• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 448
  • Last Modified:

Pix 506e VPN setup problem

Hey all,
   I am trying to setup my first VPN over this PIX 506e.  I just want to allow VPN access to specific users that travel quite a bit.  I can connect using the Cisco VPN client and it a gives me a local IP address.  However, I cannot route anywhere from there.   for instance I tried to FTP to my FTP server and it just times out.  Here is my config file:  

PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password *********** encrypted
passwd ************** encrypted
hostname PIX506E
domain-name mylocation.net
clock timezone EST 21
clock summer-time EST recurring
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list out_in permit tcp any interface outside eq domain
access-list out_in permit udp any interface outside eq domain
access-list out_in permit tcp any interface outside eq ssh
access-list out_in permit tcp any interface outside eq 8000
access-list out_in permit tcp any interface outside eq 8001
access-list out_in permit tcp any interface outside eq 7000
access-list out_in permit tcp any interface outside eq 5900
access-list out_in permit tcp any interface outside eq pop3
access-list out_in permit tcp any interface outside eq imap4
access-list out_in permit tcp any interface outside eq smtp
access-list out_in permit tcp any interface outside eq www
access-list out_in deny ip any any
access-list NatControl permit ip 0.0.0.0 255.255.255.0 10.197.11.0 255.255.255.0
access-list SplitTunnel permit ip 0.0.0.0 255.255.255.0 10.197.11.0 255.255.255.0
pager lines 24
icmp deny any outside
mtu outside 1500
mtu inside 1500
ip address outside 71.98.xxx.xx 255.255.255.0
ip address inside 10.197.11.x 255.255.254.0
ip audit info action alarm
ip audit attack action alarm
ip local pool vpnpool 10.197.11.xxx-10.197.11.xxx
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 10.0.0.0 255.0.0.0 0 0
nat (inside) 1 0.0.0.0 0.0.0.0 dns 0 0
static (inside,outside) tcp interface www 10.197.11.xx www netmask 255.255.255.255 0 0
static (inside,outside) tcp interface smtp 10.197.11.xx smtp netmask 255.255.255.255 0 0
static (inside,outside) tcp interface domain 10.197.11.xxxdomain netmask 255.255.255.255 0 0
static (inside,outside) udp interface domain 10.197.11.xxx domain netmask 255.255.255.255 0 0
static (inside,outside) tcp interface ftp 10.197.11.xx ftp netmask 255.255.255.255 0 0
static (inside,outside) tcp interface ssh 10.197.11.xx ssh netmask 255.255.255.255 0 0
static (inside,outside) tcp interface pop3 10.197.11.xx pop3 netmask 255.255.255.255 0 0
static (inside,outside) tcp interface 8000 10.197.11.xx 8000 netmask 255.255.255.255 0 0
static (inside,outside) tcp interface 8001 10.197.11.xx 8001 netmask 255.255.255.255 0 0
static (inside,outside) udp interface 8001 10.197.11.xx 8001 netmask 255.255.255.255 0 0
static (inside,outside) udp interface 8000 10.197.11.xx 8000 netmask 255.255.255.255 0 0
static (inside,outside) tcp interface imap4 10.197.11.xx imap4 netmask 255.255.255.255 0 0
static (inside,outside) tcp interface 7000 10.197.11.xx 7000 netmask 255.255.255.255 0 0
static (inside,outside) tcp interface 5900 10.197.11.xx 5900 netmask 255.255.255.255 0 0
access-group out_in in interface outside
route outside 0.0.0.0 0.0.0.0 71.98.xxx.x 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 10.197.10.0 255.255.254.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
fragment chain 1
sysopt connection permit-ipsec
crypto ipsec transform-set AESSHAset esp-aes esp-sha-hmac
crypto dynamic-map dynmap 30 set transform-set AESSHAset
crypto map clientvpnmap 20 ipsec-isakmp dynamic dynmap
crypto map clientvpnmap interface outside
isakmp enable outside
isakmp identity address
isakmp nat-traversal 20
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption aes
isakmp policy 10 hash sha
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
vpngroup clientremote address-pool vpnpool
vpngroup clientremote dns-server 68.238.0.12 68.238.112.12
vpngroup clientremote default-domain nacsolutions.net
vpngroup clientremote split-tunnel SplitTunnel
vpngroup clientremote idle-time 4000
vpngroup clientremote password ********
vpngroup client idle-time 1800
telnet timeout 5
ssh 10.197.0.0 255.255.224.0 inside
ssh timeout 15
console timeout 0
terminal width 80
Cryptochecksum:83617ef87df4c28cdac531f61308eec3
: end
0
gimmiecpt
Asked:
gimmiecpt
  • 6
  • 5
6 Solutions
 
Pete LongConsultantCommented:
try adding

nat (inside) 0 NatControl

0
 
Pete LongConsultantCommented:
oops sorry bad syntax

nat (inside) 0 access-list NatControl
0
 
Pete LongConsultantCommented:
plus its considered bad practice to have your VPN clients on the same subnet as your internal clients
0
Threat Trends for MSPs to Watch

See the findings.
Despite its humble beginnings, phishing has come a long way since those first crudely constructed emails. Today, phishing sites can appear and disappear in the length of a coffee break, and it takes more than a little know-how to keep your clients secure.

 
gimmiecptAuthor Commented:
Master,
    Thank you for the quick response.  I have added the Nat entry, how do I place the vpn clients on a seperate subnet?
0
 
Pete LongConsultantCommented:
You create a DHCP Pool then assign that to your VPN clients

i.e.


first remove the old one

no vpngroup clientremote address-pool vpnpool
no ip local pool vpnpool 10.197.11.xxx-10.197.11.xxx

then add the new one


ip local pool RemotePool 10.15.0.1-10.15.0.254
vpngroup clientremote address-pool RemotePool
access-list NatControl permit ip 10.197.11.xxx 255.255.254.0 10.15.0.0 255.255.255.0

in fact your dynamic map appears to be using AES? Im not sure that this will work at all!!
When I doubt log into the PDM and start again, follow the VPN wizard !



0
 
gimmiecptAuthor Commented:
I have tried to use PDM,  but it won't connect.  I get the password prompt, and get past that.  Allowed popups, and it gives me the certificate error.  After allowing the certificate it prompts me again for the authentication information.  then it says it is connecting, but never does.  I have added a pdm location line in the config.   any ideas?
0
 
Pete LongConsultantCommented:
im guessing thats because you are not in this ip range?

http 10.197.10.0 255.255.254.0 inside

0
 
gimmiecptAuthor Commented:
I am in that range...
0
 
gimmiecptAuthor Commented:
I have downgraded my Java to jre-1_5_0_01.  PDM came up.  I configured VPN through PDM.  I will test and let you know.
0
 
gimmiecptAuthor Commented:
That seemed to do it...   Thanks for your help PeteLong
0
 
Pete LongConsultantCommented:
my pleasure m8
0

Featured Post

Get Certified for a Job in Cybersecurity

Want an exciting career in an emerging field? Earn your MS in Cybersecurity and get certified in ethical hacking or computer forensic investigation. WGU’s MSCSIA degree program was designed to meet the most recent U.S. Department of Homeland Security (DHS) and NSA guidelines.  

  • 6
  • 5
Tackle projects and never again get stuck behind a technical roadblock.
Join Now