Cisco PIX 501 to Cisco 3005 concentrator via remote access
Hello people,
I need your help.
We got a Cisco PIX 501 in one place and this pix is configured for pppoe connection. The pix connects to internet via the pppoe client. an official ip address ping works well.
So what I want to do is to establish a tunnel von between this pix and a cisco 3005 concentrator.
But I failed to establish it.
Here are the pix config. the acl? s are only for the test and will be replaced if it works.
6.3 (4) version PIX
interface ethernet0 10baset
interface ethernet1 100full
ethernet0 nameif outside security0
nameif ethernet1 inside the security100
activate the password xxx
passwd xxx
hostname PIX - to THE
domain araukraine.ua
fixup protocol dns-length maximum 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol they 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol 2000 skinny
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names of
outside ip access list allow a whole
inside_access_in ip access list allow a whole
pager lines 24
opening of session
Monitor logging warnings
logging warnings put in buffered memory
MTU outside 1456
MTU inside 1456
IP address outside pppoe setroute
IP address inside 192.168.x.x 255.255.255.0
alarm action IP verification of information
alarm action attack IP audit
PDM location 192.168.x.x 255.255.255.224 inside
forest warnings of PDM 500
history of PDM activate
ARP timeout 14400
Global 1 interface (outside)
NAT (inside) 1 0.0.0.0 0.0.0.0 0 0
outside access-group in external interface
inside_access_in access to the interface inside group
Timeout xlate 0:05:00
Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225
H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00
Timeout, uauth 0:05:00 absolute
GANYMEDE + Protocol Ganymede + AAA-server
AAA-server GANYMEDE + 3 max-failed-attempts
AAA-server GANYMEDE + deadtime 10
RADIUS Protocol RADIUS AAA server
AAA-server RADIUS 3 max-failed-attempts
AAA-RADIUS deadtime 10 Server
AAA-server local LOCAL Protocol
the ssh LOCAL console AAA authentication
Enable http server
255.255.x.x 192.168.x.x http inside
No snmp server location
No snmp Server contact
SNMP-Server Community public
No trap to activate snmp Server
enable floodguard
255.255.x.x telnet inside 192.168.x.x
Telnet timeout 5
SSH 194.39.97.0 255.255.255.0 outside
SSH timeout 5
management-access inside
Console timeout 0
VPDN group pppoe_group request dialout pppoe
VPDN group pppoe_group localname [email protected] / * /
VPDN group ppp authentication pap pppoe_group
VPDN username [email protected] / * / password *.
encrypted privilege 15
vpnclient Server 212.xx.xx.xx
vpnclient mode network-extension-mode
vpntest vpngroup vpnclient password *.
vpnclient username pixtest password *.
Terminal width 80
the hub, I created a user pixtest, a group vpntest and I? ve created the rules of the network for example to what server, users behind the pix will be able to access.
And that? s all.
I couldn't send you exit pix or hub because I don't have an error or a message that the tunnel will be established.
What can be wrong?
Thanks for the replies
This configuration example shows how to create an IPsec tunnel to a computer that is running the Client VPN Cisco's (4.x and later versions) to a Cisco VPN concentrator 3000 to allow the user to safely access the network inside the VPN concentrator.
Tags: Cisco Security
Similar Questions
-
ODA IP ASA when you browse the web via remote access vpn
Hi all
I was wondering if it is possible to configure an ASA5510 in a way to allow users remote access VPN use external IP of the ASA when browsing the web. So what I'm looking for is a solution to hide my IP address and use the IP address of the ASA, when browsing.
The firmware version of the ASA is 9.1 (6)
Thanks in advance
Hello
What you want to achieve is calles u-turn.
You must enable the feature allowed same-security-traffic intra-interface
For the configuration of the asa, here's the Cisco documentation (I don't copy paste on the post):
http://www.Cisco.com/c/en/us/support/docs/security/ASA-5500-x-series-NEX...
Thank you
PS: Please do not forget to rate and score as good response if this solves your problem
-
1841 as Concentrator VPN remote access with manual keying
Hi there and happy new year 2011 with best wishes!
I would use a router 1841 as VPN hub for up to 20 remote connections.
My remote (third party) clients have IPsec capacity supported by IKE and the Manual Keying, but I have not found information about simple configuration of Cisco VPN remote access (only on the easy VPN server).
I'd like to configure the VPN entry Server Manual (I think it's an easy way to start), no problem to do?
files:
-topology
-third party router Ethernet / 3G GUI IPsec with choice of algorithm auth
-third party router Ethernet / 3G GUI IPsec with choice of encryption algorithm
I feel so much better that someone help me!
Kind regards
Amaury
As the remote end is third-party routers, the only option you have will be LAN-to-LAN IPSec VPN. You can not run VPN easy because that is only supported on Cisco devices.
If your remote end has a static external ip address that ends the VPN, you can configure card crypto static LAN-to-LAN on the 1841 router, however, if your remote end has dynamic external ip address, you must configure card crypto dynamic LAN-to-LAN on the 1841 router. All remote LAN subnets must be unique.
-
How to configure VPN 3000 Concentrator for remote access
I have inherited a VPN concentrator and want to configure it to provide remote access to my internal laboratory network when I'm traveling. Private interface is configured as 192.168.1.240/24. Public interface is configured as one of my public IP addresses. I have a public IP pool on the back side of a cable modem Roadrunner. I created a pool of addresses for clients such as 192.168.1.200 by 192.168.1.205. I created all group configurations, group and user base.
In the IP Routing tab, I see a default route pointing to my IP address of public gateway - the IP address of my box of roadrunner cable modem gateway.
Since my VPN client, I am able to connect to the VPN concentrator. I get an address from the pool and check the details of the tunnel under the statistics section shows IP address correct pool for the customer and the correct public IP address of my VPN reorga
Jeff,
According to statistics, it seems that the client sends traffic to the hub, but his answer not get back.
We need check the hub settings itself.
I need check the hub settings and that it is a GUI based device so I can't even ask to see the technology and the only option available is to WebEx.
You're ok with webex, pls lemme session comfortable time id and e-mail to send the invitation, it takes no more time and we will carry it out
Thank you
Ankur
-
PIX 501 to allow access to the ftp server
Hello
We have a public ip address of the pix 501 and the other, I want to access the ftp server on the internal network from the outside. I tried to configure the PDM by a static nat, which translate to the address of the FTP to the public address, but then none of the stations networks could out - how can I configure it?
I would also like to know what ports should I open on the acl for access to the ftp server.
Thank you, daguech
Yes, sorry... You must use the unique host for addresses command. The access list is applied to your external interface?
for example, the command would be:
Access-group acl_out in interface outside
Also, can you connect to the local ftp server behind a firewall?
-
Connectivity random Cisco Pix 501
Hello. I'm having some trouble with my CISCO PIX 501 Setup.
A few months I started having random disconnects on my network (from inside to outside). The machines can ping the DC or the Pix, but impossible to surf the internet. The only way to make them go outside is a reboot of Pix.
My configuration is:
-----------
See the ACE - pix config (config) #.
: Saved
: Written by enable_15 at 09:23:07.033 UTC Tuesday, June 3, 2014
6.3 (3) version PIX
interface ethernet0 car
interface ethernet1 100full
ethernet0 nameif outside security0
nameif ethernet1 inside the security100
activate 8Ry34retyt7RR564 encrypted password
2fvbbfgdI.2KUOU encrypted passwd
hostname as pix
domain as.local
fixup protocol dns-length maximum 512
fixup protocol esp-ike
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol pptp 1723
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol 2000 skinny
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names of
access-list acl_out permit icmp any one
ip access list acl_out permit a whole
access-list acl_out permit tcp any one
Allow Access-list outside_access_in esp a whole
outside_access_in list access permit udp any eq isakmp everything
outside_access_in list of access permit udp any eq 1701 all
outside_access_in list of access permit udp any eq 4500 all
outside_access_in ip access list allow a whole
pager lines 24
Outside 1500 MTU
Within 1500 MTU
outside 10.10.10.2 IP address 255.255.255.0
IP address inside 192.168.100.1 255.255.255.0
alarm action IP verification of information
alarm action attack IP audit
history of PDM activate
ARP timeout 14400
Global 1 10.10.10.8 - 10.10.10.254 (outside)
NAT (inside) 1 0.0.0.0 0.0.0.0 0 0
Access-group outside_access_in in interface outside
access to the interface inside group acl_out
Route outside 0.0.0.0 0.0.0.0 10.10.10.1 0
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225
H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00
Timeout, uauth 0:05:00 absolute
GANYMEDE + Protocol Ganymede + AAA-server
RADIUS Protocol RADIUS AAA server
AAA-server local LOCAL Protocol
Enable http server
http 192.168.10.2 255.255.255.255 inside
http 192.168.10.101 255.255.255.255 inside
http 192.168.100.2 255.255.255.255 inside
No snmp server location
No snmp Server contact
SNMP-Server Community public
No trap to activate snmp Server
enable floodguard
Permitted connection ipsec sysopt
ISAKMP nat-traversal 20
Telnet timeout 5
SSH 192.168.10.101 255.255.255.255 inside
SSH timeout 60
Console timeout 0
dhcpd dns 8.8.8.8 8.8.4.4
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd outside auto_config
Terminal width 80
Cryptochecksum:7f9bda5e534eaeb1328ab08a3c4d28a
------------Do you have any advice? I don't get what's wrong with my setup.
My DC is 192.168.100.2 and the network mask is 255.255.255.0
The network configuration is configured to set the IP of the gateway to 192.168.100.1 (i.e. the PIX 501).
I have about 50 + peers on the internal network.
Any help is apprecciate.
Hello
You have a license for 50 users +?
After the release of - Show version
RES
Paul
-
Microsoft secondary authority w / Cisco router / PIX 501
I'm trying to get digital certificates to work on my 2621XM router. I have also
need to put in place on the three firewalls PIX 501 but who have not obtained until now still. I have
don't have no access to the CA root, but it could bring in line if I had to. I have
have a stand-alone Microsoft subordinate CA that I want to use to publish all
certificates.
Is it possible, as well with the router and the firewall? If so, what version
the IOS do I need? I installed the add-on CEP at HQ. I can't
It works and I'm starting to wonder if it is still possible. If this doesn't
work, how can I make it work? I have all the documents that Cisco has combed
on the subject and have gotten nowhere.
Any help would be greatly appreciated. Thank you.
Jennnette,
I sent this document, let me know how it goes or if you have any questions.
Kurtis Durrett
-
Cisco 3640 to the PIX 501 site 2 site VPN performance specifications.
I intend on creating a site-2-site VPN in Star configuration with a Cisco 3640 as the hub and PIX 501 at the remote sites. My question is around the plug that I read.
.
The specifications for a PIX-501-BUN-K9 tell PIX 501 3DES Bundle (chassis, SW, 10 users, 3DES).
.
A question is what really "10 users. Which is the limit of the number of concurrent sessions, I have on the VPN at a given time, or that it means something else?
.
I also read the specs say that the Maximum number of VPN tunnels that can support a PIX 501 is 5. Because I'm not going to make a tunnel between the PIX 501 at the remote site and the 3640 on the central site, I think I would be OK. Is that correct or is the max value talk the maximum number of concurrent sessions on the tunnel tunnels?
.
Thank you.
UDP traffic always creates a session in the PIX so that the return traffic will be allowed in. The UDP timeout is 2 minutes but IIRC. If you go around NAT with a statement of "nat 0" should not create an xlate I think.
The real time is hard to say really, probably around 2 minutes for a UDP-only user, you would probably make a few 'local sho' orders on the PIX to really see for sure however.
-
PIX 501 for Cisco 3640 VPN router
-Start ciscomoderator note - the following message has been changed to remove potentially sensitive information. Please refrain from publishing confidential information about the site to reduce the risk to the security of your network. -end of the note ciscomoderator-
Have a 501 PIX and Cisco 3640 router. The 3640 is configured for dynamic map for VPN. The PIX 501 is set to pointing to the 3640 router static map. I can establish a tunnel linking the PIX to the router and telnet to a machine AIX on the inside network to the router. When I try to print on the network of the PIX 501 inside it fails.
What Miss me? I added the configuration for the PIX and the router.
Here are the PIX config:
PIX Version 6.1 (1)
ethernet0 nameif outside security0
nameif ethernet1 inside the security100
enable encrypted password xxxxxxxxxxxxxxxx
xxxxxxxxxxxxx encrypted passwd
pixfirewall hostname
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol 2000 skinny
names of
pager lines 24
interface ethernet0 10baset
interface ethernet1 10full
Outside 1500 MTU
Within 1500 MTU
IP address outside dhcp setroute
IP address inside 192.168.1.1 255.255.255.0
alarm action IP verification of information
alarm action attack IP audit
PDM logging 100 information
history of PDM activate
ARP timeout 14400
Global 1 interface (outside)
NAT (inside) 1 0.0.0.0 0.0.0.0 0 0
Timeout xlate 0:05:00
Timeout conn 01:00 half-closed 0: 10:00 udp 0:02:00 CPP 0: h323 from 10:00 0:05:00 sip 0:30:00 sip_media 0:02:00
Timeout, uauth 0:05:00 absolute
GANYMEDE + Protocol Ganymede + AAA-server
RADIUS Protocol RADIUS AAA server
Enable http server
http 192.168.1.0 255.255.255.0 inside
No snmp server location
No snmp Server contact
SNMP-Server Community public
No trap to activate snmp Server
enable floodguard
No sysopt route dnat
Telnet timeout 5
SSH timeout 5
dhcpd address 192.168.1.2 - 192.168.1.33 inside
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd outside auto_config
dhcpd allow inside
Terminal width 80
Cryptochecksum:XXXXXXXXXXXXXXXXXXX
: end
Here is the router config
Router #sh runn
Building configuration...
Current configuration: 6500 bytes
!
version 12.2
no service button
tcp KeepAlive-component snap-in service
a tcp-KeepAlive-quick service
horodateurs service debug datetime localtime
Log service timestamps datetime localtime
no password encryption service
!
router host name
!
start the flash slot1:c3640 - ik9o3s - mz.122 - 16.bin system
queue logging limit 100
activate the password xxxxxxxxxxxxxxxxx
!
clock TimeZone Central - 6
clock summer-time recurring CENTRAL
IP subnet zero
no ip source route
!
!
no ip domain-lookup
!
no ip bootp Server
inspect the name smtp Internet IP
inspect the name Internet ftp IP
inspect the name Internet tftp IP
inspect the IP udp Internet name
inspect the tcp IP Internet name
inspect the name DMZ smtp IP
inspect the name ftp DMZ IP
inspect the name DMZ tftp IP
inspect the name DMZ udp IP
inspect the name DMZ tcp IP
audit of IP notify Journal
Max-events of po verification IP 100
!
crypto ISAKMP policy 1
BA 3des
preshared authentication
Group 2
!
crypto ISAKMP policy 20
BA 3des
preshared authentication
Group 2
ISAKMP crypto key address x.x.180.133 xxxxxxxxxxx
ISAKMP crypto keys xxxxxxxxxxx address 0.0.0.0 0.0.0.0
!
!
Crypto ipsec transform-set esp-3des esp-sha-hmac vpn test
Crypto ipsec transform-set esp-3des esp-sha-hmac PIXRMT
!
dynamic-map crypto dny - Sai 25
game of transformation-PIXRMT
match static address PIX1
!
!
static-card 10 map ipsec-isakmp crypto
the value of x.x.180.133 peer
the transform-set vpn-test value
match static address of Hunt
!
map ISCMAP 15-isakmp ipsec crypto dynamic dny - isc
!
call the rsvp-sync
!
!
!
controller T1 0/0
framing ESF
linecode b8zs
Slots 1-12 channels-group 0 64 speed
Description controller to the remote frame relay
!
controller T1 0/1
framing ESF
linecode b8zs
Timeslots 1-24 of channel-group 0 64 speed
Description controller for internet link SBIS
!
interface Serial0/0:0
Description CKT ID 14.HXGK.785129 Frame Relay to Remote Sites
bandwidth 768
no ip address
no ip redirection
no ip unreachable
no ip proxy-arp
encapsulation frame-relay
frame-relay lmi-type ansi
!
interface Serial0 / point to point 0:0.17
Description Frame Relay to xxxxxxxxxxx location
IP unnumbered Ethernet1/0
no ip redirection
no ip unreachable
no ip proxy-arp
IP nat inside
No arp frame relay
dlci 17 frame relay interface
!
interface Serial0 / point to point 0:0.18
Description Frame Relay to xxxxxxxxxxx location
IP unnumbered Ethernet1/0
no ip redirection
no ip unreachable
no ip proxy-arp
IP nat inside
No arp frame relay
dlci 18 frame relay interface
!
interface Serial0 / point to point 0:0.19
Description Frame Relay to xxxxxxxxxxx location
IP unnumbered Ethernet1/0
no ip redirection
no ip unreachable
no ip proxy-arp
IP nat inside
No arp frame relay
dlci 19 frame relay interface
!
interface Serial0 / point to point 0:0.20
Description Frame Relay to xxxxxxxxxxxxx location
IP unnumbered Ethernet1/0
no ip redirection
no ip unreachable
no ip proxy-arp
IP nat inside
No arp frame relay
dlci 20 frame relay interface
!
interface Serial0 / point to point 0:0.21
Description Frame Relay to xxxxxxxxxxxx
IP unnumbered Ethernet1/0
no ip redirection
no ip unreachable
no ip proxy-arp
IP nat inside
No arp frame relay
dlci 21 frame relay interface
!
interface Serial0 / point to point 0:0.101
Description Frame Relay to xxxxxxxxxxx
IP unnumbered Ethernet1/0
no ip redirection
no ip unreachable
no ip proxy-arp
IP nat inside
No arp frame relay
dlci 101 frame relay interface
!
interface Serial0/1:0
CKT ID 14.HCGS.785383 T1 to ITT description
bandwidth 1536
IP address x.x.76.14 255.255.255.252
no ip redirection
no ip unreachable
no ip proxy-arp
NAT outside IP
inspect the Internet IP on
no ip route cache
card crypto ISCMAP
!
interface Ethernet1/0
IP 10.1.1.1 255.255.0.0
no ip redirection
no ip unreachable
no ip proxy-arp
IP nat inside
no ip route cache
no ip mroute-cache
Half duplex
!
interface Ethernet2/0
IP 10.100.1.1 255.255.0.0
no ip redirection
no ip unreachable
no ip proxy-arp
IP nat inside
no ip route cache
no ip mroute-cache
Half duplex
!
router RIP
10.0.0.0 network
network 192.168.1.0
!
IP nat inside source list 112 interface Serial0/1: 0 overload
IP nat inside source static tcp 10.1.3.4 443 209.184.71.138 443 extensible
IP nat inside source static tcp 10.1.3.4 9869 209.184.71.138 9869 extensible
IP nat inside source 10.1.3.2 static 209.184.71.140
IP nat inside source static 10.1.3.6 209.184.71.139
IP nat inside source static 10.1.3.8 209.184.71.136
IP nat inside source static tcp 10.1.3.10 80 209.184.71.137 80 extensible
IP classless
IP route 0.0.0.0 0.0.0.0 x.x.76.13
IP route 10.2.0.0 255.255.0.0 Serial0 / 0:0.19
IP route 10.3.0.0 255.255.0.0 Serial0 / 0:0.18
IP route 10.4.0.0 255.255.0.0 Serial0 / 0:0.17
IP route 10.5.0.0 255.255.0.0 Serial0 / 0:0.20
IP route 10.6.0.0 255.255.0.0 Serial0 / 0:0.21
IP route 10.7.0.0 255.255.0.0 Serial0 / 0:0.101
no ip address of the http server
!
!
PIX1 static extended IP access list
IP 10.1.0.0 allow 0.0.255.255 192.168.1.0 0.0.0.255
IP access-list extended hunting-static
IP 10.1.0.0 allow 0.0.255.255 192.168.1.0 0.0.0.255
extended IP access vpn-static list
ip permit 192.168.1.0 0.0.0.255 10.1.0.0 0.0.255.255
IP 192.0.0.0 allow 0.255.255.255 10.1.0.0 0.0.255.255
access-list 1 refuse 10.0.0.0 0.255.255.255
access-list 1 permit one
access-list 12 refuse 10.1.3.2
access-list 12 allow 10.1.0.0 0.0.255.255
access-list 12 allow 10.2.0.0 0.0.255.255
access-list 12 allow 10.3.0.0 0.0.255.255
access-list 12 allow 10.4.0.0 0.0.255.255
access-list 12 allow 10.5.0.0 0.0.255.255
access-list 12 allow 10.6.0.0 0.0.255.255
access-list 12 allow 10.7.0.0 0.0.255.255
access-list 112 deny ip host 10.1.3.2 everything
access-list 112 refuse ip 10.1.0.0 0.0.255.255 192.168.1.0 0.0.0.255
access-list 112 allow ip 10.1.0.0 0.0.255.255 everything
access-list 112 allow ip 10.2.0.0 0.0.255.255 everything
access-list 112 allow ip 10.3.0.0 0.0.255.255 everything
access-list 112 allow ip 10.4.0.0 0.0.255.255 everything
access-list 112 allow ip 10.5.0.0 0.0.255.255 everything
access-list 112 allow ip 10.6.0.0 0.0.255.255 everything
access-list 112 allow ip 10.7.0.0 0.0.255.255 everything
access-list 120 allow ip host 10.100.1.10 10.1.3.7
not run cdp
!
Dial-peer cor custom
!
!
!
!
connection of the banner ^ CCC
******************************************************************
WARNING - Unauthorized USE strictly PROHIBITED!
******************************************************************
^ C
!
Line con 0
line to 0
password xxxxxxxxxxxx
local connection
Modem InOut
StopBits 1
FlowControl hardware
line vty 0 4
exec-timeout 15 0
password xxxxxxxxxxxxxx
opening of session
!
end
Router #.
Add the following to the PIX:
> permitted connection ipsec sysopt
This indicates the PIX around all ACLs for IPsec traffic. Now that your IPSec traffic is still subject to the standard rules of PIX, so launched inside the traffic is allowed to go in, but off-initiated traffic is not.
-
Hello
I have Microsoft CA server with the latest support CEP and pix 501 that gets the digital certificate. I also have the client certificate of Cisco, but VPN doesn't work
In the IPSec Log Viewer, I constantly "CM_IKE_ESTABLISH_FAIL."
It worked well prior to Win2k server has been completely updated with the latest patches.
The pix configuration is identical to that of article http://www.cisco.com/warp/public/471/configipsecsmart.html
I reinstall the stand-alone CA and support CEP server but not had any luck.
What could be wrong?
It looks like IKE implementation problem. Make DH group 2 policy ISAKMP.
Visit this link:
http://www.Cisco.com/univercd/CC/TD/doc/product/iaabu/PIX/pix_v53/IPSec/exvpncl.htm
-
QoS is supported on the Cisco PIX 501 or 506th?
Hello
There is no mention of QoS in technical for the PIX 501 and 506 records but nothing for the 515. PIX OS 7.x configuration guides do not mention specific material support.
Does anyone know if QoS is taken care of in the 501 or 506th - I need support lines expectations for VoIP over IPSec.
Thank you
Chris
QoS is supported in 7.x code, you would have to level 501/506 to 7.x code, but this is not supported on these two models, the next logical solution would be to upgrade your PIX 501/506 to asa5505s.
Rgds
Jorge
-
Customer Cisco PIX 501 VPN connects but no connection to the local network
Hi all:
I am able to make a VPN connection to a PIX 501. The remote client is assigned an IP (192.168.2.1) also, but not able to access all the machines in the local network connected to the PIX.
I have attached the PIX configuration.
Advice will be greatly appreciated.
********************
6.3 (5) PIX version
interface ethernet0 car
interface ethernet1 100full
ethernet0 nameif outside security0
nameif ethernet1 inside the security100
enable password xxxx
passwd xxxxx
pixfirewall hostname
domain ciscopix.com
fixup protocol dns-length maximum 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol 2000 skinny
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names of
access-list 101 permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list 102 permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
pager lines 24
Outside 1500 MTU
Within 1500 MTU
IP address outside dhcp setroute
IP address inside 192.168.1.1 255.255.255.0
alarm action IP verification of information
alarm action attack IP audit
IP local pool ippool 192.168.2.1 - 192.168.2.5
location of PDM 192.168.2.0 255.255.255.0 outside
PDM logging 100 information
history of PDM activate
ARP timeout 14400
Global 1 interface (outside)
NAT (inside) - 0 102 access list
NAT (inside) 1 0.0.0.0 0.0.0.0 0 0
Timeout xlate 0:05:00
Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225
H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00
Sip timeout - disconnect 0:02:00 prompt Protocol sip-0: 03:00
Timeout, uauth 0:05:00 absolute
GANYMEDE + Protocol Ganymede + AAA-server
AAA-server GANYMEDE + 3 max-failed-attempts
AAA-server GANYMEDE + deadtime 10
RADIUS Protocol RADIUS AAA server
AAA-server RADIUS 3 max-failed-attempts
AAA-RADIUS deadtime 10 Server
AAA-server local LOCAL Protocol
Enable http server
http 192.168.1.0 255.255.255.0 inside
No snmp server location
No snmp Server contact
SNMP-Server Community public
No trap to activate snmp Server
enable floodguard
Permitted connection ipsec sysopt
Crypto ipsec transform-set esp - esp-md5-hmac RIGHT
Crypto-map dynamic dynmap 10 transform-set RIGHT
map mymap 10-isakmp ipsec crypto dynamic dynmap
mymap outside crypto map interface
ISAKMP allows outside
ISAKMP identity address
part of pre authentication ISAKMP policy 10
encryption of ISAKMP policy 10
ISAKMP policy 10 md5 hash
10 2 ISAKMP policy group
ISAKMP life duration strategy 10 86400
vpngroup vpn3000 ippool address pool
vpngroup vpn3000 Server dns 68.87.72.130
vpngroup vpn3000-wins 192.168.1.100 Server
vpngroup vpn3000 split tunnel 101
vpngroup vpn3000 downtime 1800
password vpngroup vpn3000 *.
Telnet timeout 5
SSH timeout 5
Console timeout 0
dhcpd address 192.168.1.2 - 192.168.1.33 inside
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd outside auto_config
dhcpd allow inside
Terminal width 80
Cryptochecksum:xxxx
****************
The DNS server is the one assigned to me by my ISP.
My internal network connected to the PIX is 192.168.1.1 - 192.168.1.33 and the VPN ip pool is 192.168.2.1 - 192.168.2.5
"isakmp nat-traversal 20" can do the trick.
-
PIX 501, 1 static IP, IP address dynamic 2. Mesh full possible?
I have 3 sites. All sites have PIX 501. Central site has a static IP, 2 remote sites a dynamic IP.
I have no problem with the connection to the central site by using their dynamic IP address in a remote star connection.
Is it possible for 2 remote sites communicate? There is data that must be transferred between remote sites. I read somewhere in cisco site web which its possible via mesh on request.
Does anyone have an example of configuration on a VPN Site to Site where the Central site has static IP and remote sites with a dynamic IP? Remote locations teaches a dynamic IP from remote sites to the central server.
Thank you.
With IOS as your hub and then the Yes rays, the rays can learn dynamically address other departments using the PNDH. This type of configuration is called Dynamic Multipoint VPN (DMVPN), you can read everything you need to know about this here:
http://www.Cisco.com/warp/public/105/DMVPN.html
Even with EzVPN (not DMVPN) the rays will not learn the address of other rays, all communication is always via the hub. Call another talks would work, but as I said, the packages will talk-star.
-
L2l IPSec VPN 3000 and PIX 501
Hello
I have a remote site that has a broadband internet connection and uses a PIX 501. We wanted to connect them with our main office using our VPN 3000 via VPN site-to-site.
I followed the following documentation:
However the L2L session does not appear on the hub when I check the active sessions.
The network diagram, as well as the PIX config and the screenshots of the VPN configuration for the IPSec-L2L tunnel is attached.
Any help or advice are appreciated.
I just noticed that the PIX firewall, the phase 1 paramateres are not configured. You must configure the same PASE 1 and phase 2 settings on both ends of the tunnel.
For example, on CVPN 3000, you have configured settings Phase 1 as 3DES, pre-shared key etc... We have the same configuration on the PIX firewall too.
Here is an example of sample config
I hope this helps!
-
I am very new to cisco equipment and I was wondering if someone could help me with this (probably very simple question).
When connecting to my pix via the browser (https://192.168.1.1/startup.html), the browser never took the start screen with the message that says "loading, please wait." This leads me to believe that the firewall is rejecting connections from my machine (which uses dhcp to get an ip address of the pix).
To work around this problem, I tried to connect to the CLI using hyperterminal. I can connect and run a few basic commands as 'show version', but cannot log on as a user with permissions.
If the web interface has a default connection of void & empty, surely the cli should be the same?
Is anyone able to tell me what is the default login, so that I can start confguring the pix via the cli?
Thanks in advance.
Justin Spencer.
Please see below for info pix:
Cisco PIX Firewall Version 6.3 (3)
Cisco PIX Device Manager Version 3.0 (1)
Updated Thursday, August 13 03 13:55 by Manu
pixfirewall until 12 minutes 18 seconds
Material: PIX - 501, 16 MB RAM, 133 MHz Am5x86 CPU
Flash E28F640J3 @ 0 x 3000000, 8 MB
BIOS Flash E28F640J3 @ 0xfffd8000, 128KB
0: ethernet0: the address is 0011.937e.0486, irq 9
1: ethernet1: the address is 0011.937e.0487, irq 10
Features licensed:
Failover: disabled
VPN - A: enabled
VPN-3DES-AES: enabled
The maximum physical Interfaces: 2
Maximum Interfaces: 2
Cut - through Proxy: enabled
Guardians: enabled
URL filtering: enabled
Internal guests: 10
Throughput: unlimited
Peer IKE: 10
This PIX has a restricted license (R).
Serial number: 808301473 (0x302db3a1)
Activation key running: 0xb53be54d 0x26da18f9 0xb2b78cef 0x8fe1abb6
Configuration changed from enable_1 to 15:36:42.554 UTC, Monday, November 8, 2004
pixfirewall >
long live java.
Please this mark as resolved, others won't waste time.
Thank you
Maybe you are looking for
-
Hi guys,. My Pavilion g6 2302ax cell no. 4 battery voltage showing o mV even after a full charge. I baught my laptop 2 months before and its hardware works very well so far, I've noticed this problem. I've attached a screenshot of the HP support assi
-
Property Loader: Array of strings
I'm looking for an example of use of stage property loader to load an array of type strings labView. Not much in the reference manual... Thank you JVH
-
format a hard drive from the old computer
I got a hard drive of 250 GB desktop a replaced albums which I now use as an extra external hard drive. Externally has never been formatted since the abduction and there are several files that have been transferred to the new office. Now, I bought
-
For the last decade or so, when the use of different versions of Windows (Windows 95, Windows ME, Windows 2000, Windows XP), when I want to print a list of what I have in a sub directory (or folder), I have to go to a DOS window and use the DIR comma
-
Windows will not be stopped; also get a RunDLL error every time I start up
Computer doesn't stop, I pressed the power button.RunDLL error which comes up every time I start, it's 'there was a problem starting C:\Users\Gregg\AppData/Roaming\cdeteg.dll.The specified module could not be found.