Can't ping anything through VPN

[mbarrow]

Hello,

This is really doing my head in and i've been trying for days without success. I'm trying to configure a vpn using IPSEC or PPTP. I can connect using vpn client 3.1 but can't ping nothing, do I have to create a route between my vpn ip address and the local ip address? and i can't connect using PPTP.

Can someone please have a look at my config and give me some pointers?

PIX Version 6.2(2)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security50
enable password ************* encrypted
passwd ************* encrypted
hostname trghco-pix515
domain-name trghcopix.com
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
name 192.168.5.170 mailserver1
name 192.168.5.113 mailserver2
object-group network mailservers
network-object host mailserver1
network-object host mailserver2
object-group service allowed_ports tcp
port-object eq smtp
access-list 100 permit tcp any host 80.4.***.*** eq www
access-list 100 permit tcp host 80.4.***.*** host 80.4.***.*** eq pcanywhere-data
access-list 100 permit udp host 80.4.***.*** host 80.4.***.*** eq pcanywhere-status
access-list 100 permit tcp host 193.201.***.*** host 80.4.***.*** eq pcanywhere-data
access-list 100 permit udp host 193.201.***.*** host 80.4.***.*** eq pcanywhere-status
access-list 100 permit tcp any host 80.4.***.*** eq www
access-list 100 permit tcp host 193.201.***.*** host 80.4.***.*** eq sqlnet
access-list 100 permit tcp host 80.4.***.*** host 80.4.***.*** eq pcanywhere-data
access-list 100 permit udp host 80.4.***.*** host 80.4.***.*** eq pcanywhere-status
access-list 100 permit tcp host 80.4.***.*** host 80.4.***.*** eq pcanywhere-data
access-list 100 permit udp host 80.4.***.*** host 80.4.***.*** eq pcanywhere-status
access-list 100 permit tcp host 193.201.***.*** host 80.4.***.*** eq ftp
access-list 100 permit tcp host 212.56.***.*** host 80.4.***.*** eq ftp
access-list 100 permit tcp host 193.201.***.*** host 80.4.***.*** eq pcanywhere-data
access-list 100 permit udp host 193.201.***.*** host 80.4.***.*** eq pcanywhere-status
access-list vpn permit ip 192.168.5.0 255.255.255.0 192.168.12.0 255.255.255.0
pager lines 24
interface ethernet0 100full
interface ethernet1 100full
interface ethernet2 100full
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip address outside 80.4.***.*** 255.255.255.224
ip address inside 192.168.5.102 255.255.255.0
ip address dmz 192.168.8.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool bigpool 192.168.12.1-192.168.12.253
pdm location 192.168.5.6 255.255.255.255 inside
pdm location 192.168.5.104 255.255.255.255 inside
pdm location mailserver2 255.255.255.255 inside
pdm location mailserver1 255.255.255.255 inside
pdm location 192.168.2.0 255.255.255.0 inside
pdm location 192.168.2.22 255.255.255.255 inside
pdm location 192.168.1.0 255.255.255.0 inside
pdm location 192.168.9.0 255.255.255.0 inside
pdm location 192.168.5.1 255.255.255.255 inside
pdm location 192.168.5.3 255.255.255.255 inside
pdm location 168.50.1.0 255.255.255.0 inside
pdm location 192.168.5.223 255.255.255.255 inside
pdm location 192.168.5.222 255.255.255.255 inside
pdm history enable
arp timeout 14400
global (outside) 1 80.4.***.***
nat (inside) 1 192.168.5.0 255.255.255.0 0 0
static (inside,outside) 80.4.***.*** mailserver1 netmask 255.255.255.255 0 0
static (inside,outside) 80.4.***.*** mailserver2 netmask 255.255.255.255 0 0
static (inside,outside) 80.4.***.*** 192.168.5.104 netmask 255.255.255.255 0 0
static (inside,outside) 80.4.***.*** 192.168.5.223 netmask 255.255.255.255 0 0
static (inside,outside) 80.4.***.*** 192.168.5.6 netmask 255.255.255.255 0 0
static (inside,outside) 80.4.***.*** 192.168.5.222 netmask 255.255.255.255 0 0
access-group 100 in interface outside
route outside 0.0.0.0 0.0.0.0 80.4.185.126 1
route inside 168.50.1.0 255.255.255.0 192.168.5.3 1
route inside 192.168.1.0 255.255.255.0 192.168.5.3 1
route inside 192.168.2.0 255.255.255.0 192.168.5.1 1
route inside 192.168.9.0 255.255.255.0 192.168.5.3 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 si
p 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 192.168.5.6 255.255.255.255 inside
http 192.168.2.22 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt security fragguard
sysopt connection permit-ipsec
sysopt connection permit-pptp
no sysopt route dnat
crypto ipsec transform-set myset esp-des esp-md5-hmac
crypto dynamic-map dynmap 10 set transform-set myset
crypto map mymap 10 ipsec-isakmp dynamic dynmap
crypto map mymap client configuration address initiate
crypto map mymap client configuration address respond
crypto map mymap interface outside
isakmp enable outside
isakmp policy 10 authentication rsa-sig
isakmp policy 10 encryption des
isakmp policy 10 hash sha
isakmp policy 10 group 1
isakmp policy 10 lifetime 86400
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup vpn3000-all address-pool bigpool
vpngroup vpn3000-all default-domain password
vpngroup vpn3000-all idle-time 1800
vpngroup vpn3000-all password ********
telnet 192.168.5.6 255.255.255.255 inside
telnet 192.168.2.22 255.255.255.255 inside
telnet timeout 5
ssh timeout 5
vpdn group 1 accept dialin pptp
vpdn group 1 ppp authentication pap
vpdn group 1 ppp authentication chap
vpdn group 1 ppp authentication mschap
vpdn group 1 ppp encryption mppe 40
vpdn group 1 client configuration address local bigpool
vpdn group 1 pptp echo 60
vpdn group 1 client authentication local
vpdn username ********* password *********
vpdn enable outside
terminal width 80
Cryptochecksum:f7c2e57d63f89298a3dd025f897bce79
: end
trghco-pix515#

 

[ChicagoTechNet]

use tracert command to find out where it stops or post the result here.

Robert Lin, MS-MVP, MCSE & CNE
Windows, Network and How to at

http://www25.brinkster.com/ChicagoTech

 

[mbarrow]

Hi thanks for the reply.

I've tried a tracert to a pc on the 192.168.5.0 network and am getting a timeout straight away.

Thanks

 

[FX45]

Can you access anything through VPN? I guess not
After quick look at cfgs i can see "nat(0)" stuff missed
I'm assuming you want to access hosts on network 192.168.5.0/24. If not, there is more work to do with this configuration.

Try this:

Create new access list for traffic between dynamically assigned addresses from your "bigpool"(192.168.12.0/24) and addresses you want these clients to access inside your network (192.168.5.0/24).
ie.:

access-list FX45 permit ip 192.168.5.0 255.255.255.0 192.168.12.0 255.255.255.0

!-- Add more statements to access-list FX45 for future VPN's.
!-- In essence this access-list states what traffic you want to allow to pass through the VPN tunnels.

Then, except this traffic from the NAT process.

nat (inside) 0 access-list FX45


Hope this will help a little.
If not I'll have to look at this cfg line by line.
There is another issue with this VPN:
with your configuration, after opening VPN tunnel, VPN clients may not be able to browse the internet at the same time. You may change the FX45 name to anything you want
Anyway, the above addition is necessary in both scenarios.

 

[mbarrow]

FX45

I already have an access-list between the 192.168.5.0 and 192.168.12.0 network. I was missing the nat (inside) 0 access-list vpn. I have now added this and it is still not pinging or connecting to anything on the .5.0 network. Do I have to add an access-group? When i connect through to the vpn the access-list hitcnt doesn't go up by 1, it's always 0.

Also how can you tell that if the VPN clients connect they can't access the internet at the same time?

Sorry to ask to many questions and i really appreciate the help.

 

[FX45]

add:
isakmp identity address

change:
vpngroup vpn3000-all default-domain password
to:
vpngroup vpn3000-all default-domain something.com

If you have internal DNS u can add this:
vpngroup vpn3000-all dns-server 192.168.5.59

Can u PPTP using w2k build-in client?
Try to ping using ip address not FQDN


change mppe to auto :
vpdn group 1 ppp encryption mppe auto

Try to create different pool for PPTP:
ip local pool pptp-pool 192.168.125.1-192.168.125.254
vpdn group 1 client configuration address local pptp-pool
vpdn group 1 client configuration dns 192.168.5.59

nat (inside) 0 access-list FX45
access-list FX45 permit ip 192.168.5.0 255.255.0.0 192.168.125.0 255.255.255.0
!--- for inside networks behind next hop routers
access-list FX45 permit ip 192.168.5.0 255.255.0.0 192.168.9.0 255.255.255.0


Make sure that IP addresses you use for VPN & PPTP pools are not used anywhere else in the inside network.
Double check NIC config on Servers for duplicate IP addresses, netmask and getaway mismatch.

If you have internal routers do ip classless on them and add static routes to VPN & PPTP networks.
ip route 192.168.125.0 255.255.255.0 192.168.5.102
ip route 192.168.12.0 255.255.255.0 192.168.5.102