Solved

Cisco VPN client to PIX 501 very slow - outlook slow to connect

Posted on 2007-11-27
5
566 Views
Last Modified: 2008-02-01
Hi All,
We have a new SDSL line 1:1 and a new CISCO PIX handling VPN connections to our Small Business Server network.
It works OK but it's very slow. When users connected, Outlook takes forever to respond and half the time it won't connect.
Also, very often we have trouble 'pinging' the mail server at 192.168.20.2 and have to restart in order to cure the problem.

Any ideas why this might be?

Here is the config:

: Saved
:
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password 17r encrypted
passwd 2KFOU encrypted
hostname londonpix
domain-name ciscopix.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 192.168.1.0 Munich-Lan
name 192.168.15.0 munich
name 212.202.225.34 munichpix
name 192.168.20.2 mail
object-group service Webmail tcp
  description Secure webmail access
  port-object eq www
  port-object eq https
  port-object eq smtp
access-list inside_outbound_nat0_acl permit ip any 192.168.17.10 255.255.255.254
access-list inside_outbound_nat0_acl permit ip 192.168.16.0 255.255.255.0 munich 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 192.168.20.0 255.255.255.0 munich 255.255.255.0
access-list split_T permit ip 192.168.16.0 255.255.255.0 192.168.17.0 255.255.255.0
access-list split_T permit ip 192.168.20.0 255.255.255.0 192.168.17.0 255.255.255.0
access-list outside_access_in remark Remoteweb workplace
access-list outside_access_in permit tcp any eq 4125 any eq 4125
access-list outside_access_in permit tcp any interface outside object-group Webmail
access-list outside_cryptomap_20 permit ip 192.168.16.0 255.255.255.0 munich 255.255.255.0
access-list outside_cryptomap_20 permit ip 192.168.20.0 255.255.255.0 munich 255.255.255.0
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 217.144.147.66 255.255.255.252
ip address inside 192.168.20.253 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool remote 192.168.17.10-192.168.17.21 mask 255.255.255.0
pdm location 192.168.16.0 255.255.255.255 inside
pdm location 192.168.16.0 255.255.255.0 inside
pdm location Munich-Lan 255.255.255.0 inside
pdm location 192.168.16.2 255.255.255.255 inside
pdm location 192.168.17.10 255.255.255.254 outside
pdm location Munich-Lan 255.255.255.255 outside
pdm location munich 255.255.255.0 outside
pdm location munichpix 255.255.255.255 outside
pdm location 0.0.0.0 255.255.255.255 outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp interface smtp mail smtp netmask 255.255.255.255 0 0
static (inside,outside) tcp interface www mail www netmask 255.255.255.255 0 0
static (inside,outside) tcp interface https mail https netmask 255.255.255.255 0 0
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 217.144.147.65 1
route outside munich 255.255.255.0 217.144.147.65 1
route inside 192.168.16.0 255.255.255.0 mail 1
route outside munichpix 255.255.255.255 217.144.147.66 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http Munich-Lan 255.255.255.0 inside
http 192.168.16.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
sysopt connection permit-pptp
sysopt connection permit-l2tp
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 20 ipsec-isakmp
crypto map outside_map 20 match address outside_cryptomap_20
crypto map outside_map 20 set peer munichpix
crypto map outside_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
isakmp enable outside
isakmp key ******** address 212.202.225.48 netmask 255.255.255.255 no-xauth no-config-mode
isakmp key ******** address munichpix netmask 255.255.255.255 no-xauth no-config-mode
isakmp key ******** address 0.0.0.0 netmask 255.255.255.255 no-xauth no-config-mode
isakmp nat-traversal 3600
isakmp log 1
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup users address-pool remote
vpngroup users dns-server mail
vpngroup users split-tunnel split_T
vpngroup users idle-time 1800
vpngroup users password ********
telnet 0.0.0.0 255.255.255.255 outside
telnet timeout 5
ssh timeout 5
console timeout 0
vpdn group users accept dialin l2tp
vpdn group users ppp authentication pap
vpdn group users client configuration address local remote
vpdn group users client authentication local
vpdn group users l2tp tunnel hello 300
vpdn username magnus password *********
dhcpd address 192.168.20.3-192.168.20.10 inside
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
username lmiles password C2K7vvz encrypted privilege 5
username dvago password WXgDIo encrypted privilege 5
username nlarsen password QtR1r86 encrypted privilege 5
username sfallgren password j767 encrypted privilege 5
username treiss password 84cqT encrypted privilege 5
username jcgas password uTOiBncrypted privilege 5
username akoch password 8KaLZxhN encrypted privilege 5
username magnus password qu7g encrypted privilege 15
username eyblood password whhCrfoivSj9zJwC encrypted privilege 5
vpnclient server 217.144.147.66
vpnclient mode client-mode
vpnclient vpngroup users password ********
terminal width 80
Cryptochecksum:4feae555fe0a8b1e1fb56e89d0dc7f6d
: end
londonpix(config)# crypto map outside_map client authentication LOCAL
londonpix(config)#
0
Comment
Question by:magnus911
  • 3
  • 2
5 Comments
 
LVL 36

Expert Comment

by:grblades
Comment Utility
I take it that when you say outlook has problem connecting you are using it in exchange mode.

For the benefit of other experts the SBS server is dual homed between the vpn network and the internal network.

You say you have to reboot to get things working again. What do you reboot?

On the SBS server can you bring up a command prompt and post the output from the following commands :-
ipconfig /all
route print
0
 
LVL 1

Author Comment

by:magnus911
Comment Utility
Sorry I'm not being clear. Forget the reboot thing...I only had to do that once because for some reason i couldn't ping 192.168.20.2 so I rebooted the PIX and then all was well.

My problem with Outlook (yes on exchange) is that it takes around 3 minutes to say 'connected'. After that time it's fine, but why the delay? It should be much faster. When you open it it says 'trying to connect' for at least 3 minutes before saying 'connected'.

Bit tricky to post the route print as you ask because i can't copy and paste from cmd!

0
 
LVL 36

Expert Comment

by:grblades
Comment Utility
To copy from cmd you can select the text (drag the white box over all the text) and then press the enter key. It is a very strange way of doing a copy but it does work!
0
 
LVL 1

Author Comment

by:magnus911
Comment Utility
Oh I see, that'll come in useful thanks!

Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

C:\Documents and Settings\Administrator>ipconfig /all

Windows IP Configuration

   Host Name . . . . . . . . . . . . : SBS2003
   Primary Dns Suffix  . . . . . . . : acpcapital.local
   Node Type . . . . . . . . . . . . : Unknown
   IP Routing Enabled. . . . . . . . : Yes
   WINS Proxy Enabled. . . . . . . . : Yes
   DNS Suffix Search List. . . . . . : acpcapital.local

PPP adapter RAS Server (Dial In) Interface:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : WAN (PPP/SLIP) Interface
   Physical Address. . . . . . . . . : 00-53-45-00-00-00
   DHCP Enabled. . . . . . . . . . . : No
   IP Address. . . . . . . . . . . . : 192.168.16.31
   Subnet Mask . . . . . . . . . . . : 255.255.255.255
   Default Gateway . . . . . . . . . :
   NetBIOS over Tcpip. . . . . . . . : Disabled

Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Intel(R) PRO/100 S Server Adapter #2
   Physical Address. . . . . . . . . : 00-02-B3-B2-84-D2
   DHCP Enabled. . . . . . . . . . . : No
   IP Address. . . . . . . . . . . . : 192.168.20.2
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.20.253
   DNS Servers . . . . . . . . . . . : 192.168.20.253
   NetBIOS over Tcpip. . . . . . . . : Disabled

Ethernet adapter Server Local Area Connection:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network Connection
   Physical Address. . . . . . . . . : 00-14-22-0B-71-78
   DHCP Enabled. . . . . . . . . . . : No
   IP Address. . . . . . . . . . . . : 192.168.16.2
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . :
   DNS Servers . . . . . . . . . . . : 192.168.16.2
   Primary WINS Server . . . . . . . : 192.168.16.2

C:\Documents and Settings\Administrator>route print

IPv4 Route Table
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x10002 ...00 53 45 00 00 00 ...... WAN (PPP/SLIP) Interface
0x10003 ...00 02 b3 b2 84 d2 ...... Intel(R) PRO/100 S Server Adapter #2
0x10004 ...00 14 22 0b 71 78 ...... Intel(R) PRO/1000 MT Network Connection
===========================================================================
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0   192.168.20.253     192.168.20.2     20
        127.0.0.0        255.0.0.0        127.0.0.1        127.0.0.1      1
     192.168.16.0    255.255.255.0     192.168.16.2     192.168.16.2     10
     192.168.16.2  255.255.255.255        127.0.0.1        127.0.0.1     10
    192.168.16.31  255.255.255.255        127.0.0.1        127.0.0.1     50
   192.168.16.255  255.255.255.255     192.168.16.2     192.168.16.2     10
     192.168.20.0    255.255.255.0     192.168.20.2     192.168.20.2     20
     192.168.20.2  255.255.255.255        127.0.0.1        127.0.0.1     20
   192.168.20.255  255.255.255.255     192.168.20.2     192.168.20.2     20
        224.0.0.0        240.0.0.0     192.168.16.2     192.168.16.2     10
        224.0.0.0        240.0.0.0     192.168.20.2     192.168.20.2     20
  255.255.255.255  255.255.255.255     192.168.16.2     192.168.16.2      1
  255.255.255.255  255.255.255.255     192.168.20.2     192.168.20.2      1
Default Gateway:    192.168.20.253
===========================================================================
Persistent Routes:
  None

C:\Documents and Settings\Administrator>
0
 
LVL 36

Accepted Solution

by:
grblades earned 500 total points
Comment Utility
> DNS Servers . . . . . . . . . . . : 192.168.20.253
That doesnt look right. I am not sure if it will really cause a problem though but then again I am not that familiar with windows servers. I would certenly fix it and give it another go though.
0

Featured Post

Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

Join & Write a Comment

This article assumes you have at least one Cisco ASA or PIX configured with working internet and a non-dynamic, public, address on the outside interface. If you need instructions on how to enable your device for internet, or basic configuration info…
Because virtualization becomes more and more common, and, with Microsoft Hyper-V included in Windows Server at no additional costs, and, most server hardware nowadays is more than capable of running a physical Small Business Server (SBS) 2008 or 201…
Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…
This demo shows you how to set up the containerized NetScaler CPX with NetScaler Management and Analytics System in a non-routable Mesos/Marathon environment for use with Micro-Services applications.

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now