usernames and encrypted passwords. The password encryption is week and only designed to stop someone reading it over your shoulder. It would only take a computer program a few seconds to crack them. I would advise you change the passwords when it is all working.
0
 
LVL 1

Author Comment

by:magnus911
Comment Utility
ok grblades! thanks very much for all your hard work!
I will do that all now.

Sorry for being a complete noobie but what's the command for save/reboot?

0
 
LVL 1

Author Comment

by:magnus911
Comment Utility
OK! I think I've done it...

here's the config (minus passwords this time!)

londonpix# show run
: Saved
:
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password 1iwWUt9x7r encrypted
passwd 2KFOU encrypted
hostname londonpix
domain-name ciscopix.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 192.168.1.0 Munich-Lan
name 192.168.15.0 munich
name 212.202.225.34 munichpix
name 192.168.20.2 mail
object-group service Webmail tcp
  description Secure webmail access
  port-object eq www
  port-object eq https
  port-object eq smtp
access-list inside_outbound_nat0_acl permit ip any 192.168.17.10 255.255.255.254
access-list inside_outbound_nat0_acl permit ip 192.168.16.0 255.255.255.0 munich 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 192.168.20.0 255.255.255.0 munich 255.255.255.0
access-list split_T permit ip 192.168.16.0 255.255.255.0 192.168.17.0 255.255.255.0
access-list split_T permit ip 192.168.20.0 255.255.255.0 192.168.17.0 255.255.255.0
access-list outside_access_in remark Remoteweb workplace
access-list outside_access_in permit tcp any eq 4125 any eq 4125
access-list outside_access_in permit tcp any interface outside object-group Webmail
access-list outside_cryptomap_20 permit ip 192.168.16.0 255.255.255.0 munich 255.255.255.0
access-list outside_cryptomap_20 permit ip 192.168.20.0 255.255.255.0 munich 255.255.255.0
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 217.144.147.66 255.255.255.252
ip address inside 192.168.20.253 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool remote 192.168.17.10-192.168.17.21 mask 255.255.255.0
pdm location 192.168.16.0 255.255.255.255 inside
pdm location 192.168.16.0 255.255.255.0 inside
pdm location Munich-Lan 255.255.255.0 inside
pdm location 192.168.16.2 255.255.255.255 inside
pdm location 192.168.17.10 255.255.255.254 outside
pdm location Munich-Lan 255.255.255.255 outside
pdm location munich 255.255.255.0 outside
pdm location munichpix 255.255.255.255 outside
pdm location 0.0.0.0 255.255.255.255 outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp interface smtp 192.168.16.2 smtp netmask 255.255.255.255 0 0
static (inside,outside) tcp interface www 192.168.16.2 www netmask 255.255.255.255 0 0
static (inside,outside) tcp interface https 192.168.16.2 https netmask 255.255.255.255 0 0
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 217.144.147.65 1
route outside munich 255.255.255.0 217.144.147.65 1
route inside 192.168.16.0 255.255.255.0 mail 1
route outside munichpix 255.255.255.255 217.144.147.66 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http Munich-Lan 255.255.255.0 inside
http 192.168.16.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
sysopt connection permit-pptp
sysopt connection permit-l2tp
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 20 ipsec-isakmp
crypto map outside_map 20 match address outside_cryptomap_20
crypto map outside_map 20 set peer munichpix
crypto map outside_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
isakmp enable outside
isakmp key ******** address 212.202.225.48 netmask 255.255.255.255 no-xauth no-config-mode
isakmp key ******** address munichpix netmask 255.255.255.255 no-xauth no-config-mode
isakmp key ******** address 0.0.0.0 netmask 255.255.255.255 no-xauth no-config-mode
isakmp log 1
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup users address-pool remote
vpngroup users dns-server 217.144.147.66
vpngroup users split-tunnel split_T
vpngroup users idle-time 1800
vpngroup users password ********
telnet 0.0.0.0 255.255.255.255 outside
telnet timeout 5
ssh timeout 5
console timeout 0
vpdn group users accept dialin l2tp
vpdn group users ppp authentication pap
vpdn group users client configuration address local remote
vpdn group users client authentication local
vpdn group users l2tp tunnel hello 300
vpdn username magnus password *********
dhcpd address 192.168.20.3-192.168.20.10 inside
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
username lmiles password C2KDJjL27vvz encrypted privilege 5
username dvago password WXTBh5B6VgDIo encrypted privilege 5
username nlarsen password QtTrpg8fR1r86 encrypted privilege 5
username sfallgren password j7dKsDioff67 encrypted privilege 5
username treiss password 84cqn6c6nuT encrypted privilege 5
username jcgas password uTOiBRSV.v encrypted privilege 5
username akoch password 8KaLWxZxhN encrypted privilege 5
username magnus password qu7AQBg encrypted privilege 15
username eyblood password whj9zJwC encrypted privilege 5
vpnclient server 217.144.147.66
vpnclient mode client-mode
vpnclient vpngroup users password
terminal width 80
Cryptochecksum:37457d21e4e2b9a58944ea5ac0b021d1
: end
londonpix#
0
 
LVL 36

Expert Comment

by:grblades
Comment Utility
"wri mem" saves the config so it is not lost on a reboot.
"reload" will perform a reboot.

The 'static' commands havent changed. Try adding the following agin :-
no static (inside,outside) tcp interface smtp 192.168.16.2 smtp netmask 255.255.255.255 0 0
no static (inside,outside) tcp interface www 192.168.16.2 www netmask 255.255.255.255 0 0
no static (inside,outside) tcp interface https 192.168.16.2 https netmask 255.255.255.255 0 0
static (inside,outside) tcp interface smtp 192.168.20.2 smtp netmask 255.255.255.255 0 0
static (inside,outside) tcp interface www 192.168.20.2 www netmask 255.255.255.255 0 0
static (inside,outside) tcp interface https 192.168.20.2 https netmask 255.255.255.255 0 0
0
 
LVL 1

Author Comment

by:magnus911
Comment Utility
Whoops! that was me using the up button and not thinking!

londonpix(config)# show run
: Saved
:
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password 1iwZbeXI9x7r encrypted
passwd 2KFQnbNIdI.2 encrypted
hostname londonpix
domain-name ciscopix.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 192.168.1.0 Munich-Lan
name 192.168.15.0 munich
name 212.202.225.34 munichpix
name 192.168.20.2 mail
object-group service Webmail tcp
  description Secure webmail access
  port-object eq www
  port-object eq https
  port-object eq smtp
access-list inside_outbound_nat0_acl permit ip any 192.168.17.10 255.255.255.254
access-list inside_outbound_nat0_acl permit ip 192.168.16.0 255.255.255.0 munich 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 192.168.20.0 255.255.255.0 munich 255.255.255.0
access-list split_T permit ip 192.168.16.0 255.255.255.0 192.168.17.0 255.255.255.0
access-list split_T permit ip 192.168.20.0 255.255.255.0 192.168.17.0 255.255.255.0
access-list outside_access_in remark Remoteweb workplace
access-list outside_access_in permit tcp any eq 4125 any eq 4125
access-list outside_access_in permit tcp any interface outside object-group Webmail
access-list outside_cryptomap_20 permit ip 192.168.16.0 255.255.255.0 munich 255.255.255.0
access-list outside_cryptomap_20 permit ip 192.168.20.0 255.255.255.0 munich 255.255.255.0
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 217.144.147.66 255.255.255.252
ip address inside 192.168.20.253 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool remote 192.168.17.10-192.168.17.21 mask 255.255.255.0
pdm location 192.168.16.0 255.255.255.255 inside
pdm location 192.168.16.0 255.255.255.0 inside
pdm location Munich-Lan 255.255.255.0 inside
pdm location 192.168.16.2 255.255.255.255 inside
pdm location 192.168.17.10 255.255.255.254 outside
pdm location Munich-Lan 255.255.255.255 outside
pdm location munich 255.255.255.0 outside
pdm location munichpix 255.255.255.255 outside
pdm location 0.0.0.0 255.255.255.255 outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp interface smtp mail smtp netmask 255.255.255.255 0 0
static (inside,outside) tcp interface www mail www netmask 255.255.255.255 0 0
static (inside,outside) tcp interface https mail https netmask 255.255.255.255 0 0
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 217.144.147.65 1
route outside munich 255.255.255.0 217.144.147.65 1
route inside 192.168.16.0 255.255.255.0 mail 1
route outside munichpix 255.255.255.255 217.144.147.66 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http Munich-Lan 255.255.255.0 inside
http 192.168.16.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
sysopt connection permit-pptp
sysopt connection permit-l2tp
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 20 ipsec-isakmp
crypto map outside_map 20 match address outside_cryptomap_20
crypto map outside_map 20 set peer munichpix
crypto map outside_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
isakmp enable outside
isakmp key ******** address 212.202.225.48 netmask 255.255.255.255 no-xauth no-config-mode
isakmp key ******** address munichpix netmask 255.255.255.255 no-xauth no-config-mode
isakmp key ******** address 0.0.0.0 netmask 255.255.255.255 no-xauth no-config-mode
isakmp log 1
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup users address-pool remote
vpngroup users dns-server 217.144.147.66
vpngroup users split-tunnel split_T
vpngroup users idle-time 1800
vpngroup users password ********
telnet 0.0.0.0 255.255.255.255 outside
telnet timeout 5
ssh timeout 5
console timeout 0
vpdn group users accept dialin l2tp
vpdn group users ppp authentication pap
vpdn group users client configuration address local remote
vpdn group users client authentication local
vpdn group users l2tp tunnel hello 300
vpdn username magnus password *********
dhcpd address 192.168.20.3-192.168.20.10 inside
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
username lmiles password C2KmXgyDJjL27vvz encrypted privilege 5
username dvago password WXHm1TBh5B6VgDIo encrypted privilege 5
username nlarsen password QtvepTrpg1r86 encrypted privilege 5
username sfallgren password j75viSDioff67 encrypted privilege 5
username treiss password 84cqV/9n6c6nuT encrypted privilege 5
username jcgas password uTOin/rmqRSV.v encrypted privilege 5
username akoch password 8KaZAowyWxZxhN encrypted privilege 5
username magnus password quouLeRTTVAQBg encrypted privilege 15
username eyblood password wCrfoivSj9zJwC encrypted privilege 5
vpnclient server 217.144.147.66
vpnclient mode client-mode
vpnclient vpngroup users password ********
terminal width 80
Cryptochecksum:1c76f78c8e57ebab6a22f60dc9950dd5
: end
londonpix(config)#
0
 
LVL 36

Expert Comment

by:grblades
Comment Utility
That looks fine now.
0
 
LVL 1

Author Comment

by:magnus911
Comment Utility
ok thanks! just waiting for a couple of traders to leave for the night and then I'm going to try it! Hope it works...thanks so much for your advice! Love this site...
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 
LVL 1

Author Comment

by:magnus911
Comment Utility
Ok Huge problem! I have set it all up and within the LAN it's fine, I can use the internet etc.

However, I've just used another connection to dial in using the CISCO VPN Client. It assigns me an address of 192.168.17.x as it should but i am unable to ping the server at 192.168.16.2 so i am unable to access exchange, shared drive etc.

Any ideas?

0
 
LVL 36

Expert Comment

by:grblades
Comment Utility
On the SBS box make sure you have the subnet mask defined correctly and you have a default gateway of 192.168.20.253 configured aswell.
0
 
LVL 1

Author Comment

by:magnus911
Comment Utility
the subnet mask should be 255.255.255.0 ?
0
 
LVL 1

Author Comment

by:magnus911
Comment Utility
also, most of it is working as if i go to https://217.144.147.66/exchange then i get the OWA from the exchange server...so it must be a vpn routing thing that isn't working, i just don't know enough about Cisco boxes to know what exactly!

0
 
LVL 36

Expert Comment

by:grblades
Comment Utility
What vpn connection method are you using as you have both the cisco vpn client and pptp enabled?

What happens if you try to connect to 192.168.20.2 over the VPN instead of 192.168.16.2?
0
 
LVL 1

Author Comment

by:magnus911
Comment Utility
Ah, I see! the Hosts file should be set so sbs2003 = 192.168.20.2! not 192.168.16.2...

Thanks!

Last thing then - how do i get to access the shared drive? If i start > run \\sbs2003 or \\192.168.20.2 i get an error. i know we set static routes for www, https and smtp so how do i do it for shared files?

thanks!
0
 
LVL 36

Accepted Solution

by:
grblades earned 500 total points
Comment Utility
What VPN connection method are you using?

I will assume you are using the Cisco VPN client which is the best method. You would normally have it configured with entries such as the following. That way your internal DNS server sitting on the SBS server us used for querying all local names while the clients default dns server is used for everything else. By using the local dns server you should be able to resolve the server name.
vpngroup users dns-server 192.168.20.2
vpngroup users default-domain mydomain.local
!--- Use our internal DNS server for looking up our machines but let the client use its normal
!--- DNS server for other sites.
vpngroup users split-dns mydomain.local

However I would have expected you to be able to connect to 192.168.16.2 and \\192.168.20.2 should have worked anyway.

Itys late at hight now in the UK so I will continue to help you in the morning.
0
 
LVL 1

Author Comment

by:magnus911
Comment Utility
thanks!
0
 
LVL 1

Author Comment

by:magnus911
Comment Utility
I'm also in the UK so understand what you mean about the time! When you do come back to this, it is all working fine sort of! I can ping the 192.168.20.2 no problem and can also access exchange etc...
when i try and access the shared drive it prompts for a username and password. I use the administrator one but it rejects it. I've also tried my own user password...

I'm thinking maybe it's because I'm not logged onto the domain but hey! you've answered the main problem!

I will worry about it in the morning...
0
 
LVL 1

Author Comment

by:magnus911
Comment Utility
All done, sorted thanks! I've raised the points because it was tricky and you stuck in there! thanks dude!
0

Featured Post

Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

Like many others, when I created a Windows 2008 RRAS VPN server, I connected via PPTP, and still do, but there are problems that can arise from solely using PPTP.  One particular problem was that the CFO of the company used a Virgin Broadband Wirele…
Overview Often, we set up VPN appliances where the connected clients are on a separate subnet and the company will have alternate internet connections and do not use this particular device as the gateway for certain servers or clients. In this case…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now