Pix Client VPN config help

Discussion in 'Cisco' started by Grey Samuels, Jan 16, 2004.

  1. Grey Samuels

    Grey Samuels Guest

    I am trying to set up a client vpn on a pix 501. It will authenticate
    the user but once connected you can not access anything on the
    network. Here is the config all help appreciated! Thanks!

    jbcpa# show config
    : Saved
    : Written by enable_15 at 01:38:12.174 UTC Fri Jan 16 2004
    PIX Version 6.3(3)
    interface ethernet0 10baset
    interface ethernet1 100full
    nameif ethernet0 outside security0
    nameif ethernet1 inside security100
    enable password 8Ry2YIyt7RRXU24 encrypted
    passwd 2KFQnbIdI.2KYOU encrypted
    hostname jbcpa
    fixup protocol dns maximum-length 512
    fixup protocol ftp 21
    fixup protocol h323 h225 1720
    fixup protocol h323 ras 1718-1719
    fixup protocol http 80
    fixup protocol ils 389
    fixup protocol rsh 514
    fixup protocol rtsp 554
    fixup protocol sip 5060
    fixup protocol sip udp 5060
    fixup protocol skinny 2000
    fixup protocol smtp 25
    fixup protocol sqlnet 1521
    fixup protocol tftp 69
    names
    access-list mail_in permit tcp any any eq smtp
    access-list mail_in permit tcp any any eq pop3
    access-list mail_in permit tcp any any eq 3389
    pager lines 24
    icmp permit any outside
    mtu outside 1500
    mtu inside 1500
    ip address outside 216.218.111.73 255.255.255.0
    ip address inside 192.168.0.1 255.255.255.0
    ip audit info action alarm
    ip audit attack action alarm
    ip local pool vpnpool 192.168.0.126-192.168.0.131
    pdm logging informational 100
    pdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 1 0.0.0.0 0.0.0.0 0 0
    static (inside,outside) tcp interface smtp 192.168.0.2 smtp netmask
    255.255.255.
    255 0 0
    static (inside,outside) tcp interface pop3 192.168.0.2 pop3 netmask
    255.255.255.
    255 0 0
    static (inside,outside) tcp interface 3389 192.168.0.2 3389 netmask
    255.255.255.
    255 0 0
    access-group mail_in in interface outside
    route outside 0.0.0.0 0.0.0.0 216.218.111.1 1
    timeout xlate 0:05:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225
    1:00:00
    timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout uauth 0:05:00 absolute
    aaa-server TACACS+ protocol tacacs+
    aaa-server RADIUS protocol radius
    aaa-server LOCAL protocol local
    aaa-server partnerauth protocol radius
    aaa-server partnerauth (inside) host 192.168.0.2 ****** timeout 15
    aaa-server vpnclient protocol radius
    aaa-server vpnclient (inside) host 192.168.0.2 ****** timeout 15
    http server enable
    http 192.168.0.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    no snmp-server enable traps
    floodguard enable
    sysopt connection permit-ipsec
    crypto ipsec transform-set vpndial esp-des esp-md5-hmac
    crypto dynamic-map dynmap 10 set transform-set vpndial
    crypto map mymap 10 ipsec-isakmp dynamic dynmap
    crypto map mymap client authentication vpnclient
    crypto map mymap interface outside
    isakmp enable outside
    isakmp identity address
    isakmp policy 10 authentication pre-share
    isakmp policy 10 encryption des
    isakmp policy 10 hash md5
    isakmp policy 10 group 2
    isakmp policy 10 lifetime 86400
    vpngroup vpn3000 idle-time 1800
    vpngroup vpnclient address-pool vpnpool
    vpngroup vpnclient dns-server 192.168.0.2
    vpngroup vpnclient default-domain ja.com
    vpngroup vpnclient idle-time 1800
    vpngroup vpnclient password *******
    telnet 192.168.0.2 255.255.255.255 inside
    telnet timeout 5
    ssh timeout 5
    management-access inside
    console timeout 0
    dhcpd address 192.168.0.100-192.168.0.125 inside
    dhcpd dns 192.168.0.2
    dhcpd lease 3600
    dhcpd ping_timeout 750
    dhcpd auto_config outside
    terminal width 80
    Cryptochecksum:9e808878a679731d327b752b2da20c4b
    jbcpa#
     
    Grey Samuels, Jan 16, 2004
    #1
    1. Advertising

  2. Grey Samuels

    Rik Bain Guest

    What addresses are you trying to connect to? Internal "private"
    addresses? If so, you need to configure nat 0 to bypass nat:


    :
    access-list nonat permit ip 192.168.0.0 255.255.255.0 192.168.0.0 255.255.255.0
    nat (inside) 0 access-list nonat
    :


    Rik Bain


    On Fri, 16 Jan 2004 12:15:40 -0600, Grey Samuels wrote:

    > I am trying to set up a client vpn on a pix 501. It will authenticate
    > the user but once connected you can not access anything on the network.
    > Here is the config all help appreciated! Thanks!
    >
    > jbcpa# show config
    > : Saved
    > : Written by enable_15 at 01:38:12.174 UTC Fri Jan 16 2004
    > PIX Version 6.3(3)
    > interface ethernet0 10baset
    > interface ethernet1 100full
    > nameif ethernet0 outside security0
    > nameif ethernet1 inside security100
    > enable password 8Ry2YIyt7RRXU24 encrypted passwd 2KFQnbIdI.2KYOU
    > encrypted
    > hostname jbcpa
    > fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup
    > protocol h323 h225 1720
    > fixup protocol h323 ras 1718-1719
    > fixup protocol http 80
    > fixup protocol ils 389
    > fixup protocol rsh 514
    > fixup protocol rtsp 554
    > fixup protocol sip 5060
    > fixup protocol sip udp 5060
    > fixup protocol skinny 2000
    > fixup protocol smtp 25
    > fixup protocol sqlnet 1521
    > fixup protocol tftp 69
    > names
    > access-list mail_in permit tcp any any eq smtp access-list mail_in
    > permit tcp any any eq pop3 access-list mail_in permit tcp any any eq
    > 3389 pager lines 24
    > icmp permit any outside
    > mtu outside 1500
    > mtu inside 1500
    > ip address outside 216.218.111.73 255.255.255.0 ip address inside
    > 192.168.0.1 255.255.255.0 ip audit info action alarm ip audit attack
    > action alarm
    > ip local pool vpnpool 192.168.0.126-192.168.0.131 pdm logging
    > informational 100
    > pdm history enable
    > arp timeout 14400
    > global (outside) 1 interface
    > nat (inside) 1 0.0.0.0 0.0.0.0 0 0
    > static (inside,outside) tcp interface smtp 192.168.0.2 smtp netmask
    > 255.255.255.
    > 255 0 0
    > static (inside,outside) tcp interface pop3 192.168.0.2 pop3 netmask
    > 255.255.255.
    > 255 0 0
    > static (inside,outside) tcp interface 3389 192.168.0.2 3389 netmask
    > 255.255.255.
    > 255 0 0
    > access-group mail_in in interface outside route outside 0.0.0.0 0.0.0.0
    > 216.218.111.1 1 timeout xlate 0:05:00 timeout conn 1:00:00 half-closed
    > 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
    > timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout
    > uauth 0:05:00 absolute
    > aaa-server TACACS+ protocol tacacs+
    > aaa-server RADIUS protocol radius
    > aaa-server LOCAL protocol local
    > aaa-server partnerauth protocol radius aaa-server partnerauth (inside)
    > host 192.168.0.2 ****** timeout 15 aaa-server vpnclient protocol radius
    > aaa-server vpnclient (inside) host 192.168.0.2 ****** timeout 15 http
    > server enable
    > http 192.168.0.0 255.255.255.0 inside no snmp-server location no
    > snmp-server contact
    > snmp-server community public
    > no snmp-server enable traps
    > floodguard enable
    > sysopt connection permit-ipsec
    > crypto ipsec transform-set vpndial esp-des esp-md5-hmac crypto
    > dynamic-map dynmap 10 set transform-set vpndial crypto map mymap 10
    > ipsec-isakmp dynamic dynmap crypto map mymap client authentication
    > vpnclient crypto map mymap interface outside isakmp enable outside
    > isakmp identity address
    > isakmp policy 10 authentication pre-share isakmp policy 10 encryption
    > des
    > isakmp policy 10 hash md5
    > isakmp policy 10 group 2
    > isakmp policy 10 lifetime 86400
    > vpngroup vpn3000 idle-time 1800
    > vpngroup vpnclient address-pool vpnpool vpngroup vpnclient dns-server
    > 192.168.0.2 vpngroup vpnclient default-domain ja.com vpngroup vpnclient
    > idle-time 1800
    > vpngroup vpnclient password *******
    > telnet 192.168.0.2 255.255.255.255 inside telnet timeout 5 ssh timeout 5
    > management-access inside
    > console timeout 0
    > dhcpd address 192.168.0.100-192.168.0.125 inside dhcpd dns 192.168.0.2
    > dhcpd lease 3600
    > dhcpd ping_timeout 750
    > dhcpd auto_config outside
    > terminal width 80
    > Cryptochecksum:9e808878a679731d327b752b2da20c4b jbcpa#
     
    Rik Bain, Jan 16, 2004
    #2
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. MP
    Replies:
    2
    Views:
    12,393
  2. GVB
    Replies:
    1
    Views:
    2,895
    Martin Bilgrav
    Feb 6, 2004
  3. Nick
    Replies:
    2
    Views:
    2,474
  4. Svenn
    Replies:
    3
    Views:
    765
    Svenn
    Mar 13, 2006
  5. Replies:
    1
    Views:
    4,912
    Martin Bilgrav
    Sep 9, 2006
Loading...

Share This Page