can ssh but not telnet through VPN connection?

[jrjuiliano]

Hi all,

I've set up my vpn connection on a 506e PIX for simple remote access. Right now the only issues I have are the inability to use telnet from the remote user to the network behind the PIX. I can use SSH (port 22) just fine but not telnet. We need telnet in order to use our IBM Client Access terminal software to connect to an iSeries within the network.

Anyone have any suggestions? I've attached (most) of my config below. If you find anything else, by the way, that might help make the connections cleaner/faster/safer please feel free to chime in as well!

Thanks.

: Saved
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
access-list inside_access_in permit tcp any any eq [URL unfurl="true"]www log[/URL] 
access-list inside_access_in permit tcp any any eq https log 
access-list inside_access_in permit tcp any any eq pop3 log 
access-list inside_access_in permit tcp any any eq smtp log 
access-list inside_access_in permit tcp object-group FTP_ACCESS any eq ftp log 

access-list outside_cryptomap_dyn_20 permit ip any 192.168.1.0 255.255.255.0 
access-list inside_outbound_nonat permit ip any 192.168.1.0 255.255.255.0 
access-list SplitTunnelACL permit ip 10.10.0.0 255.255.0.0 192.168.1.0 255.255.255.0 
pager lines 24
logging on
logging timestamp
logging trap informational
logging device-id hostname
logging host inside NTSERVER
mtu outside 1500
mtu inside 1500
ip address outside x.x.x.x 255.255.255.x
ip address inside 10.10.1.1 255.255.0.0
ip audit info action alarm
ip audit attack action alarm
ip local pool VPNPOOL 192.168.1.1-192.168.1.254 mask 255.255.255.0

arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_outbound_nonat
nat (inside) 1 10.10.0.0 255.255.0.0 0 0
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 x.x.x.x 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+ 
aaa-server TACACS+ max-failed-attempts 3 
aaa-server TACACS+ deadtime 10 
aaa-server RADIUS protocol radius 
aaa-server RADIUS max-failed-attempts 3 
aaa-server RADIUS deadtime 10 
aaa-server LOCAL protocol local 
aaa-server NTSERVER protocol radius 
aaa-server NTSERVER max-failed-attempts 3 
aaa-server NTSERVER deadtime 10 
aaa-server NTSERVER (inside) host NTSERVER <sharedpass> timeout 5
aaa authentication ssh console LOCAL
http server enable
http 10.10.0.0 255.255.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set MYTRANS esp-3des esp-sha-hmac 
crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20
crypto dynamic-map outside_dyn_map 20 set transform-set MYTRANS
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map client configuration address respond
crypto map outside_map client authentication NTSERVER
crypto map outside_map interface outside
isakmp enable outside
isakmp nat-traversal 20
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash sha
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup TCEMGREMOTE address-pool VPNPOOL
vpngroup TCEMGREMOTE dns-server host1 host2
vpngroup TCEMGREMOTE wins-server host1 host2
vpngroup TCEMGREMOTE default-domain example.local
vpngroup TCEMGREMOTE split-tunnel SplitTunnelACL
vpngroup TCEMGREMOTE idle-time 1800
vpngroup TCEMGREMOTE password <password>
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 5
management-access inside
console timeout 0
dhcpd domain example.com

: end

 

[jrjuiliano]

I think I have it...

Looks like I can't have a completely different subnet (local lan is 10.10.0.0 255.255.0.0 and the PIX subnet for my VPN pool was 192.168.1.0 255.255.0.0). I was under the impression that I should not set my PIX to the same subnet, but it was the only thing that seemed to work.

Unless someone has an idea about setting a specific route? Everything seemed to work right with the 192.168.1.0 subnet except for telnet!

I haven't tried multiple connections yet to the PIX using VPN but so far with a single connection everything seems to work with zero discarded or bypassed packets.

If anyone has any suggestions on a better way to do this, please speak up!

Thanks.

J.R.

 

[boymarty24]

You are right, you should have your pool one a different subnet. You can have some other connection problems if you use the same pool as your subnet.

Instead of using ANY in your access-list inside_outbound_nonat statement use your internal subnet range ( 10.10.0.0 )

 

[jrjuiliano]

Well, I think I have it now. Thanks for your help. I tried what you suggested and I probably did it wrong. It turned my whole subnet into nonat and ended up killing Internet and E-mail connectivity. Oh well.

I guess I'd be OK to use something 10.10.6.0 255.255.255.240 for now. I don't plan on having more than maybe two connections at a time, so we'll see how it goes!

 

[boymarty24]

huh, that was strange.

did you use

access-list inside_outbound_nonat permit ip 10.10.0.0 255.255.255.0 192.168.1.0 255.255.255.0 ?

 

[jrjuiliano]

Oh, probably not; I don't quite remember what I did (and I'm at home now anyway, so the work stops! :=) ). But I think I have it working with this "small subnet". Need to test it with multiple connections but I don't know when that's going to happen.

Thanks again for your help.

 

[mbilgrav]

your inside ACL doesnt allow telnet.

 

[boymarty24]

Well he can ssh and the accesslist doesnt allow that either. And he has the sysopt command who excludes the ipsec traffic from the accesslists, or i am wrong?