Redirect pat interface on a PIX PPTP

Is it possible to redirect traffic PPTP from the external interface of a PIX, which has a unique IP address or are you really to have an any translated IP peripheral PPTP termination.

Example, I have a PIX with a unique public IP I have to redirect ports 23 25 53 110 to an in-house 2 k server. I would be able to redirect traffic to this server pptp also or will I have problems with the gre and need a new ip address?

Patrick Laidlaw

GRE will cause you problems. PPTP uses GRE (Protocol IP 47) at the time and TCP 1723 port. You will be able to redirect TCP/1723, but not the GRE traffic.

To do this, you will need a separate IP address.

Tags: Cisco Security

Similar Questions

  • HDD upgrade on Satellite Pro A120-184 - SATA or PATA interface

    Hello

    I have a 120-184 (1 year) and want to know if there a SATA or PATA interface? I need to upgrade the hard drive, but here? m do not know what model to buy... To be honest I don't really know the difference!

    Sorry for stupid questions,
    Thanks in advance,
    Mike

    Hey Buddy

    You need a SATA HDD.
    The P - ATA is a technology more old which has been replaced by a new interface standard called SATA (Serial Advanced Technology Attachment).

    As I m wrong not the satellite Pro A120 was equipped with 60 GB HARD drive.

    I think you should be able to use the 100 GB or maybe a 120 GB hard drives.
    More big disk HARD s could not be recognized by the BIOS correctly.

    In case you I would not try larger 120 GB HARD disk sizes.

    See you soon

  • Several Interfaces of VPN - Pix 6.3 (5)

    Hi all

    I'm trying to establish a secondary VPN interface off our PIX for reasons of split tunneling. Unfortunately, I can't upgrade to 7.0 + to provide the functionality of routing same interface.

    I want to keep our card crypto in place current production until the transition is complete. Is it possible to have a 'map outside_map interface outside crypto' and a 'card crypto interface ExternalVPN ExternalVPN' or will be the new command to destroy the existing?

    Thank you.

    -Dominique

    This version of Pix follows the same principle that any 7.x or 8.x or cisco devices, there can only be one card encryption interface, in your case, I think you are applying cryptographic cards various different interfaces so the substitution them shouldn't be your concerned, rather ensuring the flow and routing.

  • Interface GUI language PIX

    Guys,

    Is the graphic interface of the PIX with a multilingual browser configuration? What languages are supported? In particular is a Japanese GUI available? And if cannot, therefore, a user/administrator choose which language he wants when connecting?

    See you soon,.

    Vito

    Hi Vito,

    I've never heard of PDM to be multilingual.

    Thank you

    Nadeem

  • Ping inside the interface on a Pix 501 from outside the network

    All the

    I have a Pix 501 firewall at a remote site with an IPSEC tunnel established at HQ. We have an analysis tool which remote sites for us let proactively pings know when a site crashes. I want to set up this ping the inside interface of the Pix tool as I can with 871 routers; However I can't configure the Pix to allow ICMP inside interface. I know by default that the Pix does not allow ICMP to the opposite interface and I was wondering if someone could help me with a configuration that will allow this? I enclose my configuration of the pix!

    Thank you

    Brian

    Hello

    By raising the ordering tool, it seems that the 'management-access' command was introduced in version 6.3

    I recommend spending at 6.3 If you can.

    Federico.

  • PAT on IPSEC VPN (Pix 501)

    Hello

    I work to connect a PIX 501 VPN for a 3rd party hub 3015. The hub requires all traffic to come from a single source IP address. This IP address is assigned to me as z.z.z.z. I have successfully built the VPN and tested by mapping staticly internal IP with the IP address assigned, but cannot get the orders right to do with PAT in order to have more than one computer on the subnet 10.x.x.0. This Pix is also a backup for internet routing and NAT work currently as well for this.

    I can redirect traffic to my subnet to the remote subnet via the VPN, but I can't seem to get the right stuff PAT to the VPN using the assigned IP address. If anyone can give me some advice that would be great.

    lines of current config interesting configuration with static mapping:

    --------------------------------------------------------------------------

    access-list 101 permit ip 10.0.0.0 255.255.255.0 y.y.y.0 255.255.255.0

    access-list 102 permit ip y.y.y.0 255.255.255.0 z.z.z.z host

    access-list 103 allow host ip y.y.y.0 255.255.255.0 z.z.z.z

    IP address outside w.w.w.1 255.255.255.248

    IP address inside 10.0.0.1 255.255.255.0

    Global 1 interface (outside)

    NAT (inside) - 0 102 access list

    NAT (inside) 1 0.0.0.0 0.0.0.0 0 0

    public static z.z.z.z (Interior, exterior) 10.x.x.50 netmask 255.255.255.255 0 0

    Route outside 0.0.0.0 0.0.0.0 w.w.w.2 1

    correspondence address card crypto mymap 10 103

    mymap outside crypto map interface

    ISAKMP allows outside

    Thank you!

    Dave

    Dave,

    (1) get rid of static electricity. Use more Global/NAT. The static method will create a permanent

    translation for your guests inside and they will always be this way natted. Use

    NAT of politics, on the contrary, as shown here:

    not static (inside, outside) z.z.z.z 10.x.x.50 netmask 255.255.255.255 0 0

    Global (outside) 2 z.z.z.z netmask 255.255.255.255

    (Inside) NAT 2-list of access 101

    (2) the statement, "nat (inside) access 0 2' list will prevent nat of your valuable traffic."

    Delete this because you need to nat 2 nat/global card. (as a general rule, simply you

    If you terminate VPN clients on your device and do not want inside the traffic which

    is intended for the vpn clients to be natted on the external interface).

    (3) with the instructions of Global/nat 2, all traffic destined for the remote network will be first

    translated into z.z.z.z. Then your card crypto using the ACL 103 will encrypt all traffic which

    sources of z.z.z.z for y.y.y.0 24. This translation wil happen only when traffic is destined for the vpn.

    I hope this helps. I have this work on many tunnels as you describe.

    Jamison

  • 506th PIX, PPTP and Windows 98

    Hello

    Customer cannot run IPSEC (long story), so we will try to use the 'customer' Microsoft PPTP to end their VPN on a PIX506E. To simplify things, we went with local authentication (RADIUS proved problematic on the Win2k Server).

    It works very well from an XP machine, but not Windows 98 - I get the message "Error 691", which means that the PIX is actively rejecting the login/password (i.e. the packets arrive on the PIX ok, I can see them in a debugging).

    Here, someone suggested that the machines Windows 98, which were connected to the field will add the domain name, IE. DOMAIN/username, rather than just the user name. I tried to create a local section for this combination, but without success.

    Anyone had similar problems or know a workaround?

    I get the engineer tomorrow to review RADIUS authentication (regardless of this problem, I want to disable the PIX), will that help may be?

    See you soon,.

    Mike.

    Who told you that it adds the name is quite correct. You can see the exact user name password that sends your pc windows 98 if you turn on loggin on the connection. The journal name is ppp.log. Take a look at this log after trying to connect and you will see the exact user name being sent, which is him you will need to put in your pix. You might want to retype your password for the user on the pix as well.

    Kurtis Durrett

  • A VPN client can go same interface on the Pix 515

    A user in a Pix VPN and get an address x.x.x.x via an ippool on the Pix. Once this is done, they will need access to information on the public network. Is it possible since they come out of the same interface?

    I can open ports and route subnets on our core routers, but that doesn't seem to work.

    Thank you

    Dwane

    Hi elodie

    You can do this by entering the following command

    permit same-security-traffic intra-interface

    Concerning

  • 3 interfaces and routing PIX

    Hi all

    I have a PIX 515E configured with 3 interfaces, exterior, Interior and a Tunnel interface to my VPN clients. VPN clients not only access within the network, I have to move them to other networks through the external interface. As you cannot route the IPSEC packets from the same interface its entry, which is why I used a separate interface for VPN clients. Default gateway is set to the external interface. Now the problem is that when the vpn users try to connect to Internet, Tunnel interface is getting traffic but does not send back as default route traffic is defined on the external interface.

    Tunnel interface is 192.168.32.253 and if I connect from a pc with the ip address of 192.168.32.50, its works perfectly fine and also routing traffic to other networks through outside as PIX knows where to forward packets. Can someone please help me solve this problem of routing in PIX.

    the Interior is 192.168.33.254 security 0

    the outside is 192.168.34.254 security 100

    The tunnel is 192.168.32.253 security 90

    NAT (inside) - 0 110 access list

    access-list 110 permit ip 192.168.33.0 255.255.255.0 any

    Thanks in advance.

    KAZ

    Unless you know that networks, clients must connect to it may not be a solution, given that it looks like you need the default routes two, one for traffic encrypted clients and the other for traffic not encrypted Internet. You may be able to create a NAT pool in the router that provides Internet access to the Tunnel interface so that all incoming client traffic is coordinated in this router to an address from a pool. That would make all remote clients look like they came from a subnet, so you wouldn't need a default route on the interface of Tunnel in the PIX. You will probably need to do this router's Internet interface an interface 'ip nat inside' because I don't think that IOS supports dynamic NAT pools with 'ip nat outside source. It sounds backwards, but I think it would work. You'll probably also want to use an access list or with the pool route map, NAT to only apply to the traffic to the Tunnel from PIX interface (i.e. VPN traffic), as I'm assuming that the same router provides Internet connectivity for the interfaces from the outside and the Tunnel to the PIX.

    Good luck!

  • Creating a new interface on the Pix 516F

    I've created and activated a new interface (DMZ) on a 516F Pix. In the MDP a default outbound rule was automatically created for this interface. I could get out to the internet without any problem. However, I need to open some ports in the DMZ to the inside interface. When I add a new access rule, the outbound rule disappears and I can no longer to the internet. I tried to recreate a similar rule to allow all tcp traffic to the external interface of the demilitarized zone. The MDP has accepted the rule, but when I went back to look at it, the rule has been changed from the outside to the inside.

    How can I maintain the default outbound rule and always open ports inside?

    Thank you

    Nick

    In General:

    allow access to your internal network (web servers, printers, regardless.) (BE SPECIFIC!)

    deny all access to your internal network (deny ip no matter what subnet)

    allow an ip

  • Amount of the ACLs on an interface of the PIX

    Hi all

    I just wanted to know how much group-access entry (s) that you can attached to a 515ER PIX interface? I wonder if it's the same rule as the router, IE 1 ACL/interface/direction. En thank you your help.

    Hi Vincent,.

    You can apply to a single group-access on any pix interface... is not like in a router in a router, you can apply groups of incoming/outgoing access... On a pix you can apply only inbound access-groups...

    I hope this helps... all the best...

    REDA

  • 506th PIX - PPTP

    Hello

    quick question regarding the 506e... .or all PIX firewall.

    Can PPTP sessions end on these firewalls, just as do the IP Sec sessions?

    Or they should end on some kind of server, and then open the ports on the firewall to let them pass

    Thank you

    Answer is YES!

    and here's the document you need you'll get:

    http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a0080143a5d.shtml

    Let me know if this helps and plese note all messages.

    Thank you

    Jay

  • This allows traffic between two interfaces ethernet on a PIX

    I have a PIX with interface inside, IP 10.198.16.1. It also has an interface called WTS, IP 10.12.60.1. I'm having difficulty to allow traffic from the 10.198.16.0 network to cross the PIX in 10.12.60.0. I'm trying specifically to allow access to a server with an IP address of 10.12.60.2.

    I enclose my config. Any help would be greatly appreciated!

    OK, so the inside interface has a security level of 100, WTS has a security level of 75, so traffic from inside to WTS is considered outbound traffic, which is allowed by default. All you need is a pair of nat/global (or static) between both interfaces so that the PIX knows how NAT traffic between two interfaces (remember, the PIX do NAT).

    You have this in your config file:

    NAT (inside) 1 10.0.0.0 255.0.0.0 0 0

    who says all traffic inside, interface with the IP 10.x.x.x address will be NAT would have, but you must then a global for the interface WTS define what those IPS will be NAT would.

    Adding:

    Global (WTS) 1 interface

    will be PAT all inside resolves the IP address of the interface WTS and allow traffic to flow between the interfaces. If you prefer the hosts inside the interface to appear as their own IP address on the WTS network, then you can use a static command and NAT addresses themselves, actually doing NAT, but not actually change addresses:

    static (inside, WTS) 10.198.16.1 10.198.16.1 netmask 255.255.240.0

    Hope that helps.

  • PPTP VPN pix 501 question

    I'm relatively new to the security stuff.  I'm a guy of the voice.  I created a Pix 501 for IPSEC VPN and works very well.  Then I tried it setting up PPTP VPN.  I use Windows XP to connect.  It connects fine, but I can't ping to the inside interface on the PIX.  I can do this by using IPSEC.  Any ideas?   Here is my config:

    :

    6.3 (3) version PIX

    interface ethernet0 car

    interface ethernet1 100full

    ethernet0 nameif outside security0

    nameif ethernet1 inside the security100

    activate the password * encrypted

    passwd * encrypted

    host name *.

    domain name *.

    fixup protocol dns-length maximum 512

    fixup protocol ftp 21

    fixup protocol h323 h225 1720

    fixup protocol h323 ras 1718-1719

    fixup protocol http 80

    fixup protocol pptp 1723

    fixup protocol rsh 514

    fixup protocol rtsp 554

    fixup protocol sip 5060

    fixup protocol sip udp 5060

    fixup protocol 2000 skinny

    fixup protocol smtp 25

    fixup protocol sqlnet 1521

    fixup protocol tftp 69

    names of

    access-list 101 permit icmp any any echo response

    access-list 80 allow ip 10.0.0.0 255.255.255.0 192.168.5.0 255.255.255.0

    access-list ip 10.0.0.0 sheep allow 255.255.255.0 192.168.5.0 255.255.255.0

    access-list ip 10.0.0.0 sheep allow 255.255.255.0 192.168.6.0 255.255.255.0

    pager lines 24

    opening of session

    emergency logging console

    Outside 1500 MTU

    Within 1500 MTU

    IP address outside of *. *. *. * 255.255.255.0

    IP address inside 10.0.0.1 255.255.255.0

    alarm action IP verification of information

    alarm action attack IP audit

    IP local pool pool1 192.168.5.100 - 192.168.5.200

    IP local pool pool2 192.168.6.100 - 192.168.6.200

    history of PDM activate

    ARP timeout 14400

    Global 1 interface (outside)

    NAT (inside) 0 access-list sheep

    NAT (inside) 1 10.0.0.0 255.0.0.0 0 0

    Access-group 101 in external interface

    Route outside 0.0.0.0 0.0.0.0 *. *. *. * 1

    Timeout xlate 03:00

    Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225

    H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00

    Timeout, uauth 0:05:00 absolute

    GANYMEDE + Protocol Ganymede + AAA-server

    RADIUS Protocol RADIUS AAA server

    AAA-server local LOCAL Protocol

    the ssh LOCAL console AAA authentication

    No snmp server location

    No snmp Server contact

    SNMP-Server Community public

    No trap to activate snmp Server

    enable floodguard

    Permitted connection ipsec sysopt

    Sysopt connection permit-pptp

    Sysopt connection permit-l2tp

    Crypto ipsec transform-set high - esp-3des esp-sha-hmac

    Crypto ipsec transform-set esp - esp-md5-hmac RIGHT

    Crypto dynamic-map cisco 4 strong transform-set - a

    Crypto-map dynamic dynmap 10 transform-set RIGHT

    Cisco dynamic of the partners-card 20 crypto ipsec isakmp

    partner-map interface card crypto outside

    card crypto 10 PPTP ipsec-isakmp dynamic dynmap

    ISAKMP allows outside

    ISAKMP key * address 0.0.0.0 netmask 0.0.0.0

    ISAKMP nat-traversal 20

    part of pre authentication ISAKMP policy 8

    ISAKMP strategy 8 3des encryption

    ISAKMP strategy 8 md5 hash

    8 2 ISAKMP policy group

    ISAKMP life duration strategy 8 the 86400

    vpngroup address pool1 pool test

    vpngroup default-field lab118 test

    vpngroup split tunnel 80 test

    vpngroup test 1800 idle time

    Telnet timeout 5

    SSH 10.0.0.0 255.0.0.0 inside

    SSH 192.168.5.0 255.255.255.0 inside

    SSH 192.168.6.0 255.255.255.0 inside

    SSH timeout 5

    management-access inside

    Console timeout 0

    VPDN PPTP-VPDN-group accept dialin pptp

    VPDN group PPTP-VPDN-GROUP ppp authentication chap

    VPDN group PPTP-VPDN-GROUP ppp mschap authentication

    VPDN group PPTP-VPDN-GROUP ppp encryption mppe auto

    VPDN group VPDN GROUP-PPTP client configuration address local pool2

    VPDN group VPDN GROUP-PPTP client configuration dns 8.8.8.8

    VPDN group VPDN GROUP-PPTP pptp echo 60

    VPDN group VPDN GROUP-PPTP client for local authentication

    VPDN username bmeade password *.

    VPDN allow outside

    You will have to connect to an internal system inside and out run the PIX using pptp.

    For ssh access the PIX, you will also need additional configuration, see the section on code PIX pre 7.x, section access ssh to the security apparatus .

    http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a008069bf1b.shtml#C4

    Concerning

  • Is it possible to build a vpn tunnel to the DMZ on a pix 515 interface?

    I would like to know if it is possible to have a vpn tunnel ending on a DMZ interface rather then inside interface of a pix 3-way. All the examples of configuration, I found route traffic from the VPN client somewhere on the internet on the inside interface of the pix. I tried a sheep-access list of the demilitarized zone to the vpn client, but it does not work. According to me, because the vpn traffic goes to the safety higher by definition interface. Am I wrong?

    Hello

    You can do it in use (nat 0 dmz x.x.x.x y.y.y.y)

Maybe you are looking for