• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1656
  • Last Modified:

Cisco VPN 3g card access problem

Hi!! With the help of lots of people on this site, I know have a working Cisco PIX 501 firewall. Only problem is, when I test it using a 3G card it doesn't work. The cisco client will connect, and an ipconfig./all will show it has assigned me an address on the 192.168.17.x subnet, but I am unable to ping anything on the network and Outlook won't connect.

3G card is UK T-mobile...

here is the config:

PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password 1iwWUtCZbeXI9x7r encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname londonpix
domain-name ciscopix.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
name Munich-Lan
name munich
name munichpix
name mail
object-group service Webmail tcp
  description Secure webmail access
  port-object eq www
  port-object eq https
  port-object eq smtp
access-list inside_outbound_nat0_acl permit ip any
access-list inside_outbound_nat0_acl permit ip munich
access-list inside_outbound_nat0_acl permit ip munich
access-list split_T permit ip
access-list split_T permit ip
access-list outside_access_in remark Remoteweb workplace
access-list outside_access_in permit tcp any eq 4125 any eq 4125
access-list outside_access_in permit tcp any interface outside object-group Webmail
access-list outside_cryptomap_20 permit ip munich
access-list outside_cryptomap_20 permit ip munich
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside
ip address inside
ip audit info action alarm
ip audit attack action alarm
ip local pool remote mask
pdm location inside
pdm location inside
pdm location Munich-Lan inside
pdm location inside
pdm location outside
pdm location Munich-Lan outside
pdm location munich outside
pdm location munichpix outside
pdm location outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0 0
static (inside,outside) tcp interface smtp mail smtp netmask 0 0
static (inside,outside) tcp interface www mail www netmask 0 0
static (inside,outside) tcp interface https mail https netmask 0 0
access-group outside_access_in in interface outside
route outside 1
route outside munich 1
route inside mail 1
route outside munichpix 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http Munich-Lan inside
http inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
sysopt connection permit-pptp
sysopt connection permit-l2tp
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 20 ipsec-isakmp
crypto map outside_map 20 match address outside_cryptomap_20
crypto map outside_map 20 set peer munichpix
crypto map outside_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
isakmp enable outside
isakmp key ******** address netmask no-xauth no-config-mode
isakmp key ******** address munichpix netmask no-xauth no-config-mode
isakmp key ******** address netmask no-xauth no-config-mode
isakmp log 1
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup users address-pool remote
vpngroup users dns-server
vpngroup users split-tunnel split_T
vpngroup users idle-time 1800
vpngroup users password ********
telnet outside
telnet timeout 5
ssh timeout 5
console timeout 0
vpdn group users accept dialin l2tp
vpdn group users ppp authentication pap
vpdn group users client configuration address local remote
vpdn group users client authentication local
vpdn group users l2tp tunnel hello 300
vpdn username magnus password *********
dhcpd address inside
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
username lmiles password C2KmXgyDJjL27vvz encrypted privilege 5
username dvago password WXHm1TBh5B6VgDIo encrypted privilege 5
username nlarsen password QtvepTrpg8fR1r86 encrypted privilege 5
username sfallgren password j75viSdKsDioff67 encrypted privilege 5
username treiss password 84cqV/yi9n6c6nuT encrypted privilege 5
username jcgas password uTOiBOn/rmqRSV.v encrypted privilege 5
username akoch password 8KaL7ZAowyWxZxhN encrypted privilege 5
username magnus password qu7pouLeRTTVAQBg encrypted privilege 15
username eyblood password whhCrfoivSj9zJwC encrypted privilege 5
vpnclient server
vpnclient mode client-mode
vpnclient vpngroup users password ********
terminal width 80
: end
1 Solution
Hello again :)

Are you using the cisco vpn client or pptp directly within windows?

If you are using the Cisco client then it could be that 3G network is blocking the ESP protocol which is used to send the encrypted data. Its not uncommon as it is a very unusual protocol (not technically ip) and difficult for firewalls to handle. There is a way around it though which is to add the following line to your configuration :-
isakmp nat-traversal 3600
This will cause the encrypted packets to be sent via the UDP protocol instead which should work better. In the cisco vpn client you need to edit the settings for the connection and enable 'IPSEC over UDP'.
magnus911Author Commented:
Hi Again!

thanks I'll try it. Always using the Cisco VPN client by the way!
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now