Static NAT on PIX 501 help

Similar Questions

• PIX 501 PPPoE w / static NAT loss of connectivity

  I have a {should} installation very simple. PIX 501 with PPPoE on the external interface, 3 inside customers using PAT and 1 inside the client I am trying to use an address mapping static on permit communications with this host from the outside using a particular service. I did a lot of these before where there was an ADSL router in front of the PIX, but this is the first where I've used the PIX as the PPPoE client. When I use the static NAT for the single host it loses all connectivity beyond the PIX outside interface. When I get rid of the static mapping, through PAT very well. I spent many hours troubleshooting and control a lot of obvious things, but I am at a loss right now... unless it could be a problem with the IP address that has been assigned by the ISP for use with static NAT. Any thoughts on this would be greatly appreciated.

  Thank you

  Sorry, in your case that static would look like this because of the dynamic IP.

  static (inside, outside) 23 interface 10.1.1.1 23 netmask 255.255.255.255

  Daniel

• PIX 501 NAT and PAT with a single IP address

  Using the following configuration, on my first PIX 501, I am unable to provide a server of mail to the outside world and allows inside customers to browse the Internet. :

  6.3 (5) PIX version

  interface ethernet0 car

  interface ethernet1 100full

  ethernet0 nameif outside security0

  nameif ethernet1 inside the security100

  enable password xxxx

  passwd xxx

  hostname fw-sam-01

  SAM domain name

  fixup protocol dns-length maximum 512

  fixup protocol ftp 21

  fixup protocol h323 h225 1720

  fixup protocol h323 ras 1718-1719

  fixup protocol http 80

  fixup protocol rsh 514

  fixup protocol rtsp 554

  fixup protocol sip 5060

  fixup protocol sip udp 5060

  fixup protocol 2000 skinny

  No fixup not protocol smtp 25

  fixup protocol sqlnet 1521

  fixup protocol tftp 69

  names of

  outside access list permit tcp any host 62.x.x.109 eq smtp

  access the inside to allow tcp a whole list

  pager lines 24

  Outside 1500 MTU

  Within 1500 MTU

  IP address outside the 62.177.x.x.x.255.248

  IP address inside 192.168.45.1 255.255.255.0

  alarm action IP verification of information

  alarm action attack IP audit

  location of PDM 192.168.45.2 255.255.255.255 inside

  PDM logging 100 information

  history of PDM activate

  ARP timeout 14400

  Global 1 interface (outside)

  NAT (inside) 1 0.0.0.0 0.0.0.0 0 0

  public static 62.177.x.x.x.45.2 (Interior, exterior) mask subnet 255.255.255.255 0 0

  outside access-group in external interface

  group-access to the Interior in the interface inside

  Route outside 0.0.0.0 0.x.x.x.177.208.105 1

  Timeout xlate 0:05:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225

  H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00

  Sip timeout - disconnect 0:02:00 prompt Protocol sip-0: 03:00

  Timeout, uauth 0:05:00 absolute

  GANYMEDE + Protocol Ganymede + AAA-server

  AAA-server GANYMEDE + 3 max-failed-attempts

  AAA-server GANYMEDE + deadtime 10

  RADIUS Protocol RADIUS AAA server

  AAA-server RADIUS 3 max-failed-attempts

  AAA-RADIUS deadtime 10 Server

  AAA-server local LOCAL Protocol

  Enable http server

  http 192.168.45.0 255.255.255.0 inside

  No snmp server location

  No snmp Server contact

  SNMP-Server Community public

  No trap to activate snmp Server

  enable floodguard

  Telnet 192.168.45.0 255.255.255.0 inside

  Telnet timeout 5

  SSH timeout 5

  Console timeout 0

  dhcpd lease 3600

  dhcpd ping_timeout 750

  : end

  It is I'am using access list and groups wrong or am I wrong in PAT/NAT configuration.

  Please advise...

  Hello

  I went through the ongoing discussion. The pix configuration should be fine for now according to suggestions. The problems seems to be on the server. If it is a new installation of windows, then there is an option not to accept requests that are not local network.

  If you want to check if pix allows connections and then when you telnet to port 25 of the outside, just run the xlates control.

  SH xlate and it should show you a translation for the inside host. More than a quick test if pix allows traffic is to check 'sho-outdoor access list' and see if the counters are increasing.

  Hopefully this should help you.

  Arun S.

• Help with vpn pix 501

  I'm setting up a cisco pix 501 vpn tunnel but will have questions. The Firewall works although I am able to get out of the internet, but the VPN does not work. On the primary side, I see that the tunnel is up and the traffic is sent but not received.

  Currently I'm sitting at the secondary location but don't know what the problem maybe. Anyone know what I have wrong which could prevent the data to send from this device?

  Here is my config

  Here's my config if it would help

  See the race
  : Saved
  :
  6.3 (5) PIX version
  interface ethernet0 car
  interface ethernet1 100full
  ethernet0 nameif outside security0
  nameif ethernet1 inside the security100
  activate 2KFQnbNIdI.2KYOU encrypted password
  2KFQnbNIdI.2KYOU encrypted passwd
  hostname ciscofirewall
  domain hillsanddales.com
  fixup protocol dns-length maximum 512
  fixup protocol ftp 21
  fixup protocol h323 h225 1720
  fixup protocol h323 ras 1718-1719
  fixup protocol http 80
  fixup protocol rsh 514
  fixup protocol rtsp 5
  fixup protocol rtsp 55
  fixup protocol rtsp 554
  fixup protocol sip 5060
  fixup protocol sip udp 5060
  fixup protocol 2000 skinny
  fixup protocol smtp 25

  fixup protocol sqlnet 1521
  fixup protocol tftp 69
  names of
  access-list 101 permit ip 192.168.80.0 255.255.255.0 192.168.50.0 255.255.255.0
  192.168.80.0 IP Access-list sheep 255.255.255.0 allow 192.168.50.0 255.255.255.0
  in_outside list access permit tcp any host 192.168.50.240
  in_outside list access permit tcp any host 64.90.xxx.xx
  pager lines 24
  Outside 1500 MTU
  Within 1500 MTU
  IP address outside 66.84.xxx.xx 255.255.255.252
  IP address inside 192.168.80.1 255.255.255.0
  alarm action IP verification of information
  alarm action attack IP audit
  location of PDM 192.168.50.0 255.255.255.0 outside
  location of PDM 192.168.80.2 255.255.255.255 inside
  location of PDM 192.168.50.0 255.255.255.0 inside
  location of PDM 182.168.80.0 255.255.255.255 inside
  location of PDM 0.0.0.0 255.255.255.0 inside
  location of PDM 0.0.0.0 255.255.255.255 inside
  location of PDM 192.168.80.5 255.255.255.255 inside
  location of PDM 192.168.80.7 255.255.255.255 inside
  PDM logging 100 information
  history of PDM activate

  ARP timeout 14400
  Global 1 interface (outside)
  NAT (inside) 1 0.0.0.0 0.0.0.0 0 0
  Route outside 0.0.0.0 0.0.0.0 66.84.xxx.x
  Route inside 192.168.50.0 255.255.255.0 192.168.50.240 1
  Timeout xlate 0:05:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225
  H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00
  Sip timeout - disconnect 0:02:00 prompt Protocol sip-0: 03:00
  Timeout, uauth 0:05:00 absolute
  GANYMEDE + Protocol Ganymede + AAA-server
  AAA-server GANYMEDE + 3 max-failed-attempts
  AAA-server GANYMEDE + deadtime 10
  RADIUS Protocol RADIUS AAA server
  AAA-server RADIUS 3 max-failed-attempts
  AAA-RADIUS deadtime 10 Server
  AAA-server local LOCAL Protocol
  Enable http server
  http 192.168.80.0 255.255.255.0 inside
  No snmp server location
  No snmp Server contact
  SNMP-Server Community public
  No trap to activate snmp Server
  enable floodguard
  <--- more="" ---="">

  Permitted connection ipsec sysopt
  Crypto ipsec transform-set esp-3des esp-md5-hmac aptset
  aptmap 10 ipsec-isakmp crypto map
  correspondence address card crypto aptmap 10 101
  card crypto aptmap 10 peers set 64.90.xxx.xx
  card crypto aptmap 10 transform-set aptset
  aptmap interface card crypto outside
  ISAKMP allows outside
  ISAKMP key * address 64.90.xxx.xx netmask 255.255.255.255
  ISAKMP identity address
  ISAKMP nat-traversal 20
  part of pre authentication ISAKMP policy 10
  ISAKMP policy 10 3des encryption
  ISAKMP policy 10 md5 hash
  10 2 ISAKMP policy group
  ISAKMP life duration strategy 10 86400
  Telnet 192.168.80.2 255.255.255.255 inside
  Telnet 182.168.80.0 255.255.255.255 inside
  Telnet 192.168.80.5 255.255.255.255 inside
  Telnet 192.168.80.0 255.255.255.0 inside
  Telnet 192.168.80.7 255.255.255.255 inside
  Telnet timeout 5
  SSH timeout 5
  management-access inside

  Console timeout 0
  dhcpd address 192.168.80.2 - 192.168.80.33 inside
  dhcpd dns 64.90.xxx.xx 64.90.xxx.xx
  dhcpd lease 3600
  dhcpd ping_timeout 750
  dhcpd outside auto_config
  dhcpd allow inside
  Terminal width 80
  Cryptochecksum:01532689fac9491fae8f86e91e2bd4c0
  : end

  Hello

  At least the NAT0 ACL is not in use

  You should have this added to the configuration

  NAT (inside) 0 access-list sheep

  -Jouni

• Help the PIX 501 - cannot access startup.html

  I'm new to the network and has received a job to configure the PIX 501 firewall.

  The fact is:

  We use IP table rules as a firewall on a linux machine. My pc is connected to a switch. So I use the yellow network cable to connect the port of the Pix 501 0 to the port in the switch. Then I disconnect my pc of swich cable and plug into the port of the Pix 501 1.

  My pc is to use a static ip address before. I try to change to automatically get an IP address, but it will not work. So I changed the setting and use the IP address originally. Pop up message network connection icon says that the local connection is enabled. But when I try to ping 192.168.1.1, request time-out. Also I can't acess the https://192.168.1.1/startup.html.

  I have a look at Books Online cisco and shootings of disorder, but most of them talk about the configuration or more advance features. I'm still on the very basic level to try to connect to the firewall.

  I hope someone can help me. All ideas and questions are welcome. Thank you.

  Your IP address should be fine. You do not want to have the PIX connected to your local network, even if you have the Linux firewall as well as this will cause a conflict. Keep the PIX the LAN for now. Your DNS configuration will have no effect because the url you are trying to reach is based on the IP address and not the domain name if your PC has nothing to look for.

  You have to check the cable that you use - if your PIX has only an 'inside' interface, then you must use a crossover cable. If he has four so it's built in switch for a straight cable will be fine. Is what PIX model?

  After checking the cable - see if you can console in the firewall - use the blue cable that came with the PIX and set up a connection (hyper terminal) terminal with the help of 9600, 8, no 1. If you can console and then you can stick in a basic configuration you can get.

• PIX - static NAT problems

  I'm doing a static route to xxx.242.139.164 to 192.168.1.13 and open ports 25 and 443. I am at a loss for what I missed to make this happen. I would also like to open the ICMP traffic or at the least response to echo so I can test the IP addresses and that doesn't seem to work either.

  PIX config attached .txt file.

  Thanks for any help!

  Hi Comoms,

  This is your problem:

  (1) here say you do not NAT traffic.

  NAT (inside) 0-list of access inside_outbound_nat0_acl

  inside_outbound_nat0_acl ip access list allow any xxx.242.139.160 255.255.255.224

  (2) then you use it for the static NAT.

  public static xxx.242.139.164 (Interior, exterior) 192.168.1.13 dns netmask 255.255.255.255 0 0

  (3) it's totally fake, first u say don't not NAT traffic, try you NAT, it. How will it work?

  (4) even if uou help with ACL, it won't work.

  (5) Please check your routes n NAT ACL, NAT STATIC, once again.

  HTH

  MAR

• PIX 501, 1 static IP, IP address dynamic 2. Mesh full possible?

  I have 3 sites. All sites have PIX 501. Central site has a static IP, 2 remote sites a dynamic IP.

  I have no problem with the connection to the central site by using their dynamic IP address in a remote star connection.

  Is it possible for 2 remote sites communicate? There is data that must be transferred between remote sites. I read somewhere in cisco site web which its possible via mesh on request.

  Does anyone have an example of configuration on a VPN Site to Site where the Central site has static IP and remote sites with a dynamic IP? Remote locations teaches a dynamic IP from remote sites to the central server.

  Thank you.

  With IOS as your hub and then the Yes rays, the rays can learn dynamically address other departments using the PNDH. This type of configuration is called Dynamic Multipoint VPN (DMVPN), you can read everything you need to know about this here:

  http://www.Cisco.com/warp/public/105/DMVPN.html

  Even with EzVPN (not DMVPN) the rays will not learn the address of other rays, all communication is always via the hub. Call another talks would work, but as I said, the packages will talk-star.

• PIX 501 DNS resolution with static route

  I use a pix 501.

  I have an internal DNS server behind the pix that uses my DNS of the ISP servers to resolve external domains.

  Now, I want to host a web site on the same server.

  To allow external access to the web server, I add the following:

  outside_in_http list access permit tcp any host A.B.C.D eq www

  static (inside, outside) A.B.C.D L.M.N.O netmask 255.255.255.255 0 0

  Access-group outside_in_http in interface outside

  It is very good and allows web access. The problem is that the server is able to resolve DNS queries.

  How can I allow my server to resolve DNS again securely. I guess it's pretty simple to do, but I'm having a lot of trouble to find the solution.

  Thanks in advance

  Dylan

  On your IP set dns to 67.38.230.69, then ping www.yahoo.com server from guest... what resovle?

• PIX + Rotary static NAT to load balance?

  You can load balance of static behind a PIX with nat servers as you can do it on a router cisco (rotating)?

  * If Yes, someone at - it had a link to an example?

  Hakuna Mete.

  Hello Hakuna,

  Unfortunately, this is not possible on the PIX. Sorry!

  Renault

• PAT on IPSEC VPN (Pix 501)

  Hello

  I work to connect a PIX 501 VPN for a 3rd party hub 3015. The hub requires all traffic to come from a single source IP address. This IP address is assigned to me as z.z.z.z. I have successfully built the VPN and tested by mapping staticly internal IP with the IP address assigned, but cannot get the orders right to do with PAT in order to have more than one computer on the subnet 10.x.x.0. This Pix is also a backup for internet routing and NAT work currently as well for this.

  I can redirect traffic to my subnet to the remote subnet via the VPN, but I can't seem to get the right stuff PAT to the VPN using the assigned IP address. If anyone can give me some advice that would be great.

  lines of current config interesting configuration with static mapping:

  --------------------------------------------------------------------------

  access-list 101 permit ip 10.0.0.0 255.255.255.0 y.y.y.0 255.255.255.0

  access-list 102 permit ip y.y.y.0 255.255.255.0 z.z.z.z host

  access-list 103 allow host ip y.y.y.0 255.255.255.0 z.z.z.z

  IP address outside w.w.w.1 255.255.255.248

  IP address inside 10.0.0.1 255.255.255.0

  Global 1 interface (outside)

  NAT (inside) - 0 102 access list

  NAT (inside) 1 0.0.0.0 0.0.0.0 0 0

  public static z.z.z.z (Interior, exterior) 10.x.x.50 netmask 255.255.255.255 0 0

  Route outside 0.0.0.0 0.0.0.0 w.w.w.2 1

  correspondence address card crypto mymap 10 103

  mymap outside crypto map interface

  ISAKMP allows outside

  Thank you!

  Dave

  Dave,

  (1) get rid of static electricity. Use more Global/NAT. The static method will create a permanent

  translation for your guests inside and they will always be this way natted. Use

  NAT of politics, on the contrary, as shown here:

  not static (inside, outside) z.z.z.z 10.x.x.50 netmask 255.255.255.255 0 0

  Global (outside) 2 z.z.z.z netmask 255.255.255.255

  (Inside) NAT 2-list of access 101

  (2) the statement, "nat (inside) access 0 2' list will prevent nat of your valuable traffic."

  Delete this because you need to nat 2 nat/global card. (as a general rule, simply you

  If you terminate VPN clients on your device and do not want inside the traffic which

  is intended for the vpn clients to be natted on the external interface).

  (3) with the instructions of Global/nat 2, all traffic destined for the remote network will be first

  translated into z.z.z.z. Then your card crypto using the ACL 103 will encrypt all traffic which

  sources of z.z.z.z for y.y.y.0 24. This translation wil happen only when traffic is destined for the vpn.

  I hope this helps. I have this work on many tunnels as you describe.

  Jamison

• VPN PPTP and PPPOE CLIENT ON PIX 501

  Hello

  Can I create a PPTP VPN and a client connection on a PIX 501 with a client to my ISP PPPOE connection. The PPPOE ip is dynamic and the VPN will be a static IP address. They gave me a username and password for VPN and PPPOE. Him also gave me an ip address for the VPN server.

  Should that happen, it's that the PPPOE should connect to the VPN to work.

  I can only get the PPPOE, but I don't know how to do this with a PPTP VPN set.

  Here is my config:
  
  PIX Version 6.3(3)
  
      interface ethernet0 auto
  
      interface ethernet1 100full
  
      nameif ethernet0 outside security0
  
      nameif ethernet1 inside security100
  
      enable password xxxxxxxx encrypted
  
      passwd xxxxxxx encrypted
  
      hostname neveroff
  
      domain-name neveroff.com
  
      fixup protocol dns maximum-length 512
  
      fixup protocol ftp 21
  
      fixup protocol h323 h225 1720
  
      fixup protocol h323 ras 1718-1719
  
      fixup protocol http 80
  
      fixup protocol rsh 514
  
      fixup protocol rtsp 554
  
      fixup protocol sip 5060
  
      fixup protocol sip udp 5060
  
      fixup protocol skinny 2000
  
      fixup protocol smtp 25
  
      fixup protocol sqlnet 1521
  
      fixup protocol tftp 69
  
      names
  
      access-list incoming permit icmp any any echo-reply
  
      access-list incoming permit icmp any any source-quench
  
      access-list incoming permit icmp any any unreachable
  
      access-list incoming permit icmp any any time-exceeded
  
      pager lines 24
  
      icmp permit any echo outside
  
      icmp permit any unreachable outside
  
      icmp permit any time-exceeded outside
  
      icmp permit any source-quench outside
  
      icmp permit any echo-reply outside
  
      icmp permit any information-reply outside
  
      icmp permit any mask-reply outside
  
      icmp permit any timestamp-reply outside
  
      mtu outside 1500
  
      mtu inside 1500
  
      ip address outside pppoe setroute
  
      ip address inside 192.168.1.1 255.255.255.0
  
      ip audit info action alarm
  
      ip audit attack action alarm
  
      pdm logging informational 100
  
      pdm history enable
  
      arp timeout 14400
  
      global (outside) 1 interface
  
      nat (inside) 1 192.168.1.0 255.255.255.0 0 0
  
      static (inside,outside) tcp interface smtp 192.168.1.201 smtp netmask 255.255.255.255 0 0
  
      access-group incoming in interface outside
  
      timeout xlate 0:05:00
  
      timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
  
      timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
  
      timeout uauth 0:05:00 absolute
  
      aaa-server TACACS+ protocol tacacs+
  
      aaa-server RADIUS protocol radius
  
      aaa-server LOCAL protocol local
  
      http server enable
  
      no snmp-server location
  
      no snmp-server contact
  
      snmp-server community public
  
      no snmp-server enable traps
  
      floodguard enable
  
      telnet timeout 5
  
      ssh 0.0.0.0 0.0.0.0 outside
  
      ssh 0.0.0.0 0.0.0.0 inside
  
      ssh timeout 5
  
      console timeout 0
  
      vpdn group pppoex request dialout pppoe
  
      vpdn group pppoex localname xxxxxxxxx
  
      vpdn group pppoex ppp authentication chap
  
      vpdn username xxxxxxxx password xxxxxxxx
  
      dhcpd address 192.168.1.10-192.168.1.41 inside
  
      dhcpd dns 192.168.1.1 168.210.2.2
  
      dhcpd lease 3600
  
      dhcpd ping_timeout 750
  
      dhcpd auto_config outside
  
      dhcpd enable inside
  
      username neveroff password TEnlGTQMwqamBzMn encrypted privilege 2
  
      terminal width 80
  
      Cryptochecksum:c5bfafa70f21ed55cc1b3df377e110bf
  
      : end
  
      

  Thank you

  Etienne

  Happy to help and please kindly mark the message as answered if you have not more than other questions. Thank you.

• Pix 501 problem, I can not receive smtp messages

  Currently, I can send messages but cannot receive the mail from the Internet, if I remove the Pix and connect directly to the Modem/router then I can SMTP on port 25 and SMTP mail works fine both in & out.

  All what we want this Pix to allow at present is:

  (a) access to Internet to all clients on the network internal

  (b) allow the customers to pop mail web e-mail accounts

  (c) we want to use Exchange & Outlook and accommodate our own email via the SMTP Protocol

  Please find attached two documents: -.

  1. a current edited config of my Pix 501 running

  2. a PowerPoint of my network diagram.

  I appreciate a lot of help.

  Vinny.

  I finally found the problem.

  On the ADSL router, you have configured the same 192.168.0.0/24 network you use behind the post office

  Server. This configuration will not work because it leads to a duplicate IP address range and you have routing

  problems.

  Change the configuration to another range of IP between the ADSL router and PIX firewall and everthing will be

  work.

  Note the address unique public IP that is configured, received is on the router Netgear ADSL uses all other interfaces

  public IP addresses.

  Recovery of the networks and the IPs:

  80.x.y.z/255.255.255.x = Netgear outside intellectual property

  192.168.2.0/255.255.255.0 = network between the internal Netgear and the PIX outside interface

  192.168.1.0/255.255.255.0 = network between the PIX inside and the external interface of the mail server

  192.168.0.0/255.255.255.0 = network between the internal interface of mail server and mail clients.

  Use 192.168.2.0 255.255.255.0 for this network, and then set it 192.168.2.1 for your ADSL router inside

  interface, use a static IP 192.168.2.2 255.255.255.0 on the PIX firewall outside interface.

  ADSL installation:

  You can choose on the Netgear between all public traffic of the 80.x.y.z IP to 192.168.2.2 transmission which is NAT or

  You can transfer to forward the http, pop3 and smtp, didn't really matter, it's just important that you NAT or PAT it

  for the PIX firewall.

  PIX installation example:

  All traffic received on the PIX outside interface for http, pop3 and smtp is then transmitted by 192.168.2.2 to mail

  the server 192.168.1.2 external IP address.

  outdoor IP 192.168.2.2 address 255.255.255.0

  IP address inside 192.168.1.1 255.255.255.0

  acl_out list access permit tcp any host 192.168.2.2 eq http

  acl_out list access permit tcp any host 192.168.2.2 pop eq

  acl_out list access permit tcp any host 192.168.2.2 eq smtp

  Access-group acl_out in interface outside

  static (inside, outside) tcp 192.168.2.2 80 192.168.1.2 80 netmask 255.255.255.255 0 0

  static (inside, outside) tcp 192.168.2.2 110 192.168.1.2 110 netmask 255.255.255.255 0 0

  static (inside, outside) tcp 192.168.2.2 25 192.168.1.2 25 netmask 255.255.255.255 0 0

  Global 1 interface (outside)

  NAT (inside) 1 0.0.0.0 0.0.0.0

  Route outside 0.0.0.0 0.0.0.0 192.168.2.1

  Installation of mail server:

  The mail server has a default route to the PIX firewall.

  Default gateway on the mail server = 192.168.1.1

  Do you have NAt or PAT on the mail server internal clients to the Internet in the direction of the PIX? If not, you need to add another road on the PIX, so know the PIX the 192.168.0.0/24 network is behind the e-mail server, as this unit is the routing for this network.

  Add a route on the PIX inside interface:

  Route inside 192.168.0.0 255.255.255.0 192.168.1.2

  E-mail clients:

  All mail clients have the internal IP address of mail as default gateway server.

  Default gateway = 192.168.0.3

  This configuration will work 100%

  Sorry if I you confused.

  sincerely

  Patrick

• IPSec VPN pix 501 no LAN access

  I'm trying to set up an IPSec VPN in a basic small business scenario. I am able to connect to my pix 501 via IPSec VPN and browse the internet, but I am unable to ping or you connect to all devices in the Remote LAN. Here is my config:

  : Saved

  :

  6.3 (3) version PIX

  interface ethernet0 car

  interface ethernet1 100full

  nameif ethernet0 WAN security0

  nameif ethernet1 LAN security99

  enable encrypted password xxxxxxxxxxxxx

  xxxxxxxxxxxxxxxxx encrypted passwd

  host name snowball

  domain xxxxxxxxxxxx.local

  clock timezone PST - 8

  fixup protocol dns-length maximum 512

  fixup protocol ftp 21

  fixup protocol h323 h225 1720

  fixup protocol h323 ras 1718-1719

  fixup protocol http 80

  fixup protocol pptp 1723

  fixup protocol rsh 514

  fixup protocol rtsp 554

  fixup protocol sip 5060

  fixup protocol sip udp 5060

  fixup protocol 2000 skinny

  No fixup not protocol smtp 25

  fixup protocol sqlnet 1521

  fixup protocol tftp 69

  names of

  acl_in list of access permit udp any any eq field

  acl_in list of access permit udp any eq field all

  acl_in list access permit tcp any any eq field

  acl_in tcp allowed access list any domain eq everything

  acl_in list access permit icmp any any echo response

  access-list acl_in allow icmp all once exceed

  acl_in list all permitted access all unreachable icmp

  acl_in list access permit tcp any any eq ssh

  acl_in list access permit tcp any any eq www

  acl_in tcp allowed access list everything all https eq

  acl_in list access permit tcp any host 192.168.5.30 eq 81

  acl_in list access permit tcp any host 192.168.5.30 eq 8081

  acl_in list access permit tcp any host 192.168.5.22 eq 8081

  acl_in list access permit icmp any any echo

  access-list acl_in permit tcp host 76.248.x.x a

  access-list acl_in permit tcp host 76.248.x.x a

  allow udp host 76.248.x.x one Access-list acl_in

  access-list acl_out permit icmp any one

  ip access list acl_out permit a whole

  acl_out list access permit icmp any any echo response

  acl_out list access permit icmp any any source-quench

  allowed any access list acl_out all unreachable icmp

  access-list acl_out permit icmp any once exceed

  acl_out list access permit icmp any any echo

  Allow Access-list no. - nat icmp a whole

  access-list no. - nat ip 192.168.5.0 allow 255.255.255.0 172.16.0.0 255.255.0.0

  access-list no. - nat ip 172.16.0.0 allow 255.255.0.0 any

  access-list no. - nat permit icmp any any echo response

  access-list no. - nat permit icmp any any source-quench

  access-list no. - nat icmp permitted all all inaccessible

  access-list no. - nat allow icmp all once exceed

  access-list no. - nat permit icmp any any echo

  pager lines 24

  MTU 1500 WAN

  MTU 1500 LAN

  IP address WAN 65.74.x.x 255.255.255.240

  address 192.168.5.1 LAN IP 255.255.255.0

  alarm action IP verification of information

  alarm action attack IP audit

  IP local pool pptppool 172.16.0.2 - 172.16.0.13

  PDM logging 100 information

  history of PDM activate

  ARP timeout 14400

  Global (WAN) 1 interface

  NAT (LAN) - access list 0 no - nat

  NAT (LAN) 1 0.0.0.0 0.0.0.0 0 0

  static (LAN, WAN) 65.x.x.37 192.168.5.10 netmask 255.255.255.255 0 0

  static (LAN, WAN) 65.x.x.36 192.168.5.20 netmask 255.255.255.255 0 0

  static (LAN, WAN) 65.x.x.38 192.168.5.30 netmask 255.255.255.255 0 0

  static (LAN, WAN) 65.x.x.39 192.168.5.40 netmask 255.255.255.255 0 0

  static (LAN, WAN) 65.x.x.42 192.168.5.22 netmask 255.255.255.255 0 0

  static (LAN, WAN) 65.x.x.43 192.168.5.45 netmask 255.255.255.255 0 0

  static (LAN, WAN) 65.x.x.44 192.168.5.41 netmask 255.255.255.255 0 0

  static (LAN, WAN) 65.x.x.45 192.168.5.42 netmask 255.255.255.255 0 0

  static (LAN, WAN) 65.x.x.46 192.168.5.44 netmask 255.255.255.255 0 0

  static (LAN, WAN) 65.x.x.41 192.168.5.21 netmask 255.255.255.255 0 0

  acl_in access to the WAN interface group

  access to the LAN interface group acl_out

  Route WAN 0.0.0.0 0.0.0.0 65.x.x.34 1

  Timeout xlate 0:05:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225

  H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00

  Timeout, uauth 0:05:00 absolute

  GANYMEDE + Protocol Ganymede + AAA-server

  RADIUS Protocol RADIUS AAA server

  AAA-server local LOCAL Protocol

  NTP server 72.14.188.195 source WAN

  survey of 76.248.x.x WAN host SNMP Server

  location of Server SNMP Sacramento

  SNMP Server contact [email protected] / * /

  SNMP-Server Community xxxxxxxxxxxxx

  SNMP-Server enable traps

  enable floodguard

  the string 1 WAN fragment

  Permitted connection ipsec sysopt

  Sysopt connection permit-pptp

  Crypto ipsec transform-set esp - esp-md5-hmac RIGHT

  Crypto-map dynamic dynmap 10 transform-set RIGHT

  map mymap 10-isakmp ipsec crypto dynamic dynmap

  client configuration address map mymap crypto initiate

  client configuration address map mymap crypto answer

  card crypto mymap WAN interface

  ISAKMP enable WAN

  ISAKMP nat-traversal 20

  part of pre authentication ISAKMP policy 10

  encryption of ISAKMP policy 10

  ISAKMP policy 10 md5 hash

  10 2 ISAKMP policy group

  ISAKMP life duration strategy 10 86400

  vpngroup myvpn address pptppool pool

  vpngroup myvpn Server dns 192.168.5.44

  vpngroup myvpn by default-field xxxxxxxxx.local

  vpngroup split myvpn No. - nat tunnel

  vpngroup idle 1800 myvpn-time

  vpngroup myvpn password *.

  Telnet 192.168.5.0 255.255.255.0 LAN

  Telnet timeout 5

  SSH 192.168.5.0 255.255.255.0 LAN

  SSH timeout 30

  Console timeout 0

  VPDN group pptpusers accept dialin pptp

  VPDN group ppp authentication pap pptpusers

  VPDN group ppp authentication chap pptpusers

  VPDN group ppp mschap authentication pptpusers

  VPDN group ppp encryption mppe 128 pptpusers

  VPDN group pptpusers client configuration address local pptppool

  VPDN group pptpusers customer 192.168.5.44 dns configuration

  VPDN group pptpusers pptp echo 60

  VPDN group customer pptpusers of local authentication

  VPDN username password xxx *.

  VPDN username password xxx *.

  VPDN enable WAN

  dhcpd address 192.168.5.200 - 192.168.5.220 LAN

  dhcpd 192.168.5.44 dns 8.8.8.8

  dhcpd lease 3600

  dhcpd ping_timeout 750

  dhcpd enable LAN

  username privilege 0 encrypted password xxxxxxxxxx xxxxxxxxxxx

  username privilege 0 encrypted password xxxxxxxxxx xxxxxxxxxxx

  Terminal width 80

  Cryptochecksum:xxxxxxxxxxxxxxxxxx

  : end

  I'm sure it has something to do with NAT or an access list, but I can't understand it at all. I know it's a basic question, but I would really appreaciate help!
  Thank you very much
  Trevor

  "No. - nat' ACL doesn't seem correct, please make sure you want to remove the following text:

  do not allow any No. - nat icmp access list a whole

  No No. - nat ip 172.16.0.0 access list allow 255.255.0.0 any

  No No. - nat access list permit icmp any any echo response

  No No. - nat access list permit icmp any any source-quench

  No No. - nat access list permit all all unreachable icmp

  No No. - nat access list do not allow icmp all once exceed

  No No. - nat access list only allowed icmp no echo

  You must have 1 line as follows:

  access-list no. - nat ip 192.168.5.0 allow 255.255.255.0 172.16.0.0 255.255.0.0

  Please 'clear xlate' after the changes described above.

  In addition, if you have a personal firewall enabled on the host you are trying to connect from the Client VPN, please turn it off and try again. Personal firewall of Windows normally blocks the traffic of different subnets.

  Hope that helps.

• Connectivity random Cisco Pix 501

  Hello. I'm having some trouble with my CISCO PIX 501 Setup.

  A few months I started having random disconnects on my network (from inside to outside). The machines can ping the DC or the Pix, but impossible to surf the internet. The only way to make them go outside is a reboot of Pix.

  My configuration is:

  -----------

  See the ACE - pix config (config) #.
  : Saved
  : Written by enable_15 at 09:23:07.033 UTC Tuesday, June 3, 2014
  6.3 (3) version PIX
  interface ethernet0 car
  interface ethernet1 100full
  ethernet0 nameif outside security0
  nameif ethernet1 inside the security100
  activate 8Ry34retyt7RR564 encrypted password
  2fvbbfgdI.2KUOU encrypted passwd
  hostname as pix
  domain as.local
  fixup protocol dns-length maximum 512
  fixup protocol esp-ike
  fixup protocol ftp 21
  fixup protocol h323 h225 1720
  fixup protocol h323 ras 1718-1719
  fixup protocol http 80
  fixup protocol pptp 1723
  fixup protocol rsh 514
  fixup protocol rtsp 554
  fixup protocol sip 5060
  fixup protocol sip udp 5060
  fixup protocol 2000 skinny
  fixup protocol smtp 25
  fixup protocol sqlnet 1521
  fixup protocol tftp 69
  names of
  access-list acl_out permit icmp any one
  ip access list acl_out permit a whole
  access-list acl_out permit tcp any one
  Allow Access-list outside_access_in esp a whole
  outside_access_in list access permit udp any eq isakmp everything
  outside_access_in list of access permit udp any eq 1701 all
  outside_access_in list of access permit udp any eq 4500 all
  outside_access_in ip access list allow a whole
  pager lines 24
  Outside 1500 MTU
  Within 1500 MTU
  outside 10.10.10.2 IP address 255.255.255.0
  IP address inside 192.168.100.1 255.255.255.0
  alarm action IP verification of information
  alarm action attack IP audit
  history of PDM activate
  ARP timeout 14400
  Global 1 10.10.10.8 - 10.10.10.254 (outside)
  NAT (inside) 1 0.0.0.0 0.0.0.0 0 0
  Access-group outside_access_in in interface outside
  access to the interface inside group acl_out
  Route outside 0.0.0.0 0.0.0.0 10.10.10.1 0
  Timeout xlate 03:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225
  H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00
  Timeout, uauth 0:05:00 absolute
  GANYMEDE + Protocol Ganymede + AAA-server
  RADIUS Protocol RADIUS AAA server
  AAA-server local LOCAL Protocol
  Enable http server
  http 192.168.10.2 255.255.255.255 inside
  http 192.168.10.101 255.255.255.255 inside
  http 192.168.100.2 255.255.255.255 inside
  No snmp server location
  No snmp Server contact
  SNMP-Server Community public
  No trap to activate snmp Server
  enable floodguard
  Permitted connection ipsec sysopt
  ISAKMP nat-traversal 20
  Telnet timeout 5
  SSH 192.168.10.101 255.255.255.255 inside
  SSH timeout 60
  Console timeout 0
  dhcpd dns 8.8.8.8 8.8.4.4
  dhcpd lease 3600
  dhcpd ping_timeout 750
  dhcpd outside auto_config
  Terminal width 80
  Cryptochecksum:7f9bda5e534eaeb1328ab08a3c4d28a
  ------------

  Do you have any advice? I don't get what's wrong with my setup.

  My DC is 192.168.100.2 and the network mask is 255.255.255.0

  The network configuration is configured to set the IP of the gateway to 192.168.100.1 (i.e. the PIX 501).

  I have about 50 + peers on the internal network.

  Any help is apprecciate.

  Hello

  You have a license for 50 users +?

  After the release of - Show version

  RES

  Paul

• Unable to connect to PDM on PIX 501

  just cannot understand this. I have a PIX 501 I used to connect very well. Now I can't get the PDM to come up inside, outside, nothing.  I use the same (old) of JAVA 1.4 version I always used. I can Telnet etc... Very well. The HTTP server is enabled and have granted access from my IP address. Any help would be greatly appreciated. See my config below.

  See the pixfirewall # running
  : Saved
  :
  6.3 (5) PIX version
  interface ethernet0 car
  interface ethernet1 100full
  ethernet0 nameif outside security0
  nameif ethernet1 inside the security100
  activate 8Ry2YjIyt7RRXU24 encrypted password
  passwd encrypted XXXXXXXX
  pixfirewall hostname
  domain ciscopix.com
  clock timezone IS - 5
  clock to summer time EDT recurring
  fixup protocol dns-length maximum 512
  fixup protocol ftp 21
  fixup protocol h323 h225 X 0
  fixup protocol h323 ras X 18 - X 19
  fixup protocol http 80
  fixup protocol rsh 514
  fixup protocol rtsp 554
  fixup protocol sip 5060
  fixup protocol sip udp 5060
  fixup protocol 2000 skinny
  fixup protocol smtp 25
  fixup protocol sqlnet 1521
  fixup protocol tftp 69
  names of
  name admin_subnet X.X.X.X
  inside_outbound_nat0_acl X.X.X.X 255.255.255.0 ip access list allow admin_
  subnet 255.255.0.0
  inside_outbound_nat0_acl X.X.X.X 255.255.255.0 ip access list allow X.X
  . X.X 255.255.255.0
  outside_cryptomap_20 X.X.X.X 255.255.255.0 ip access list permit admin_subn
  and 255.255.0.0
  outside_cryptomap_20 X.X.X.X 255.255.255.0 ip access list allow X.X.X
  . X 255.255.255.0
  pager lines 24
  Outside 1500 MTU
  Within 1500 MTU
  IP outside X.X.X.X 255.255.255.128
  inside X.X.X.X 255.255.255.0 IP address
  alarm action IP verification of information
  alarm action attack IP audit
  PDM location admin_subnet 255.255.0.0 outside
  location of PDM X.X.X.X 255.255.255.0 inside
  PDM location x.x.x.x 255.255.255.255 outside
  location of PDM X.X.X.X 255.255.255.0 outside
  location of PDM X.X.X.X 255.255.255.255 outside
  PDM logging 100 information
  history of PDM activate
  ARP timeout 14400
  Global 1 interface (outside)
  NAT (inside) 0-list of access inside_outbound_nat0_acl
  NAT (inside) 1 0.0.0.0 0.0.0.0 0 0
  Route outside 0.0.0.0 0.0.0.0 X.X.X.X 1
  Timeout xlate 0:05:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225
  H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00
  Sip timeout - disconnect 0:02:00 prompt Protocol sip-0: 03:00
  Timeout, uauth 0:05:00 absolute
  GANYMEDE + Protocol Ganymede + AAA-server
  AAA-server GANYMEDE + 3 max-failed-attempts
  AAA-server GANYMEDE + deadtime 10
  RADIUS Protocol RADIUS AAA server
  AAA-server RADIUS 3 max-failed-attempts
  AAA-RADIUS deadtime 10 Server
  AAA-server local LOCAL Protocol
  AAA authentication enable LOCAL console
  AAA authentication http LOCAL console
  LOCAL AAA authentication serial console
  the ssh LOCAL console AAA authentication
  AAA authentication LOCAL telnet console
  Enable http server
  http X.X.X.X 255.255.255.0 inside
  http admin_subnet 255.255.0.0 inside
  No snmp server location
  No snmp Server contact
  SNMP-Server Community public
  No trap to activate snmp Server
  enable floodguard
  Permitted connection ipsec sysopt
  Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac
  outside_map 20 ipsec-isakmp crypto map
  card crypto outside_map 20 match address outside_cryptomap_20
  card crypto outside_map pfs set 20 group2
  card crypto outside_map 20 game peers X.X.X.X
  outside_map crypto 20 card value transform-set ESP-AES-256-SHA
  outside_map interface card crypto outside
  ISAKMP allows outside
  ISAKMP key * address X.X.X.X 255.255.255.255 netmask No.-xauth non - co
  Nfig-mode
  part of pre authentication ISAKMP policy 20
  ISAKMP policy 20 aes-256 encryption
  ISAKMP policy 20 chopping sha
  20 2 ISAKMP policy group
  ISAKMP duration strategy of life 20 8 X 00
  Telnet X.X.X.X 255.255.255.0 outside
  Telnet X.X.X.X 255.255.255.0 inside
  Telnet admin_subnet 255.255.0.0 inside
  Telnet timeout 30
  ssh X.X.X.X 255.255.255.255 outside
  X.X.X.X 255.255.255.0 inside SSH
  SSH timeout 30
  management-access inside
  Console timeout 30
  dhcpd dns 8.8.8.8 8.8.4.4
  dhcpd lease 3600
  dhcpd ping_timeout 750
  username password XXXXXX XXXXXXXXXXX encrypted privilege 15
  Terminal width 80
  Cryptochecksum:
  : end

  Hello Mark,

  lol Nice to know that everything works fine now

  Don't forget to mark it as answered and to classify the useful messages (if you don't know how to evaluate a message just to get to the bottom of each answer and mark 1 being a wrong answer, being a great answer 5 stars)

  Kind regards

  Julio

  PD: Some kudos for you (because of the answer)