506e and MS VPN

[LonC25]

I know this has been asked before, but I can't seem to locate a solution to my problem. I am a newbie at configuring Cisco equipment, and we paid to have a PIX installed and configured.

I am trying to get the MS VPN using Windows 2000 server to go through our PIX 506e. I had it working at one point but now I can't get in.

192.168.1.10 is our mail server
192.168.1.14 is the RRAS server
192.168.1.123 is my machine setup w/ PC Anywhere access

Here is our config...

fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
pager lines 24
interface ethernet0 auto
interface ethernet1 auto
mtu outside 1500
mtu inside 1500
ip address outside xxx.xxx.74.131 255.255.255.0
ip address inside 192.168.1.16 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location 192.168.1.10 255.255.255.255 inside
pdm location 192.168.1.123 255.255.255.255 inside
pdm location 208.137.74.131 255.255.255.255 outside
pdm location 63.183.176.0 255.255.255.0 outside
pdm location 192.168.1.14 255.255.255.255 inside
pdm history enable
arp timeout 14400
global (outside) 1 xxx.xxx.74.135-xxx.xxx.74.158 netmask 255.255.255.0
global (outside) 1 xxx.xxx.74.134
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) xxx.xxx.74.133 192.168.1.10 netmask 255.255.255.255 0 0
static (inside,outside) xxx.xxx.74.132 192.168.1.14 netmask 255.255.255.255 0 0
static (inside,outside) interface 192.168.1.123 netmask 255.255.255.255 0 0
conduit permit icmp any any
conduit permit tcp host xxx.xxx.74.133 eq pop3 any
conduit permit tcp host xxx.xxx.74.133 eq smtp any
conduit permit tcp host xxx.xxx.74.133 eq 143 any
conduit permit tcp host xxx.xxx.74.133 eq

http://www any

conduit permit tcp host xxx.xxx.74.133 eq 443 any
conduit permit tcp host xxx.xxx.74.133 eq 563 any
conduit permit tcp host xxx.xxx.74.132 eq 1723 any
conduit permit gre host xxx.xxx.74.132 any
conduit permit tcp host xxx.xxx.74.131 eq 5631 any
conduit permit tcp host xxx.xxx.74.131 eq 5632 any
route outside 0.0.0.0 0.0.0.0 xxx.xxx.74.129 1

 

[br0ck]

why don't you use the PIX VPN function insted of the W2k? Brock D. Mowry
Hardware Specialist

http://www.iNECTA.com

 

[yizhar]

HI.

I agree with br0ck - you should consider using Cisco VPN as an alternative that can give you higher level of security with dual authentication.

Your configuration seems fine for VPN pass through.
You should do some tests:

* Reboot or clear ARP cache at the perimeter router. It might have a dirty cache entry for xxx.xxx.74.132
* Check RRAS configuration, and the User properties in AD Users and Computers.
* Can the RRAS server access the Internet?
* Did you get any error message at the client?
What was the exact error?
At what stage (connection, authentication, etc)?
* What about the Event viewer at the server?
* At the pix, you should setup logging at level 4, and see if you get any relevant messages. If not, then the pix isn't blocking the traffic.
* At the client, try to ping the pix outside interface.
* At the client, try to ping the pix xxx.xxx.74.132
* What is the connection type at the client? ADSL?
* Try with a dial-up modem connection.
* Try to VPN from a workstation which is directly connected to the pix outside interface.
* What is the OS at the client?
Try another client with different OS.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[yizhar]

BTW

It is better to convert your configuration to access-list because the conduit command is obsolute and should not be used on new implementations.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar