I've been working on this problem for a month and I've hit a wall. I've got some users who need to start working from home and I have to get VPN up on our PIX515 ASAP. We have an inside,dmz,&outside zones setup currently. I have an IPSEC tunnel setup already on the pix to access ANX network. I also have group of users that use a Nortel Client to access another companies VPN. Everytime I try to setup ipsec for my remote users, I take down either my ANX tunnel or my Nortel VPN users. I need my external users to be able to get to all inside network resources. If someone is located in Southeastern Michigan, I will contract out for help since I'm desperate. Here's my Pix config... PIX Version 6.2(2) nameif ethernet0 outside security0 nameif ethernet1 inside security100 nameif ethernet2 dmz security50 enable password LTPL3EG2CAB2Dllq encrypted passwd LTPL3EG2CAB2Dllq encrypted hostname fwpartech1 domain-name partechgss.com clock timezone EST -5 clock summer-time EDT recurring fixup protocol ftp 21 fixup protocol http 80 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol ils 389 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol sip 5060 fixup protocol skinny 2000 names name 209.196.42.201 IsuzuONE name 192.168.1.25 WebServer1 name 144.228.79.182 ITR_TAL_Server name 64.118.139.52 secondary_dns name 64.118.139.51 primary_dns name 192.168.0.205 TAL_Gheald name 192.168.0.204 TAL_MRuiz name 192.168.0.203 TAL_GBriolat name 192.168.0.202 TAL_GKolb name 192.168.0.201 TAL_MWedge name 192.168.0.206 eSI_PNair name 192.85.5.49 GMeSI_dbserver name 192.168.0.98 ACasadei object-group service isuzuvpntcp tcp port-object eq h323 port-object eq 17 port-object eq 50 object-group service isuzuvpn udp port-object eq secureid-udp port-object range isakmp 600 object-group network TAL_ref network-object 64.118.150.213 255.255.255.255 network-object 64.118.150.214 255.255.255.255 network-object 64.118.150.215 255.255.255.255 network-object 64.118.150.217 255.255.255.255 network-object 64.118.150.216 255.255.255.255 object-group network TAL network-object TAL_MWedge 255.255.255.255 network-object TAL_GKolb 255.255.255.255 network-object TAL_GBriolat 255.255.255.255 network-object TAL_MRuiz 255.255.255.255 network-object TAL_Gheald 255.255.255.255 object-group network TAL_ref_1 network-object 64.118.150.213 255.255.255.255 network-object 64.118.150.214 255.255.255.255 network-object 64.118.150.217 255.255.255.255 network-object 64.118.150.216 255.255.255.255 network-object 64.118.150.215 255.255.255.255 object-group network GM_eSI network-object eSI_PNair 255.255.255.255 object-group network GM_eSI_ref network-object 64.118.150.220 255.255.255.255 access-list outside_access_in permit tcp any host 64.118.150.212 eq www access-list outside_access_in permit tcp any host 64.118.150.212 eq ftp access-list outside_access_in permit tcp any host 64.118.150.212 eq ftp-data access-list outside_access_in permit tcp any host 64.118.150.212 eq smtp access-list outside_access_in permit icmp host 64.118.150.210 64.118.150.208 25 ..255.255.240 echo-reply access-list outside_access_in permit udp host ITR_TAL_Server eq isakmp object-g oup TAL_ref_1 access-list outside_access_in permit esp host ITR_TAL_Server object-group TAL_r f_1 access-list outside_access_in permit ip host GMeSI_dbserver object-group GM_eSI ref access-list outside_access_in permit icmp host GMeSI_dbserver object-group GM_e I_ref access-list outside_access_in permit udp host GMeSI_dbserver object-group GM_eS _ref access-list dmz_access_in permit icmp 192.168.1.0 255.255.255.0 192.168.0.0 255 255.255.0 echo-reply access-list dmz_access_in permit tcp host WebServer1 host primary_dns access-list dmz_access_in deny ip 192.168.1.0 255.255.255.0 192.168.0.0 255.255 255.0 access-list dmz_access_in permit ip any any access-list inside_access_in permit ip any any access-list 110 permit ip host 64.118.150.210 host GMeSI_dbserver access-list 110 permit ip host 64.118.150.220 host GMeSI_dbserver pager lines 24 logging on logging timestamp logging trap notifications logging history notifications logging host inside 192.168.0.1 interface ethernet0 auto interface ethernet1 auto interface ethernet2 auto mtu outside 1500 mtu inside 1500 mtu dmz 1500 ip address outside 64.118.150.210 255.255.255.248 ip address inside 192.168.0.10 255.255.255.0 ip address dmz 192.168.1.10 255.255.255.0 ip verify reverse-path interface inside ip verify reverse-path interface dmz ip audit info action alarm ip audit attack action alarm pdm location 192.168.0.2 255.255.255.255 inside pdm location 192.168.0.99 255.255.255.255 inside pdm location 0.0.0.0 255.255.255.0 inside pdm location 0.0.0.0 255.255.255.0 outside pdm location 192.168.0.97 255.255.255.255 inside pdm location WebServer1 255.255.255.255 dmz pdm location IsuzuONE 255.255.255.255 outside pdm location 192.168.0.1 255.255.255.255 inside pdm location ITR_TAL_Server 255.255.255.255 outside pdm location 206.126.161.15 255.255.255.255 outside pdm location 64.118.150.212 255.255.255.255 outside pdm location primary_dns 255.255.255.255 outside pdm location secondary_dns 255.255.255.255 outside pdm location TAL_MWedge 255.255.255.255 inside pdm location TAL_GKolb 255.255.255.255 inside pdm location TAL_GBriolat 255.255.255.255 inside pdm location TAL_MRuiz 255.255.255.255 inside pdm location TAL_Gheald 255.255.255.255 inside pdm location 192.168.1.16 255.255.255.240 dmz pdm location GMeSI_dbserver 255.255.255.255 outside pdm location 192.168.0.192 255.255.255.192 inside pdm location eSI_PNair 255.255.255.255 inside pdm location ACasadei 255.255.255.255 inside pdm group TAL inside pdm group TAL_ref_1 outside reference TAL pdm group GM_eSI inside pdm group GM_eSI_ref outside reference GM_eSI pdm logging informational 100 pdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 1 192.168.0.0 255.255.255.0 0 0 static (inside,dmz) 192.168.0.0 192.168.0.0 netmask 255.255.255.0 0 0 static (dmz,outside) 64.118.150.212 WebServer1 dns netmask 255.255.255.255 0 0 static (inside,outside) 64.118.150.213 TAL_MWedge netmask 255.255.255.255 0 0 static (inside,outside) 64.118.150.214 TAL_GKolb netmask 255.255.255.255 0 0 static (inside,outside) 64.118.150.215 TAL_Gheald netmask 255.255.255.255 0 0 static (inside,outside) 64.118.150.217 TAL_GBriolat netmask 255.255.255.255 0 0 static (inside,outside) 64.118.150.216 TAL_MRuiz netmask 255.255.255.255 0 0 static (inside,outside) 64.118.150.220 eSI_PNair netmask 255.255.255.255 0 0 access-group outside_access_in in interface outside access-group inside_access_in in interface inside access-group dmz_access_in in interface dmz route outside 0.0.0.0 0.0.0.0 64.118.150.209 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 s p 0:30:00 sip_media 0:02:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server RADIUS protocol radius aaa-server LOCAL protocol local http server enable http ACasadei 255.255.255.255 inside http 192.168.0.99 255.255.255.255 inside http 192.168.0.1 255.255.255.255 inside no snmp-server location no snmp-server contact snmp-server community public no snmp-server enable traps floodguard enable sysopt connection permit-ipsec sysopt connection permit-pptp no sysopt route dnat crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac crypto ipsec transform-set anx esp-des esp-md5-hmac crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto dynamic-map inside_dyn_map 20 set transform-set ESP-DES-SHA crypto dynamic-map inside_dyn_map 40 set transform-set ESP-3DES-SHA crypto map inside_map 65535 ipsec-isakmp dynamic inside_dyn_map crypto map inside_map interface inside crypto map ipsec 30 ipsec-isakmp crypto map ipsec 30 match address 110 crypto map ipsec 30 set peer 198.208.7.2 crypto map ipsec 30 set transform-set anx crypto map ipsec interface outside isakmp enable outside isakmp enable inside isakmp key ******** address 198.208.7.2 netmask 255.255.255.255 isakmp peer ip 144.228.79.182 no-xauth no-config-mode isakmp policy 20 authentication pre-share isakmp policy 20 encryption des isakmp policy 20 hash sha isakmp policy 20 group 2 isakmp policy 20 lifetime 86400 isakmp policy 30 authentication pre-share isakmp policy 30 encryption des isakmp policy 30 hash md5 isakmp policy 30 group 1 isakmp policy 30 lifetime 86400 isakmp policy 40 authentication rsa-sig isakmp policy 40 encryption des isakmp policy 40 hash sha isakmp policy 40 group 2 isakmp policy 40 lifetime 86400 isakmp policy 60 authentication pre-share isakmp policy 60 encryption 3des isakmp policy 60 hash sha isakmp policy 60 group 2 isakmp policy 60 lifetime 86400 telnet 192.168.0.99 255.255.255.255 inside telnet 192.168.0.1 255.255.255.255 inside telnet ACasadei 255.255.255.255 inside telnet timeout 5 ssh timeout 5 vpdn username acasadei password ******** vpdn enable outside vpdn enable inside vpdn enable dmz terminal width 80
