Several VPN clients behind PIX

Similar Questions

• Cisco VPN Client behind PIX 515E,-> VPN concentrator

  I'm trying to configure a client as follows:

  The user is running Cisco VPN Client 4.0. They are behind a 6.1 PIX 515E (4), and I need to connect to a VPN concentrator located outside of our network. We use PAT for address translation. As far as I know, to allow ipsec through Firewall 1 tunnel, I need to upgrade the pix to 6.3 and activate "fixup protocol esp-ike.

  Is there another way to do this? I am also curious to know how much more easy/better this will work if we were dealing with pptp.

  You don't necessarily need to fixup protocol esp-ike active. The remote Hub there encapsulation NAT - T enabled so that clients behind the NAT can run?

• Number of VPN clients behind a PIX 501, restriction?

  Is there a restriction in the number of VPN clients can be behind a PIX 501. Is is just limited by the number of hosts (10, 50, Unlimited)?

  Hello

  Behind a PIX VPN clients. Will you use NAT - T (must). It will be limited only to the number of users (normal users) through the PIX. So if you have a license to use 10 or 50 then the VPN connection is counted in this list.

  Connection VPN Client through PIX is not IKE tunnel. They are normal UDP500 and UDP4500 peers.

  Vikas

• Several outbound VPN connections behind PIX-515E

  I will take a PIX-515E off-site for a provision of access internet location. I have several people behind this PIX, who will have to return to the same Office VPN. One person can VPN through the PIX very well, but if someone else tries to VPN they cannot. Once the first person has disconnected for 10 minutes, then the next person can connect. I activated the NAT - T and added fixup protocol esp-ike. What can I do it wrong? Thank you.

  fixup protocol esp-ike - allows PAT to (ESP), one tunnel.

  Please remove this correction.

  If the remote site has NAT - T enabled, then you should be able to use NAT - T and more than 1 user should be able to use behind the PIX VPN client.

  See you soon

  Gilbert

• VPN client behind ok asa pix but no asa

  Hi all

  I was faced with a newly installed asa5505 couple. We can use the vpnclient in devices, but not behind another asa. Behind the asa same we can vpn for previous installations of pix. But when we go to other asa installs, we get the regular creation of translation failed for protocol 50.

  We have activated, isakmp, nat-traversal, udp 4500 and udp 10000. If the fault is at the other end, even if the error shows in this end?

  Anyone who is willing to help me with this?

  see you soon / Peter

  You do not allow protocol 50 - ESP through the firewall. The remote end VPN are trying to create a VPN in mode 'Hand' is not "Aggressive" mode as VPN clients.

  Add the below and test again: -.

  permit for outside_access_in to access extensive list of 6 esp a whole line

  HTH.

• Cisco VPN Client Authentication - PIX 515E-UR

  Hi all

  I need your expert help on the following issues I have:

  1. I would like to create more than 1 client VPN on my PIX-515E groups. This is so that I can give a different part of the internal network access to different type of VPN connection. For example, I want a group to have no XAUTH, while the other group must use RADIUS XAUTH. Is it possible for me to do this? I see the PIX automatically enable RADIUS on both groups of VPN clients.

  2. the RADIUS server is a Microsoft ISA with IAS server and it is located on the PIX inside interface. The VPN endpoint is external interface of the PIX. Is there a problem with this Setup? Do I need to have the RADIUS server that is located on the external interface?

  3 can. what command I use to debug RADIUS authentication?

  Thanks in advance for your help.

  Hi vincent,.

  (1) you can use the vpngroup *-authentication server ipaddress to specify the IP address of the Radius Server on a particular group... If you do not specify this, the authentication of the user is made locally... also check for vpngroup * order of user authentication

  (2) there should be no problem with the installation of your... should work fine... If the RADIUS is outdoors, it is subject to many attacks... so have it inside...

  (3) use the "RADIUS session debug" or "debug aaa authentication..."

  I hope this helps... all the best... the rate of responses if found useful

  REDA

• Remote access VPN Client to PIX, DNS issue

  Hi all.  I searched on this, but I can't find my answer.

  I set up a VPN connection to a PIX Firewall (running the version 8.0 (4)) for my business.  The VPN connection works correctly, in that I can connect to it using my software (v 5.0.02.0090) Cisco VPN Client and ping servers/resources internal IP address. However, if I try to ping by host name, it does not resolve to an IP address.  If I open a command prompt on my PC and type ipconfig/all, there are no DNS servers for my VPN, just for my normal Intel NIC adapter - I think I should have a DNS server listed under the map of VPN, right?  Here is the relevant (I think) for the VPN config lines:

  8.0 (4) version PIX

  domain xx.xx

  DNS lookup field inside

  DNS server-group DefaultDNS

  Server name 192.168.20.23

  domain xx.xx

  IP local pool vpnpoolIT 10.10.8.2 - 10.10.8.254 mask 255.255.255.0

  Crypto ipsec transform-set esp-3des esp-md5-hmac FirstSet

  Crypto-map dynamic dyn1 1jeu transform-set FirstSet

  Crypto-map dynamic dyn1 1 lifetime of security association set seconds 28800

  Crypto-map dynamic dyn1 kilobytes of life 1 set security-association 4608000

  crypto ISAKMP policy 1

  preshared authentication

  3des encryption

  md5 hash

  Group 2

  life 86400

  tunnel-group ITGroup type remote access

  tunnel-group ITGroup General attributes

  address vpnpoolIT pool

  Group-RADIUS authentication server

  tunnel-group ITGroup ipsec-attributes

  pre-shared-key *.

  Am I missing?  I can solve the DNS on the PIX itself requests.

  All the info I can find online is for an older version of the PIX software which says that I should enter the vpngroup dns- IP address of the server command, but this command is not available in my version of the software.

  Hello

  To set a DNS server to be injected into the VPN clients when they connect, you can do the following:

  This is the tunnel-group where lands the remote connection:

  tunnel-group ITGroup type remote access

  tunnel-group ITGroup General attributes

  address vpnpoolIT pool

  Group-RADIUS authentication server

  tunnel-group ITGroup ipsec-attributes

  pre-shared-key *.

  For example, create a group policy:

  internal VPN group policy
  attributes of VPN group policy

  DNS value--> x.x.x.x where x.x.x.x is the IP address of the DNS server

  Then, apply the group policy for the Group of tunnel:

  tunnel-group ITGroup General attributes

  Group Policy - by default-VPN

  It will be useful.

  Federico.

• Several VPN Client 1 LAN

  Hello

  We have 2 users who need to connect to our PIX 515 6.1 (4) using the client software of Cisco VPN Client 4.0.5 (Rel) on the Remote LAN Site.

  they all have access to the Internet Via Watchguard Firebox and router Cisco 1712.

  , but only one can access our VPN through the Cisco VPN client at the same time. When the 2nd user try to connect, the other connection of users disconnects.

  Does anyone have a question?

  You have this command in your pix

  ISAKMP nat-traversal

• 506th 3.6.3 VPN client and PIX

  Hello

  I am trying to build a VPN between Ver of Client VPN 3.6.3 and a 6.2 (2) running of PIX 506e with 3DES.

  Firewall # sh ver

  Cisco PIX Firewall Version 6.2 (2)

  Cisco PIX Device Manager Version 2.1 (1)

  Updated Saturday, June 7 02 17:49 by Manu

  Firewall up to 7 days 4 hours

  Material: PIX-506E, 32 MB RAM, Pentium II 300 MHz processor

  Flash E28F640J3 @ 0 x 300, 8 MB

  BIOS Flash AM29F400B @ 0xfffd8000, 32 KB

  Features licensed:

  Failover: disabled

  VPN - A: enabled

  VPN-3DES: enabled

  Maximum Interfaces: 2

  Cut - through Proxy: enabled

  Guardians: enabled

  URL filtering: enabled

  Internal hosts: unlimited

  Flow: limited

  Peer IKE: unlimited

  Modified configuration of enable_15 to 22:59:47.355 UTC Friday, December 13, 2002

  Firewall #.

  I get the following errors:

  Firewall #.

  crypto_isakmp_process_block: src dest 198, Mike.

  Peer VPN: ISAKMP: approved new addition: ip:Mike Total VPN peer: 1

  Peer VPN: ISAKMP: ip:Mike Ref cnt is incremented to peers: 1 Total peer VPN: 1

  Exchange OAK_AG

  ISAKMP (0): treatment ITS payload. Message ID = 0

  ISAKMP (0): audit ISAKMP transform 1 against the policy of priority 10

  ISAKMP: encryption... What? 7?

  ISAKMP: hash SHA

  ISAKMP: default group 2

  ISAKMP: preshared extended auth

  ISAKMP: type of life in seconds

  ISAKMP: lifespan (IPV) 0x0 0 x 20 0xc4 0x9b

  ISAKMP: attribute 3584

  ISAKMP (0): atts are not acceptable. Next payload is 3

  ISAKMP (0): audit ISAKMP transform 2 against the policy of priority 10

  ISAKMP: encryption... What? 7?

  ISAKMP: MD5 hash

  ISAKMP: default group 2

  ISAKMP: preshared extended auth

  ISAKMP: type of life in seconds

  ISAKMP: lifespan (IPV) 0x0 0 x 20 0xc4 0x9b

  ISAKMP: attribute 3584

  ISAKMP (0): atts are not acceptable. Next payload is 3

  ISAKMP (0): audit ISAKMP transform 3 against the policy of priority 10

  ISAKMP: encryption... What? 7?

  ISAKMP: hash SHA

  ISAKMP: default group 2

  ISAKMP: preshared auth

  ISAKMP: type of life in seconds

  ISAKMP: lifespan (IPV) 0x0 0 x 20 0xc4 0x9b

  ISAKMP: attribute 3584

  ISAKMP (0): atts are not acceptable. Next payload is 3

  ISAKMP (0): audit ISAKMP transform 4 against the policy of priority 10

  ISAKMP: encryption... What? 7?

  ISAKMP: MD5 hash

  ISAKMP: default group 2

  ISAKMP: preshared auth

  ISAKMP: type of life in seconds

  ISAKMP: lifespan (IPV) 0x0 0 x 20 0xc4 0x9b

  ISAKMP: attribute 3584

  ISAKMP (0): atts are not acceptable. Next payload is 3

  ISAKMP (0): audit ISAKMP transform against the policy of priority 10 5

  ISAKMP: encryption... What? 7?

  ISAKMP: hash SHA

  ISAKMP: default group 2

  ISAKMP: preshared extended auth

  ISAKMP: type of life in seconds

  ISAKMP: lifespan (IPV) 0x0 0 x 20 0xc4 0x9b

  ISAKMP: attribute 3584

  ISAKMP (0): atts are not acceptable. Next payload is 3

  ISAKMP (0): audit ISAKMP transform 6 against the policy of priority 10

  ISAKMP: encryption... What? 7?

  ISAKMP: MD5 hash

  ISAKMP: default group 2

  ISAKMP: preshared extended auth

  ISAKMP: type of life in seconds

  ISAKMP: lifespan (IPV) 0x0 0 x 20 0xc4 0x9b

  ISAKMP: attribute 3584

  ISAKMP (0): atts are not acceptable. Next payload is 3

  ISAKMP (0): audit ISAKMP transform 7 against the policy of priority 10

  ISAKMP: encryption... What? 7?

  ISAKMP: hash SHA

  ISAKMP: default group 2

  ISAKMP: preshared auth

  ISAKMP: type of life in seconds

  ISAKMP: lifespan (IPV) 0x0 0 x 20 0xc4 0x9b

  ISAKMP: attribute 3584

  ISAKMP (0): atts are not acceptable. Next payload is 3

  ISAKMP (0): audit ISAKMP transform 8 against the policy of priority 10

  ISAKMP: encryption... What? 7?

  ISAKMP: MD5 hash

  ISAKMP: default group 2

  ISAKMP: preshared auth

  ISAKMP: type of life in seconds

  ISAKMP: lifespan (IPV) 0x0 0 x 20 0xc4 0x9b

  ISAKMP: attribute 3584

  ISAKMP (0): atts are not acceptable. Next payload is 3

  ISAKMP (0): audit ISAKMP transform 9 against the policy of priority 10

  ISAKMP: encryption... What? 7?

  ISAKMP: hash SHA

  ISAKMP: default group 2

  ISAKMP: preshared extended auth

  ISAKMP: type of life in seconds

  ISAKMP: lifespan (IPV) 0x0 0 x 20 0xc4

  crypto_isakmp_process_block: src dest 198, Mike.

  Peer VPN: ISAKMP: ip:Mike Ref cnt is incremented to peers: 2 Total VPN peer: 1

  Peer VPN: ISAKMP: ip:Mike Ref cnt decremented to peers: 1 Total peer VPN: 1

  crypto_isakmp_process_block: src dest 198, Mike.

  Peer VPN: ISAKMP: ip:Mike Ref cnt is incremented to peers: 2 Total VPN peer: 1

  Peer VPN: ISAKMP: ip:Mike Ref cnt decremented to peers: 1 Total peer VPN: 1

  crypto_isakmp_process_block: src dest 198, Mike.

  Peer VPN: ISAKMP: ip:Mike Ref cnt is incremented to peers: 2 Total VPN peer: 1

  Peer VPN: ISAKMP: ip:Mike Ref cnt decremented to peers: 1 Total peer VPN: 1

  ISAKMP (0): retransmission of phase 1...

  ISAKMP (0): retransmission of phase 1...

  ISAKMP (0): delete SA: CBC Mike, dst 198.143.226.158

  ISADB: Reaper checking HIS 0x812ba828, id_conn = 0 DELETE IT!

  Peer VPN: ISAKMP: ip:Mike Ref cnt decremented to peers: 0 Total of VPN peer: 1

  Peer VPN: ISAKMP: deleted peer: ip:Mike VPN peer Total: 0

  Looks like I have a problem of encryption. Here is the biggest part of my setup:

  : Saved

  :

  6.2 (2) version PIX

  ethernet0 nameif outside security0

  nameif ethernet1 inside the security100

  activate the encrypted password

  encrypted passwd

  Firewall host name

  domain name

  fixup protocol ftp 21

  fixup protocol http 80

  fixup protocol h323 h225 1720

  fixup protocol h323 ras 1718-1719

  fixup protocol they 389

  fixup protocol rsh 514

  fixup protocol rtsp 554

  fixup protocol sqlnet 1521

  fixup protocol sip 5060

  fixup protocol 2000 skinny

  No fixup not protocol smtp 25

  names of

  access-list outside_access_in.255.255.224 all

  access-list outside_access_in 255.255.255.224 all

  outside_access_in tcp allowed access list all hosteq smtp

  outside_access_in list access permit tcp any host eq pop3

  outside_access_in list access permit tcp any host eq 5993

  outside_access_in tcp allowed access list all hostq smtp

  outside_access_in tcp allowed access list all pop3 hosteq

  outside_access_in list access permit tcp any host eq www

  outside_access_in tcp allowed access list any ftp hosteq

  outside_access_in tcp allowed access list all www hosteq

  outside_access_in tcp allowed access list all www hosteq

  allow the ip host Toronto one access list outside_access_in

  permit outside_access_in ip access list host Mike everything

  outside_access_in deny ip access list a whole

  pager lines 24

  opening of session

  monitor debug logging

  buffered logging critical

  logging trap warnings

  history of logging warnings

  host of logging inside

  interface ethernet0 car

  Auto interface ethernet1

  ICMP allow all outside

  ICMP allow any inside

  Outside 1500 MTU

  Within 1500 MTU

  IP address outside some 255.255.255.248

  IP address inside 10.1.1.1 255.255.255.0

  IP verify reverse path to the outside interface

  IP verify reverse path inside interface

  alarm action IP verification of information

  alarm action attack IP audit

  IP local pool vpnpool 192.168.1.50 - 192.168.1.75

  PDM location 255.255.255.255 inside xxx

  location of router PDM 255.255.255.255 outside

  PDM location 255.255.255.255 inside xxx

  location of PDM Mike 255.255.255.255 outside

  location of PDM Web1 255.255.255.255 inside

  PDM location 255.255.255.255 inside xxx

  PDM location 255.255.255.255 inside xxx

  PDM location 255.255.255.224 out xxx

  PDM location 255.255.255.224 out xxx

  xxx255.255.255.224 PDM location outdoors

  PDM location 255.255.255.255 out xxx

  location of PDM 10.1.1.153 255.255.255.255 inside

  location of PDM 10.1.1.154 255.255.255.255 inside

  PDM logging 100 reviews

  history of PDM activate

  ARP timeout 14400

  Global 1 interface (outside)

  NAT (inside) 1 0.0.0.0 0.0.0.0 0 0

  Several static inside servers...

  Access-group outside_access_in in interface outside

  Route outside 0.0.0.0 0.0.0.0 Router 1

  Timeout xlate 03:00

  Timeout conn 01:00 half-closed 0: 10:00 udp 0:02:00 CPP 0: h323 from 10:00 0:05:00 sip 0:30:00 sip_media 0:02:00

  Timeout, uauth 0:05:00 absolute

  GANYMEDE + Protocol Ganymede + AAA-server

  RADIUS Protocol RADIUS AAA server

  AAA-server local LOCAL Protocol

  No snmp server location

  No snmp Server contact

  No trap to activate snmp Server

  enable floodguard

  Permitted connection ipsec sysopt

  No sysopt route dnat

  Crypto ipsec transform-set esp-3des esp-md5-hmac RIGHT

  Crypto-map dynamic dynmap 30 transform-set RIGHT

  map newmap 20-isakmp ipsec crypto dynamic dynmap

  newmap outside crypto map interface

  ISAKMP allows outside

  ISAKMP key * address Mike netmask 255.255.255.255

  ISAKMP identity address

  part of pre authentication ISAKMP policy 10

  ISAKMP policy 10 3des encryption

  ISAKMP policy 10 md5 hash

  10 2 ISAKMP policy group

  ISAKMP life duration strategy 10 86400

  vpngroup mycompany vpnpool address pool

  vpngroup mycompany SERVER101 dns server

  vpngroup wins SERVER101 mycompany-Server

  mycompany vpngroup default-domain whatever.com

  vpngroup idle time 1800 mycompany

  mycompany vpngroup password *.

  SSH timeout 15

  dhcpd address 10.1.1.50 - 10.1.1.150 inside

  dhcpd dns Skhbhb

  dhcpd lease 3600

  dhcpd ping_timeout 750

  dhcpd field ljkn

  dhcpd allow inside

  Terminal width 80

  Cryptochecksum:0e4c08a9e834d03338974105bb73355f

  : end

  [OK]

  Firewall #.

  Any ideas?

  Thank you

  Mike

  Hi Mike,.

  You are welcome at any time. Will wait for your update

  Kind regards

  Arul

• Place a FIOS for VPN router behind PIX 501

  I have a Verizon FIOS internet connection and one of their routers wide wireless broadband, and this is a configuration of base completely... their router DHCP and firewalls, and the connection has a dynamic address.  I would put the PIX 501 behind the Verizon router as one of its clients and make the VPN PIX of other PIX 501 at other locations, such as my entire network has access to remote networks.

  Is this possible, and if yes, any who could some suggest configurations (how to address internal and external, static routes ports that may be required somewhere, etc.)?

  Thanks for any help.

  When installing my FiOS, I had already asked that it be installed on the Ethernet cable. Don't know they need to do something for you to spend the coax to Ethernet.

  The best way to test it would be to find the Media Converter (follow the coaxial cable between your FiOS router to the demarc and there should be a box with a coaxial port, some phone Sockets and an Ethernet port). If you unplug the coaxial cable and plug a laptop computer on the Ethernet port, see if your laptop takes a public IP address. If Yes, then you just have to run to your PIX501 Ethernet cable and you should be ready.

  Just to note that Verizon, according to your region, reserved DHCP assignments. This means that you may need to call Verizon and ask them to release the previous assignment of DHCP-MAC addresses. I had this happen recently. They must release the assignment then your PIX will pull a new IP address and they will book your new IP - MAC address assignment. They do this to speed up the connection to a cold start time on the router.

  Basically, they are filtering by MAC address, but rather through a sticky ARP where they clear the entry, and then the next device that connects records his MAC address and then only that device is permitted to connect to this leg of the cable. So there is a bit of work you have to do, but the most difficult part would be sitting on hold waiting for a tech, if you call to Verizon.

• VPN client to PIX - no bytes received on client

  I have a PIX with 6.3 (4) and the Client VPN 5.0.06.0110.  I can establish a tunnel, but can not pass traffic beyond the PIX to the customer network.  I ping the inside of the PIX, I believe that the tunnel is very well, but maybe the ACL is bad?  Once the tunnel is established, under details statistics/Tunnel the bytes sent back, but the received bytes remaining to 0.

  If someone would like to chime, I'd appreciate it.

  pixfirewall # sh conf
  : Saved
  : Written by enable_15 at 14:45:50.611 UTC Tuesday, December 15, 2009
  6.3 (4) version PIX
  interface ethernet0 car
  interface ethernet1 100full
  ethernet0 nameif outside security0
  nameif ethernet1 inside the security100
  enable the encrypted password xxxxx
  XXXXX encrypted passwd
  pixfirewall hostname
  domain xxx.com
  fixup protocol dns-maximum length 4096
  fixup protocol ftp 21
  fixup protocol h323 h225 1720
  fixup protocol h323 ras 1718-1719
  fixup protocol http 80
  fixup protocol they 389
  fixup protocol rsh 514
  fixup protocol rtsp 554
  fixup protocol sip 5060
  fixup protocol sip udp 5060
  fixup protocol 2000 skinny
  fixup protocol smtp 25
  fixup protocol sqlnet 1521
  fixup protocol tftp 69
  names of
  access-list 101 permit ip 192.168.27.0 255.255.255.0 10.10.10.0 255.255.255.0
  access-list 102 permit ip 192.168.27.0 255.255.255.0 10.10.10.0 255.255.255.0
  pager lines 24
  ICMP allow all outside
  ICMP allow any inside
  Outside 1500 MTU
  Within 1500 MTU
  IP address outside 209.xxx.xxx.248 255.255.255.255
  IP address inside 192.168.27.2 255.255.255.0
  alarm action IP verification of information
  alarm action attack IP audit
  IP local pool ippool 10.10.10.1 - 10.10.10.254
  PDM logging 100 information
  history of PDM activate
  ARP timeout 14400
  NAT (inside) - 0 102 access list
  Route outside 0.0.0.0 0.0.0.0 209.xxx.xxx.1 1
  Timeout xlate 0:05:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225
  H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00
  Timeout, uauth 0:05:00 absolute
  GANYMEDE + Protocol Ganymede + AAA-server
  AAA-server GANYMEDE + 3 max-failed-attempts
  AAA-server GANYMEDE + deadtime 10
  RADIUS Protocol RADIUS AAA server
  AAA-server RADIUS 3 max-failed-attempts
  AAA-RADIUS deadtime 10 Server
  AAA-server local LOCAL Protocol
  Enable http server
  No snmp server location
  No snmp Server contact
  SNMP-Server Community public
  No trap to activate snmp Server
  enable floodguard
  Permitted connection ipsec sysopt
  Crypto ipsec transform-set esp - esp-md5-hmac gvnset
  Crypto-map dynamic dynmap 10 transform-set gvnset
  gvnmap 10 card crypto ipsec-isakmp dynamic dynmap
  gvnmap interface card crypto outside
  ISAKMP allows outside
  ISAKMP key * address xxx.xxx.142.105 netmask 255.255.255.255
  ISAKMP identity address
  ISAKMP nat-traversal 20
  part of pre authentication ISAKMP policy 9
  encryption of ISAKMP policy 9
  ISAKMP policy 9 md5 hash
  9 2 ISAKMP policy group
  ISAKMP policy 9 life 28800
  vpngroup address ippool pool gvnclient
  vpngroup dns 192.168.27.1 Server gvnclient
  vpngroup gvnclient wins server - 192.168.27.1
  vpngroup gvnclient by default-domain xxx.com
  vpngroup split tunnel 101 gvnclient
  vpngroup idle 1800 gvnclient-time
  vpngroup password gvnclient *.
  Telnet 192.168.27.0 255.255.255.0 inside
  Telnet timeout 15
  SSH timeout 60
  management-access inside
  Console timeout 0
  Terminal width 80
  Cryptochecksum:xxx
  pixfirewall #.

  Servers on the 192.168.27.0 network probably need a route that points the 10.10.10.0/24 network to the PIX. It is possible that your customer VPN traffic if he imagines, but the other end does not know how to get back.

• The VPN client VPN connection behind other PIX PIX

  I have the following problem:

  I wanted to establish the VPN connection the client VPN to PIX on GPRS / 3G, but I didn t have a bit of luck with PIX IOS version 6.2 (2).

  So I upgraded PIX to 6.3 (4) to use NAT - T and VPN client to version 4.0.5

  I have configured PIX with NAT-T(isakmp nat-traversal 20), but I still had a chance, he would not go through the 1st phase. As soon as I took nat-traversal isakmp off he started working, and we can connect to our servers.

  Now, I want to connect to the VPN client behind PIX to our customer PIX network. VPN connection implements without problem, but we can not access the servers. If I configure NAT - T on the two PIX, or only on the customer PIX or only on our PIX, no VPN connection at all.

  If I have to connect VPN client behind PIX to the customer's network and you try to PING DNS server for example, on our PIX, I have following error:

  305006: failed to create of portmap for domestic 50 CBC protocol translation: dst outside:194.x.x.x 10.10.1.x

  194.x.x.x is our customer s address IP PIX

  I understand that somewhere access list is missing, but I can not understand.

  Of course, I can configure VPN site to site, but we have few customers and take us over their servers, so it'd just connect behind PIX VPN and client connection s server, instead of the first dial-in and then establish a VPN connection.

  Can you please help me?

  Thank you in advan

  The following is extracted from ASK THE DISCUSSION FORUM of EXPERTS with Glenn Fullage of Cisco.

  I've cut and pasted here for you to read, I think that the problem mentioned below:

  Question:

  Hi Glenn,.

  Following is possible?

  I have the vpn client on my PC, my LAN is protected by a pix. I can launch the vpn client to connect to remote pix. Authenticates the vpn client and the remote pix makes my PC with the assigned ip appropriate to its pool of ip address.

  The problem that I am facing is that I can not anything across the pix remote ping from my PC which is behind my pix. Can you please guide me what I have to do to make this work, if it is possible?

  My PC has a static ip address assigned with the default gateway appropriate pointing to my s pix inside interface.

  Thank you very much for any help provided in advance.

  Response from Glenn:

  First of all, make sure that the VPN connection works correctly when the remote PC is NOT behind a PIX. If that works fine, but then breaks when put behind a PIX, it is probably that the PIX is PAT, which usually breaks IPSec. Add the following command on your PIX VPN client is behind:

  fixup protocol esp-ike

  See http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/cmdref/df.htm#wp1067379 for more details.

  If it still has issues, you can turn on NAT - T on the remote PIX that ends the VPN, the client and the remote PIX must encapsulate then all IPSec in UDP packets that your PIX will be able to PA correctly. Add the following command on the remote PIX:

  ISAKMP nat-traversal

  See http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/cmdref/gl.htm#wp1027312 for more details.

  NAT - T is a standard for the encapsulation of the UDP packets inot IETF IPSec packets.

  ESP IPSec (Protocol that use your encrypted data packets) is an IP Protocol, it is located just above IP, rather than being a TCP or UDP protocol. For this reason, it has no TCP/UDP port number.

  A lot of features that make the translation of address of Port (PAT) rely on a single to PAT TCP/UDP source port number ' ing. Because all traffic is PAT would be at the same source address, must be certain uniqueness to each of its sessions, and most devices use the port number TCP/UDP source for this. Because IPSec doesn't have one, many features PAT fail to PAT it properly or at all, and the data transfer fails.

  NAT - T is enabled on both devices of the range, they will determine during the construction of the tunnel there is a PAT/NAT device between them, and if they detect that there is, they automatically encapsulate every IPSec packets in UDP packets with a port number of 4500. Because there is now a port number, PAT devices are able to PAT it correctly and the traffic goes normally.

  Hope that helps.

• The CBAC & VPN Client

  I use soft Cisco VPN client behind a Cisco CCCB router running. What are the ports must be opened to allow the client VPN working properly?

  I am currently using:

  allow an esp

  allow udp any any eq isakmp

  These are necessary, but you may also need to open UDP 10000 to support NAT - T if IPSec must cross a NAT border along its way.

  You'll also need allow beach access VPN client address to the IP address ranges whatever they are to be used in common. This is because packages through the ACL twice, once encrypted using ESP and ISAKMP, there not yet encrypted.

  So, if the VPN client has a range of pool to say 10.1.1.0/24 and his contact only the acl 10.2.0.0/16 subnet would look like:

  IP access-group extended VPNACCESS

  allow an esp

  allow udp any any eq isakmp

  permit IP 10.1.1.0 0.0.0.255 10.2.0.0 0.0.255.255

  Andy

• Failure of VPN Client

  With UDP encapsulation, it is possible to have multiple VPN clients behind a router that tap one public IP address. IE: A site DSL with Linksys router, can I have multiple clients on the LAN side to connect simultaneously to the VPN Concentor. I know that's not possible without UDP encapsulation and I think that it is not possible with UDP encapsulation, but confirmation sought a way or another.

  Thank you

  Hello

  your understanding is good, it is not possible in two ways in this scenario.

  Why, because when you use UDP/IPSec, IKE traffic is always sent using UDP500, and PAT instrument cannot use the same port for more than one machine, thas why you would see 2 customer disconnect the first person, when you try / launch 2nd session behind the same device.

  solution is ipsec/tcp, vpn3000 v3.5 + (client concentrator) support.

  Mon.02

  THX

  AFAQ

• Cisco VPN disconnection problem vpn client

  Hello

  We have a 8.2 (3) Cisco ASA and several vpn client ipsec that connect to it (5.0.07.0290 - k9 and 5.0.07.0410 - k9).

  ExExactly after that 4 hours of these clients vpn connections are deleted even if the client is still sending traffic. I can't find any parameter configuration in order to avoid this connection drop. Someone has an idea how solve it?

  I have

  I have

  AF

  Hello

  Please paste the output of "sh cry run." We can check the values of life.

  also, you can activate him debugs following like half an hour before that the Client waits for the time to unplug.

  Deb cry isa 127

  Deb cry ips 127.

  We can check the reason for the debugging by using the ip address of the client.

  I hope this helps.

  Kind regards

  Anisha

  P.S.:Please assign this thread answered if you feel that your query is resolved. Note the useful messages.