PIX 501 and pcAnywhere access rules

Similar Questions

• L2L pix 501 and remote access VPN

  Hi, I'm working on an old 501 PIX w / Software 6.3 (5), he already have access to remote VPN configuration and works very well, but now he needs a L2L implemented. One thing I try to do all the work remotely via VPN or ssh to the machine. I don't know what's on the other end, but they swear that it is set up and maybe my problem is when I start putting in orders for the other VPN it breaks the remote VPN access. One thing that I have to do is NAT a host on the inside to appear as another host on the end. I use these commands and I think it works cannot be said.

  access-list 101 permit ip remote_network 255.255.255.0 local_server host

  public static 10.1.0.203 (inside, outside) - access list 101

  then

  access-list 102 permit ip host 10.1.0.203 192.168.50.83
  access-list 102 permit ip host 10.1.0.203 192.168.50.86
  access-list 102 permit ip host 10.1.0.203 192.168.50.50
  access-list 102 permit ip host 10.1.0.203 192.168.50.85

  and use it to match against

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
  EMDs-map 10 ipsec-isakmp crypto map
  correspondence address card crypto emds-map 10 102
  card crypto emds-map 10 peers set remote_vpn_server
  card crypto emds-card 10 set of transformation-ESP-3DES-SHA

  then

  ISAKMP key magic_key address remote_vpn_server netmask 255.255.255.255
  ISAKMP identity hostname
  part of pre authentication ISAKMP policy 10
  ISAKMP policy 10 3des encryption
  ISAKMP policy 10 sha hash
  10 1 ISAKMP policy group
  ISAKMP life duration strategy 10 86400

  and that is where it usually breaks the VPN, I don't know if the other VPN works due to not being not able to get to this server to try to ping, I don't really like to try this stuff remotely but I don't have a lot of choice at the moment.

  Any thoughts?

  Thank you

  Jarrid Graham

  Yes, just use the number of different sequence with 1 name of the crypto map. Please also ensure that your dynamic crypto map, which is your vpn client has the sequence down the crypto map (more), because you want to make sure that the static crypto map (for lan-to-lan tunnel has higher sequence number (lower number)).

  The political isakmp sequence number does not match, it is processed from top to bottom (number less than the high number) and also long 1 set of isakmp policy corresponds to the remote peer, it will be negotiated properly.

  Hope that answers your question and please note useful post. Thank you.

• PIX 501 to allow access to the ftp server

  Hello

  We have a public ip address of the pix 501 and the other, I want to access the ftp server on the internal network from the outside. I tried to configure the PDM by a static nat, which translate to the address of the FTP to the public address, but then none of the stations networks could out - how can I configure it?

  I would also like to know what ports should I open on the acl for access to the ftp server.

  Thank you, daguech

  Yes, sorry... You must use the unique host for addresses command. The access list is applied to your external interface?

  for example, the command would be:

  Access-group acl_out in interface outside

  Also, can you connect to the local ftp server behind a firewall?

• PIX 501 and VPN Linksys router (WRV200)

  I inherited a work where we have a Cisco PIX 501 firewall to a single site and Linksys WRV200 Router VPN on two other

  sites. Asked me to connect these routers Linksys firewall PIX via the VPN.

  According to me, the Linksys vpn routers can only connect via IPSec VPN, I'm looking for help on the configuration of the PIX 501 for the linksys to connect with the following, if possible.

  Key exchange method: Auto (IKE)

  Encryption: Auto, 3DES, AES128, AES192, AES256

  Authentication: MD5

  Pre Shared Key: xxx

  PFS: Enabled

  Life ISAKMP key: 28800

  Life of key IPSec: 3600

  The pix, I installed MDP and I tried to use the VPN wizard without result.

  I chose the following settings when you make the VPN Wizard:

  Type of VPN: remote VPN access

  Interface: outside

  Type of Client VPN device used: Cisco VPN Client

  (can choose customer of Cisco VPN 3000, MS Windows Client by using the client MS Windows using L2TP, PPTP)

  VPN clients group

  Name of Group: RabyEstates

  Pre Shared Key: rabytest

  Scope of the Client authentication: disabled

  Address pool

  Name of the cluster: VPN - LAN

  Starter course: 192.168.2.200

  End of row: 192.168.2.250

  Domain DNS/WINS/by default: no

  IKE policy

  Encryption: 3DES

  Authentication: MD5

  Diffie-Hellman group: Group 2 (1024 bits)

  Transform set

  Encryption: 3DES

  Authentication: MD5

  I have attached the log of the VPN Linksys router VPN.

  This is the first time that I have ever worked with PIX so I'm still trying to figure the thing to, but I'm confident with the CCNA level network.

  Thanks for your help!

  Hello

  Everything looks fine for me, try to have a computer in every network and ping between them. Check the newspapers/debug and fix them.

  Let me know.

  See you soon,.

  Daniel

• IPSec VPN pix 501 no LAN access

  I'm trying to set up an IPSec VPN in a basic small business scenario. I am able to connect to my pix 501 via IPSec VPN and browse the internet, but I am unable to ping or you connect to all devices in the Remote LAN. Here is my config:

  : Saved

  :

  6.3 (3) version PIX

  interface ethernet0 car

  interface ethernet1 100full

  nameif ethernet0 WAN security0

  nameif ethernet1 LAN security99

  enable encrypted password xxxxxxxxxxxxx

  xxxxxxxxxxxxxxxxx encrypted passwd

  host name snowball

  domain xxxxxxxxxxxx.local

  clock timezone PST - 8

  fixup protocol dns-length maximum 512

  fixup protocol ftp 21

  fixup protocol h323 h225 1720

  fixup protocol h323 ras 1718-1719

  fixup protocol http 80

  fixup protocol pptp 1723

  fixup protocol rsh 514

  fixup protocol rtsp 554

  fixup protocol sip 5060

  fixup protocol sip udp 5060

  fixup protocol 2000 skinny

  No fixup not protocol smtp 25

  fixup protocol sqlnet 1521

  fixup protocol tftp 69

  names of

  acl_in list of access permit udp any any eq field

  acl_in list of access permit udp any eq field all

  acl_in list access permit tcp any any eq field

  acl_in tcp allowed access list any domain eq everything

  acl_in list access permit icmp any any echo response

  access-list acl_in allow icmp all once exceed

  acl_in list all permitted access all unreachable icmp

  acl_in list access permit tcp any any eq ssh

  acl_in list access permit tcp any any eq www

  acl_in tcp allowed access list everything all https eq

  acl_in list access permit tcp any host 192.168.5.30 eq 81

  acl_in list access permit tcp any host 192.168.5.30 eq 8081

  acl_in list access permit tcp any host 192.168.5.22 eq 8081

  acl_in list access permit icmp any any echo

  access-list acl_in permit tcp host 76.248.x.x a

  access-list acl_in permit tcp host 76.248.x.x a

  allow udp host 76.248.x.x one Access-list acl_in

  access-list acl_out permit icmp any one

  ip access list acl_out permit a whole

  acl_out list access permit icmp any any echo response

  acl_out list access permit icmp any any source-quench

  allowed any access list acl_out all unreachable icmp

  access-list acl_out permit icmp any once exceed

  acl_out list access permit icmp any any echo

  Allow Access-list no. - nat icmp a whole

  access-list no. - nat ip 192.168.5.0 allow 255.255.255.0 172.16.0.0 255.255.0.0

  access-list no. - nat ip 172.16.0.0 allow 255.255.0.0 any

  access-list no. - nat permit icmp any any echo response

  access-list no. - nat permit icmp any any source-quench

  access-list no. - nat icmp permitted all all inaccessible

  access-list no. - nat allow icmp all once exceed

  access-list no. - nat permit icmp any any echo

  pager lines 24

  MTU 1500 WAN

  MTU 1500 LAN

  IP address WAN 65.74.x.x 255.255.255.240

  address 192.168.5.1 LAN IP 255.255.255.0

  alarm action IP verification of information

  alarm action attack IP audit

  IP local pool pptppool 172.16.0.2 - 172.16.0.13

  PDM logging 100 information

  history of PDM activate

  ARP timeout 14400

  Global (WAN) 1 interface

  NAT (LAN) - access list 0 no - nat

  NAT (LAN) 1 0.0.0.0 0.0.0.0 0 0

  static (LAN, WAN) 65.x.x.37 192.168.5.10 netmask 255.255.255.255 0 0

  static (LAN, WAN) 65.x.x.36 192.168.5.20 netmask 255.255.255.255 0 0

  static (LAN, WAN) 65.x.x.38 192.168.5.30 netmask 255.255.255.255 0 0

  static (LAN, WAN) 65.x.x.39 192.168.5.40 netmask 255.255.255.255 0 0

  static (LAN, WAN) 65.x.x.42 192.168.5.22 netmask 255.255.255.255 0 0

  static (LAN, WAN) 65.x.x.43 192.168.5.45 netmask 255.255.255.255 0 0

  static (LAN, WAN) 65.x.x.44 192.168.5.41 netmask 255.255.255.255 0 0

  static (LAN, WAN) 65.x.x.45 192.168.5.42 netmask 255.255.255.255 0 0

  static (LAN, WAN) 65.x.x.46 192.168.5.44 netmask 255.255.255.255 0 0

  static (LAN, WAN) 65.x.x.41 192.168.5.21 netmask 255.255.255.255 0 0

  acl_in access to the WAN interface group

  access to the LAN interface group acl_out

  Route WAN 0.0.0.0 0.0.0.0 65.x.x.34 1

  Timeout xlate 0:05:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225

  H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00

  Timeout, uauth 0:05:00 absolute

  GANYMEDE + Protocol Ganymede + AAA-server

  RADIUS Protocol RADIUS AAA server

  AAA-server local LOCAL Protocol

  NTP server 72.14.188.195 source WAN

  survey of 76.248.x.x WAN host SNMP Server

  location of Server SNMP Sacramento

  SNMP Server contact [email protected] / * /

  SNMP-Server Community xxxxxxxxxxxxx

  SNMP-Server enable traps

  enable floodguard

  the string 1 WAN fragment

  Permitted connection ipsec sysopt

  Sysopt connection permit-pptp

  Crypto ipsec transform-set esp - esp-md5-hmac RIGHT

  Crypto-map dynamic dynmap 10 transform-set RIGHT

  map mymap 10-isakmp ipsec crypto dynamic dynmap

  client configuration address map mymap crypto initiate

  client configuration address map mymap crypto answer

  card crypto mymap WAN interface

  ISAKMP enable WAN

  ISAKMP nat-traversal 20

  part of pre authentication ISAKMP policy 10

  encryption of ISAKMP policy 10

  ISAKMP policy 10 md5 hash

  10 2 ISAKMP policy group

  ISAKMP life duration strategy 10 86400

  vpngroup myvpn address pptppool pool

  vpngroup myvpn Server dns 192.168.5.44

  vpngroup myvpn by default-field xxxxxxxxx.local

  vpngroup split myvpn No. - nat tunnel

  vpngroup idle 1800 myvpn-time

  vpngroup myvpn password *.

  Telnet 192.168.5.0 255.255.255.0 LAN

  Telnet timeout 5

  SSH 192.168.5.0 255.255.255.0 LAN

  SSH timeout 30

  Console timeout 0

  VPDN group pptpusers accept dialin pptp

  VPDN group ppp authentication pap pptpusers

  VPDN group ppp authentication chap pptpusers

  VPDN group ppp mschap authentication pptpusers

  VPDN group ppp encryption mppe 128 pptpusers

  VPDN group pptpusers client configuration address local pptppool

  VPDN group pptpusers customer 192.168.5.44 dns configuration

  VPDN group pptpusers pptp echo 60

  VPDN group customer pptpusers of local authentication

  VPDN username password xxx *.

  VPDN username password xxx *.

  VPDN enable WAN

  dhcpd address 192.168.5.200 - 192.168.5.220 LAN

  dhcpd 192.168.5.44 dns 8.8.8.8

  dhcpd lease 3600

  dhcpd ping_timeout 750

  dhcpd enable LAN

  username privilege 0 encrypted password xxxxxxxxxx xxxxxxxxxxx

  username privilege 0 encrypted password xxxxxxxxxx xxxxxxxxxxx

  Terminal width 80

  Cryptochecksum:xxxxxxxxxxxxxxxxxx

  : end

  I'm sure it has something to do with NAT or an access list, but I can't understand it at all. I know it's a basic question, but I would really appreaciate help!
  Thank you very much
  Trevor

  "No. - nat' ACL doesn't seem correct, please make sure you want to remove the following text:

  do not allow any No. - nat icmp access list a whole

  No No. - nat ip 172.16.0.0 access list allow 255.255.0.0 any

  No No. - nat access list permit icmp any any echo response

  No No. - nat access list permit icmp any any source-quench

  No No. - nat access list permit all all unreachable icmp

  No No. - nat access list do not allow icmp all once exceed

  No No. - nat access list only allowed icmp no echo

  You must have 1 line as follows:

  access-list no. - nat ip 192.168.5.0 allow 255.255.255.0 172.16.0.0 255.255.0.0

  Please 'clear xlate' after the changes described above.

  In addition, if you have a personal firewall enabled on the host you are trying to connect from the Client VPN, please turn it off and try again. Personal firewall of Windows normally blocks the traffic of different subnets.

  Hope that helps.

• Problems with PIX 501 and Server MS Cert

  Hi all

  I have two problems with my PIX 501:

  1. registration works well. The pix has a certificate and use it with SSL and VPN connections. But after a refill, the pix certificate is lost and it has regenerated again self-signed certificate!

  Yes, I wrote mem and ca records all!

  2. at the request of ca CRL , I get the following debugging:

  Crypto CA thread wakes!

  CRYPTO_PKI: Cannot be named County ava

  CRYPTO_PKI: transaction GetCRL completed

  Crypto CA thread sleeps!

  CI thread wakes!

  And the CRL is empty.

  Does anyone have any idea?

  Bert Koelewijn

  Not sure about 1, but 2 is usually caused by the COP (Point of Distribution of CRL, basically the situation where the PIX can download the Revocation list from) listed in cert CA is in a format the PIX does not, generally an LDAP URL.

  Check the following prayer:

  Open the administration tool of CA (Certification Authority) then

  (1) right click on the name of CA and choose 'properties '.

  2) click on the tab "Policy Module".

  3) click on the button "configure."

  4) click on the tab "X.509 extensions".

  > From there, it can display the list of the "CRL Distribution Points".

  Turn off everything that isn't HTTP.

  You need to reinstall the CERT in the PIX, I think, but then it should be able to download the CRL through HTTP instead of LDAP.

• Termination of the client PIX VPN and Internet access from the same interface

  Hello

  VPN remote users connect to PIX (7.2) outside interface, but need to have these clients to access the Internet through the PIX outside interface as well. Need this because PIX IPs is registered and allowed access to some electronic libraries. One way would be to set up a proxy within the network and vpn users have access to the Internet through the proxy, but can it be done without proxy?

  Yes, public internet on a stick

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a00805734ae.shtml

• PIX 501 and THE, 3DES, AES

  For a version newly produced PIX 501,

  (1) are DES, 3DES and AES activation keys all pre-installed?

  (2) how I can find on which of them is pre-installed on my PIX 501?

  (3) when I create a server VPN (on the PIX 501), I see that all three OF THEM, 3DES and AES are available in the drop-down list of the PDM configuration screen. Does that mean my PIX 501 have all three of them (FROM THE, 3DES and AES)? -If the answer is no, assume that only is preinstalled on PIX 501, then why/how can appear in the drop-down list the 3DES and AES?

  Thank you for helping.

  Scott

  Should be integrated already. depends on the way the news is your PIX 501.

  To be sure to log in to the console and type:

  See the version

  See the example output version:

  See the pixfirewall version (config) #.

  Cisco PIX Firewall Version 6.2 (3)

  Cisco PIX Device Manager Version 2.0 (1)

  Updated Thursday April 17 02 21:18 by Manu

  pixdoc515 up to 9 days 3 hours

  Material: PIX - 515, 64 MB RAM, Pentium 200 MHz processor

  I28F640J5 @ 0 x 300 Flash, 16 MB

  BIOS Flash AT29C257 @ 0xfffd8000, 32 KB

  0: ethernet0: the address is 0050.54ff.3772, irq 10

  1: ethernet1: the address is 0050.54ff.3773, irq 7

  2: ethernet2: the address is 00d0.b792.409d, irq 11

  Features licensed:

  Failover: enabled

  VPN - A: enabled

  VPN-3DES: enabled

  Maximum Interfaces: 6

  Cut - through Proxy: enabled

  Guardians: enabled

  URL filtering: enabled

  Internal hosts: unlimited

  Throughput: unlimited

  Peer IKE: unlimited

  Serial number: 480221353 (0x1c9f98a9)

  Activation key running: 0x36df4255 0x246dc5fc 0x39d2ec4d 0x09f6288f

  Modified configuration of enable_15 to 12:15:28.311 UTC Wednesday, may 1, 2002

  pixfirewall (config) #.

  Here, you should see if THE or 3DES, AES encryption is active or not. If you have just SOME so you can use the following link and get for free a new activation key that allows 3DES and AES.

  https://Tools.Cisco.com/swift/licensing/JSP/formGenerator/Pix3DesMsgDisplay.jsp

  sincerely

  Patrick

• PIX 515E and remote access VPN

  I use a PIX 515E with: ASDM Version: 5,0000 51 PIX Version: 8.0 (4) and configure it with remote access VPN.

  I would like to get an email every time that a user login (and or disconnection) to the VPN. Remote clients use the Cisco VPN Client.

  Any help is appreciated,

  Hello

  Here is a link to the email configuration when you log in to the ASA/PIX: http://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html#anc7

  Then you can create a list of message to send the logs only for the connection/disconnection of the VPN user: http://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html#anc18

  There is a wire that is linked here: https://supportforums.cisco.com/discussion/10798976/asa-email-logging-issue

• sick of frustration... 501 and ACL

  Hey all, what gives.

  I worked on a pix 501 and I can't get the ACL to save my life. I'm new on this and obviously missing something. I have a 501 connected to a cable broadband account is public ip through DHCP. I want to limit all traffic going out to 80, 110 and 53.

  I add the following commands.

  access-l 125 permit tcp any any eq 80

  access-l 125 permit tcp any any eq 53

  access-l 125 permit tcp any any eq 110

  access-l 125 deny ip any one

  access-g 125 in interface inside

  everything falls to the interface I think. I am able to browse the net, Kazaa, sof2 throughout the day if I use the default configuration provided by the firewall. I posted this before and actually got it to work once. I tried to repeat the process, but failed.

  any help is GREATLY appreciated

  humbly yours

  MB

  Add

  > access-l 125 permit udp any how any eq 53

  DNS searches with UDP, TCP not. You will find probably your DNS resolution does not work, so when you navigate to a web server by name it will fail, because the first thing that your PC will do is a name search.

• PIX 501 question?

  Hello

  I have a PIX 501 and received 1 single public IP address from my ISP and I need to access a server on the private network of outside (Telnet or FTP).

  How to translate the Private IP of the server to the public ip address for the external interface of the firewall and specifying the port ftp or telnet only? is this possible?

  Thank you

  The pleasure is mine.

  Click rate if you found the post useful.

  sincerely

  Patrick

• QoS is supported on the Cisco PIX 501 or 506th?

  Hello

  There is no mention of QoS in technical for the PIX 501 and 506 records but nothing for the 515. PIX OS 7.x configuration guides do not mention specific material support.

  Does anyone know if QoS is taken care of in the 501 or 506th - I need support lines expectations for VoIP over IPSec.

  Thank you

  Chris

  QoS is supported in 7.x code, you would have to level 501/506 to 7.x code, but this is not supported on these two models, the next logical solution would be to upgrade your PIX 501/506 to asa5505s.

  Rgds

  Jorge

• Reseting ipsec on PIX 501

  Hi all. Just a quick question. I can't seem to find how to reset ipsec on PIX 501 and force her to negotiate again and I also want to reset statistics for ipsec his. I know that I saw somewhere, orders, but now can't seem to find the commands from anywhere.

  Thanks in advance for any help.

  Hello...

  Config mode...

  ISAKMP crypto claire his

  - and -

  clear crypto ipsec his

  PS. You can find the commands on the PIX by entering the configuration mode by typing...

  PIX01 (config) # clear cry?

  Hope the above helps and please note messages!

• PIX 501 will ios ver 6.2 come to him, with only 16ram 8flash? Thank you

  Wanted to load pdm 2.1.1 firewall and VPN. Found 501 takes ver 6.2 but not to enother ram.

  Thank you

  Phil

  From http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_62/relnotes/pixrn622.htm#xtocid4 :

  "The PIX 501 has 16 MB of RAM and will work correctly with Version 6.2, while all other PIX firewall platforms continue to require at least 32 MB of RAM (and are therefore also compatible with Version 6.2 or newer).

  In addition, all units except the PIX 501 and PIX 506/506E require 16 MB of Flash memory to boot. (The 501 PIX and PIX 506/506E have 8 MB of Flash memory, which works correctly with Version 6.2) »

  PIX firewall model... Flash memory required in point 6.2

  PIX 501 .......................... 8 MB

  Steve

• Cisco PIX 501 to Cisco 3005 concentrator via remote access

  Hello people,

  I need your help.

  We got a Cisco PIX 501 in one place and this pix is configured for pppoe connection. The pix connects to internet via the pppoe client. an official ip address ping works well.

  So what I want to do is to establish a tunnel von between this pix and a cisco 3005 concentrator.

  But I failed to establish it.

  Here are the pix config. the acl? s are only for the test and will be replaced if it works.

  6.3 (4) version PIX

  interface ethernet0 10baset

  interface ethernet1 100full

  ethernet0 nameif outside security0

  nameif ethernet1 inside the security100

  activate the password xxx

  passwd xxx

  hostname PIX - to THE

  domain araukraine.ua

  fixup protocol dns-length maximum 512

  fixup protocol ftp 21

  fixup protocol h323 h225 1720

  fixup protocol h323 ras 1718-1719

  fixup protocol http 80

  fixup protocol they 389

  fixup protocol rsh 514

  fixup protocol rtsp 554

  fixup protocol sip 5060

  fixup protocol sip udp 5060

  fixup protocol 2000 skinny

  fixup protocol smtp 25

  fixup protocol sqlnet 1521

  fixup protocol tftp 69

  names of

  outside ip access list allow a whole

  inside_access_in ip access list allow a whole

  pager lines 24

  opening of session

  Monitor logging warnings

  logging warnings put in buffered memory

  MTU outside 1456

  MTU inside 1456

  IP address outside pppoe setroute

  IP address inside 192.168.x.x 255.255.255.0

  alarm action IP verification of information

  alarm action attack IP audit

  PDM location 192.168.x.x 255.255.255.224 inside

  forest warnings of PDM 500

  history of PDM activate

  ARP timeout 14400

  Global 1 interface (outside)

  NAT (inside) 1 0.0.0.0 0.0.0.0 0 0

  outside access-group in external interface

  inside_access_in access to the interface inside group

  Timeout xlate 0:05:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225

  H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00

  Timeout, uauth 0:05:00 absolute

  GANYMEDE + Protocol Ganymede + AAA-server

  AAA-server GANYMEDE + 3 max-failed-attempts

  AAA-server GANYMEDE + deadtime 10

  RADIUS Protocol RADIUS AAA server

  AAA-server RADIUS 3 max-failed-attempts

  AAA-RADIUS deadtime 10 Server

  AAA-server local LOCAL Protocol

  the ssh LOCAL console AAA authentication

  Enable http server

  255.255.x.x 192.168.x.x http inside

  No snmp server location

  No snmp Server contact

  SNMP-Server Community public

  No trap to activate snmp Server

  enable floodguard

  255.255.x.x telnet inside 192.168.x.x

  Telnet timeout 5

  SSH 194.39.97.0 255.255.255.0 outside

  SSH timeout 5

  management-access inside

  Console timeout 0

  VPDN group pppoe_group request dialout pppoe

  VPDN group pppoe_group localname [email protected] / * /

  VPDN group ppp authentication pap pppoe_group

  VPDN username [email protected] / * / password *.

  encrypted privilege 15

  vpnclient Server 212.xx.xx.xx

  vpnclient mode network-extension-mode

  vpntest vpngroup vpnclient password *.

  vpnclient username pixtest password *.

  Terminal width 80

  the hub, I created a user pixtest, a group vpntest and I? ve created the rules of the network for example to what server, users behind the pix will be able to access.

  And that? s all.

  I couldn't send you exit pix or hub because I don't have an error or a message that the tunnel will be established.

  What can be wrong?

  Thanks for the replies

  This configuration example shows how to create an IPsec tunnel to a computer that is running the Client VPN Cisco's (4.x and later versions) to a Cisco VPN concentrator 3000 to allow the user to safely access the network inside the VPN concentrator.

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2284/products_configuration_example09186a008026f96c.shtml