ipsec vpn pix506 cant see internal network

Discussion in 'Hardware' started by lokojones, Jun 26, 2009.

  1. lokojones

    lokojones

    Joined:
    Jun 26, 2009
    Messages:
    2
    hi everyone
    same as title.im able to establish vpn connection, but dont see internal network

    PIX Version 6.3(5)
    interface ethernet0 auto
    interface ethernet1 auto
    nameif ethernet0 outside security0
    nameif ethernet1 inside security100
    enable password 9oxbv7Ut.gwTPTmC encrypted
    passwd 9oxbv7Ut.gwTPTmC encrypted
    hostname pix506
    domain-name squareball.info
    fixup protocol dns maximum-length 512
    fixup protocol ftp 21
    fixup protocol h323 h225 1720
    fixup protocol h323 ras 1718-1719
    fixup protocol http 80
    fixup protocol rsh 514
    fixup protocol rtsp 554
    fixup protocol sip 5060
    fixup protocol sip udp 5060
    fixup protocol skinny 2000
    fixup protocol smtp 25
    fixup protocol sqlnet 1521
    fixup protocol tftp 69
    names
    access-list inbound permit icmp any any
    pager lines 24
    mtu outside 1500
    mtu inside 1500
    ip address outside dhcp setroute
    ip address inside 192.168.3.1 255.255.255.0
    ip audit info action alarm
    ip audit attack action alarm
    ip local pool test 192.168.3.50-192.168.3.60
    pdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 1 0.0.0.0 0.0.0.0 0 0
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
    timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout sip-disconnect 0:02:00 sip-invite 0:03:00
    timeout uauth 0:05:00 absolute
    aaa-server TACACS+ protocol tacacs+
    aaa-server TACACS+ max-failed-attempts 3
    aaa-server TACACS+ deadtime 10
    aaa-server RADIUS protocol radius
    aaa-server RADIUS max-failed-attempts 3
    aaa-server RADIUS deadtime 10
    aaa-server LOCAL protocol local
    http server enable
    http 192.168.3.0 255.255.255.255 inside
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    no snmp-server enable traps
    floodguard enable
    sysopt connection permit-ipsec
    crypto ipsec transform-set myset esp-3des esp-md5-hmac
    crypto dynamic-map dynmap 30 set transform-set myset
    crypto map newmap 65000 ipsec-isakmp dynamic dynmap
    crypto map mymap 30 ipsec-isakmp dynamic dynmap
    crypto map mymap interface outside
    isakmp enable outside
    isakmp identity address
    isakmp policy 10 authentication pre-share
    isakmp policy 10 encryption 3des
    isakmp policy 10 hash md5
    isakmp policy 10 group 2
    isakmp policy 10 lifetime 86400
    vpngroup vpn3000 address-pool test
    vpngroup vpn3000 dns-server 194.168.4.100 194.168.8.100
    vpngroup vpn3000 idle-time 1800
    vpngroup vpn3000 password ********
    telnet 192.168.3.0 255.255.255.0 inside
    telnet timeout 20
    ssh timeout 5
    console timeout 0
    dhcpd address 192.168.3.20-192.168.3.30 inside
    dhcpd dns 194.168.4.100 194.168.8.100
    dhcpd lease 3600
    dhcpd ping_timeout 750
    dhcpd enable inside
    terminal width 80
    Cryptochecksum:080b0596eb19f0ca5aaa7174d1ce34a7
    : end
    [OK]

    i know this is somethings to do with ipsec through NAT
    so i tried with extra config:

    access-list nonat permit ip 192.168.3.0 255.255.255.0 192.168.3.0 255.255.255.0
    nat (inside) 0 access-list nonat

    if i good understanding nat 0 is no nat for incomming network 192.168.3.0 which going to 192.168.3.0

    inforjunetly is not working:(
    topology: dchp modem <--> pix 506 <--> internal network
    any help
    lokojones, Jun 26, 2009
    #1
    1. Advertising

  2. lokojones

    adeelasher

    Joined:
    Jun 29, 2009
    Messages:
    19
    Try
    isakmp nat-traversal
    adeelasher, Jun 29, 2009
    #2
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Vincent
    Replies:
    0
    Views:
    2,099
    Vincent
    Apr 5, 2005
  2. eric the brave
    Replies:
    0
    Views:
    1,038
    eric the brave
    Mar 5, 2006
  3. Agile.Aspect@gmail.com

    PIX506 and second internal network

    Agile.Aspect@gmail.com, Jun 21, 2007, in forum: Cisco
    Replies:
    3
    Views:
    634
    Walter Roberson
    Jun 22, 2007
  4. Ned
    Replies:
    2
    Views:
    540
    benner
    Aug 17, 2007
  5. johnz
    Replies:
    3
    Views:
    1,493
    jrguent@gmail.com
    Aug 20, 2009
Loading...

Share This Page