PIX 501 to PIX 515 site to site tunnel

[TheStressFactor]

Hello all,

I have a pix 501 to pix 515 vpn tunnel. Everything is basically working fine. I can ping hosts from each location and rdp to them and vice versa.

One thing that is not working is microsoft office communicator. i can ping the server that runs it but my users behind the 501 cannot access it...any ideas? below is the 501 config

PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
hostname pix
domain-name .com
no fixup protocol dns
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list 10 permit ip 192.168.16.0 255.255.255.0 192.168.100.0 255.255.255.0
access-list 10 permit ip 192.168.16.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list 10 permit ip 192.168.16.0 255.255.255.0 192.168.51.0 255.255.255.0
access-list 10 permit ip 192.168.16.0 255.255.255.0 192.168.52.0 255.255.255.0
access-list 10 permit ip 192.168.16.0 255.255.255.0 192.168.53.0 255.255.255.0
access-list 10 permit ip 192.168.16.0 255.255.255.0 192.168.54.0 255.255.255.0
access-list 10 permit ip 192.168.16.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list 10 permit ip 192.168.16.0 255.255.255.0 192.168.3.0 255.255.255.0
access-list 10 permit ip 192.168.16.0 255.255.255.0 192.168.4.0 255.255.255.0
access-list 10 permit ip 192.168.16.0 255.255.255.0 192.168.5.0 255.255.255.0
access-list 10 permit ip 192.168.16.0 255.255.255.0 192.168.6.0 255.255.255.0
access-list 10 permit ip 192.168.16.0 255.255.255.0 192.168.7.0 255.255.255.0
access-list 10 permit ip 192.168.16.0 255.255.255.0 192.168.8.0 255.255.255.0
access-list 10 permit ip 192.168.16.0 255.255.255.0 192.168.9.0 255.255.255.0
access-list 10 permit ip 192.168.16.0 255.255.255.0 192.168.10.0 255.255.255.0
access-list 10 permit ip 192.168.16.0 255.255.255.0 192.168.11.0 255.255.255.0
access-list 10 permit ip 192.168.16.0 255.255.255.0 192.168.12.0 255.255.255.0
access-list 10 permit ip 192.168.16.0 255.255.255.0 192.168.13.0 255.255.255.0
access-list 10 permit ip 192.168.16.0 255.255.255.0 192.168.14.0 255.255.255.0
access-list 10 permit ip 192.168.16.0 255.255.255.0 192.168.15.0 255.255.255.0
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside pppoe setroute
ip address inside 192.168.16.2 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list 10
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
conduit permit icmp any any
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set phili esp-des esp-md5-hmac
crypto map phili 30 ipsec-isakmp
crypto map phili 30 match address 10
crypto map phili 30 set peer x.x.x.226
crypto map phili 30 set transform-set phili
crypto map phili interface outside
isakmp enable outside
isakmp key ******** address x.x.x.226 netmask 255.255.255.224 no-xauth no-
config-mode
isakmp nat-traversal 20
isakmp policy 30 authentication pre-share
isakmp policy 30 encryption des
isakmp policy 30 hash md5
isakmp policy 30 group 2
isakmp policy 30 lifetime 50000
telnet 192.168.16.0 255.255.255.0 inside
telnet timeout 5
ssh 192.168.1.0 255.255.255.255 inside
ssh 192.168.54.0 255.255.255.255 inside
ssh 192.168.60.0 255.255.255.255 inside
ssh 192.168.60.0 255.255.255.0 inside
ssh 192.168.54.0 255.255.255.0 inside
ssh 192.168.1.0 255.255.255.0 inside
ssh 192.168.16.0 255.255.255.0 inside
ssh timeout 50
console timeout 0
vpdn group pennoni request dialout pppoe
vpdn group pennoni localname
vpdn group pennoni ppp authentication mschap
vpdn username password *********
dhcpd address 192.168.16.50-192.168.16.80 inside
dhcpd dns 192.168.51.2 192.168.51.3
dhcpd wins 192.168.51.2 192.168.51.3
dhcpd lease 5000
dhcpd ping_timeout 750
dhcpd domain pennoni.com
dhcpd auto_config outside
dhcpd enable inside
terminal width 80

 

[fdurham]

Can you provide the sh run of the other pix. That configuration looks good.

Frank

 

[TheStressFactor]

Sure...here it is..thanks for looking.

PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 intf2 security4
hostname pix
domain-name domain.com
clock timezone EST -5
clock summer-time EDT recurring
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
object-group service Allow_OUT tcp
description Inside Permitted Traffic
port-object eq domain
port-object eq echo
port-object eq imap4
port-object eq smtp
port-object eq www
port-object eq ident
port-object eq ftp
port-object eq whois
port-object eq telnet
port-object eq ldap
port-object eq pop3
port-object eq ssh
port-object eq nntp
port-object eq h323
port-object eq ldaps
port-object eq aol
port-object eq ftp-data
port-object eq pptp
port-object eq https
port-object eq 5061
access-list inside_outbound_nat0_acl permit ip any 192.168.50.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip any 192.168.101.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 192.168.1.0 255.255.255.0 10.250.1.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 192.168.2.0 255.255.255.0 10.250.1.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 192.168.3.0 255.255.255.0 10.250.1.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 192.168.4.0 255.255.255.0 10.250.1.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 192.168.5.0 255.255.255.0 10.250.1.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 192.168.6.0 255.255.255.0 10.250.1.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 192.168.7.0 255.255.255.0 10.250.1.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 192.168.8.0 255.255.255.0 10.250.1.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 192.168.9.0 255.255.255.0 10.250.1.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 192.168.10.0 255.255.255.0 10.250.1.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 192.168.11.0 255.255.255.0 10.250.1.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 192.168.12.0 255.255.255.0 10.250.1.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 192.168.13.0 255.255.255.0 10.250.1.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 192.168.14.0 255.255.255.0 10.250.1.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip Knoxville 255.255.255.0 10.250.1.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 192.168.20.0 255.255.255.0 10.250.1.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 192.168.50.0 255.255.255.0 10.250.1.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 192.168.51.0 255.255.255.0 10.250.1.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 192.168.52.0 255.255.255.0 10.250.1.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 192.168.53.0 255.255.255.0 10.250.1.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 192.168.54.0 255.255.255.0 10.250.1.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip any 192.168.16.0 255.255.255.0
access-list outside_cryptomap_dyn_20 permit ip any 10.250.1.0 255.255.255.0
access-list outside_cryptomap_dyn_20 permit tcp any any eq 5061
access-list split permit ip 192.168.20.0 255.255.255.0 10.250.1.0 255.255.255.0
access-list split permit ip 192.168.1.0 255.255.255.0 10.250.1.0 255.255.255.0
access-list split permit ip 192.168.2.0 255.255.255.0 10.250.1.0 255.255.255.0
access-list split permit ip 192.168.3.0 255.255.255.0 10.250.1.0 255.255.255.0
access-list split permit ip 192.168.4.0 255.255.255.0 10.250.1.0 255.255.255.0
access-list split permit ip 192.168.5.0 255.255.255.0 10.250.1.0 255.255.255.0
access-list split permit ip 192.168.6.0 255.255.255.0 10.250.1.0 255.255.255.0
access-list split permit ip 192.168.7.0 255.255.255.0 10.250.1.0 255.255.255.0
access-list split permit ip 192.168.8.0 255.255.255.0 10.250.1.0 255.255.255.0
access-list split permit ip 192.168.9.0 255.255.255.0 10.250.1.0 255.255.255.0
access-list split permit ip 192.168.10.0 255.255.255.0 10.250.1.0 255.255.255.0
access-list split permit ip 192.168.11.0 255.255.255.0 10.250.1.0 255.255.255.0
access-list split permit ip 192.168.12.0 255.255.255.0 10.250.1.0 255.255.255.0
access-list split permit ip 192.168.13.0 255.255.255.0 10.250.1.0 255.255.255.0
access-list split permit ip 192.168.14.0 255.255.255.0 10.250.1.0 255.255.255.0
access-list split permit ip Knoxville 255.255.255.0 10.250.1.0 255.255.255.0
access-list split permit ip 192.168.50.0 255.255.255.0 10.250.1.0 255.255.255.0
access-list split permit ip 192.168.51.0 255.255.255.0 10.250.1.0 255.255.255.0
access-list split permit ip 192.168.52.0 255.255.255.0 10.250.1.0 255.255.255.0
access-list split permit ip 192.168.53.0 255.255.255.0 10.250.1.0 255.255.255.0
access-list split permit ip 192.168.54.0 255.255.255.0 10.250.1.0 255.255.255.0
access-list split permit ip any 192.168.16.0 255.255.255.0
access-list brownsville permit ip any 192.168.16.0 255.255.255.0
pager lines 24
logging on
logging trap warnings
logging history warnings
logging facility 23
mtu outside 1500
mtu inside 1500
mtu intf2 1500
ip address outside x x
ip address inside 192.168.100.2 255.255.255.0
ip address intf2 x 255.255.0.0
ip audit attack action alarm
ip local pool VPN 10.250.1.1-10.250.1.100
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) .x

http://www netmask

255.255.255.255 0 0
static (inside,outside) .x 192.168.1.6 netmask 255.255.255.255 0 0
static (inside,outside) .x 192.168.1.7 netmask 255.255.255.255 0 0
static (inside,outside) .x 192.168.1.13 netmask 255.255.255.255 0 0
static (inside,outside) .x 192.168.1.154 netmask 255.255.255.255 0 0
static (inside,outside) .x 192.168.1.18 netmask 255.255.255.255 0 0
static (inside,outside) .x 192.168.100.1 netmask 255.255.255.255 0 0
static (inside,outside) .x 192.168.1.5 netmask 255.255.255.255 0 0
static (inside,outside) .x netmask 255.255.255.255 0 0
static (inside,intf2) 192.168.100.0 192.168.100.0 netmask 255.255.255.0 0 0
static (inside,outside) .x 192.168.100.3 netmask 255.255.255.255 0 0
static (intf2,outside) .x 172.16.100.3 netmask 255.255.255.255 0 0
static (inside,outside) .x netmask 255.255.255.255 0 0
conduit permit tcp host .x eq https any
conduit permit tcp host .x eq pop3 any
conduit permit tcp host .x eq

http://www any

conduit permit tcp host .x eq

http://www any

conduit permit tcp host .x eq

http://www any

conduit permit tcp host .x eq

http://www any

conduit permit tcp host .x eq 8080 any
conduit permit tcp host .x eq pptp any
conduit permit gre host .x any
conduit permit tcp host .x eq ftp any
conduit permit tcp host .x eq telnet host 146.145.65.12
conduit permit tcp host .x eq smtp any
conduit permit icmp any any
conduit permit tcp host .x eq

http://www any

conduit permit gre host .x any
conduit permit tcp host .x eq pptp any
conduit permit udp host .x eq isakmp any
conduit permit tcp host .x eq 3389 any
rip inside default version 2
route outside 0.0.0.0 0.0.0.0 .x 1
route inside 10.250.1.0 255.255.255.0 192.168.100.1 1
route inside 192.168.1.0 255.255.255.0 192.168.100.1 1
route inside 192.168.2.0 255.255.255.0 192.168.100.1 1
route inside 192.168.3.0 255.255.255.0 192.168.100.1 1
route inside 192.168.4.0 255.255.255.0 192.168.100.1 1
route inside 192.168.5.0 255.255.255.0 192.168.100.1 1
route inside 192.168.6.0 255.255.255.0 192.168.100.1 1
route inside 192.168.7.0 255.255.255.0 192.168.100.1 1
route inside 192.168.8.0 255.255.255.0 192.168.100.1 1
route inside 192.168.9.0 255.255.255.0 192.168.100.1 1
route inside 192.168.10.0 255.255.255.0 192.168.100.1 1
route inside 192.168.11.0 255.255.255.0 192.168.100.1 1
route inside 192.168.12.0 255.255.255.0 192.168.100.1 1
route inside 192.168.14.0 255.255.255.0 192.168.100.1 1
route inside Knoxville 255.255.255.0 192.168.100.1 1
route inside 192.168.20.0 255.255.255.0 192.168.100.1 1
route inside 192.168.50.0 255.255.255.0 192.168.100.1 1
route inside 192.168.51.0 255.255.255.0 192.168.100.1 1
route inside 192.168.52.0 255.255.255.0 192.168.100.1 1
route inside 192.168.53.0 255.255.255.0 192.168.100.1 1
route inside 192.168.54.0 255.255.255.0 192.168.100.1 1
route inside 192.168.60.0 255.255.255.0 192.168.100.3 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
aaa-server partnerauth protocol radius
aaa-server partnerauth (inside) host 192.168.1.18 vpn123 timeout 10
url-server (inside) vendor websense host 192.168.100.7 timeout 5 protocol TCP version 1
url-cache dst 1KB
aaa authentication ssh console LOCAL
filter url http 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 allow
http server enable
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
sysopt connection permit-pptp
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set NORMAL esp-des esp-md5-hmac
crypto ipsec transform-set brownsville esp-des esp-md5-hmac
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-DES-MD5
crypto dynamic-map 20 11 set transform-set NORMAL
crypto map outside_map 10 ipsec-isakmp
crypto map outside_map 10 match address MS
crypto map outside_map 10 set peer
crypto map outside_map 10 set transform-set NORMAL
crypto map outside_map 20 ipsec-isakmp dynamic 20
crypto map outside_map 30 ipsec-isakmp
crypto map outside_map 30 match address brownsville
crypto map outside_map 30 set peer .52
crypto map outside_map 30 set transform-set brownsville
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map client authentication partnerauth
crypto map outside_map interface outside
isakmp enable outside
isakmp key ******** address netmask 255.255.255.255
isakmp key ******** address netmask 255.255.255.255 no-xauth no-config-mode
isakmp identity address
isakmp keepalive 10 5
isakmp nat-traversal 20
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 1
isakmp policy 10 lifetime 86400
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
isakmp policy 30 authentication pre-share
isakmp policy 30 encryption des
isakmp policy 30 hash md5
isakmp policy 30 group 2
isakmp policy 30 lifetime 50000
vpngroup ciscovpnusers address-pool PennoniVPN
vpngroup ciscovpnusers dns-server 192.168.51.2 192.168.51.3
vpngroup ciscovpnusers wins-server 192.168.51.2 192.168.51.3
vpngroup ciscovpnusers default-domain pennoni.com
vpngroup ciscovpnusers split-tunnel split
vpngroup ciscovpnusers idle-time 1800
vpngroup ciscovpnusers authentication-server partnerauth
vpngroup ciscovpnusers user-authentication
vpngroup ciscovpnusers device-pass-through
vpngroup ciscovpnusers password ********
vpngroup VPNaccess idle-time 1800
vpngroup VPNAccess split-tunnel inside_outbound_nat0_acl
vpngroup VPNAccess idle-time 1800
vpngroup ip idle-time 1800
telnet 192.168.100.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 30
console timeout 0
vpdn group VPNAccess accept dialin pptp
vpdn group VPNAccess ppp authentication mschap
vpdn group VPNAccess client configuration address local PennoniVPN
vpdn group VPNAccess client configuration dns 192.168.1.10 192.168.1.15
vpdn group VPNAccess client configuration wins 192.168.1.10 192.168.1.15
vpdn group VPNAccess pptp echo 60
vpdn group VPNAccess client authentication local
vpdn username mweidner password *********
vpdn enable outside
privilege 15
url-block url-mempool 1500
url-block url-size 4
terminal width 80

 

[NetworkGhost]

Try the "no fixup protocol sip".

 

[TheStressFactor]

On each pix or just the one with the network that is having problems?

 

[NetworkGhost]

Try the one that is having issues first. You may have to do both though.

 

[TheStressFactor]

Did it on both and it works like a champ now

 

[NetworkGhost]

Great. Nice to know that is a issue. There may be ways around it but for the time being that is a quick fix.

 

[TheStressFactor]

what does the fixup protocol do?

If I may ask you another question, I cannot seem to ping the 501 pix internal ip from any other network? any ideas why?

 

[NetworkGhost]

The fixup is supposed to provide an advanced inspection on certain types of traffic allowing ports to dynamically opened for an established session that requires them to be opened. The problem is that it doesnt always work. The ICMP thing could be due to a number of things. Have you done a trace route to make sure the traffic is making it to the hop before the Pix?

 

[TheStressFactor]

Lets say I do a tracert to the server behind the pix from my laptop.

It hits my default gateway, my pix(which is my sid eof the tunnel), and then goes right to the device without even acknowledging the pix on the other end.

 

[NetworkGhost]

because the pix on the other end is just passing the traffic. (Tunneling).If you are having issues pinging from the 515 internal network to the inside int on the 501 net it wont go because the traffic wont go back through the same interface it originated.

 

[TheStressFactor]

Makes a ton of sense....was thinking that and glad you confirmed it.

One last question. None of my clients on the network behind the pix can pick up dhcp. This is when trying to obtain a dhcp address from the pix 501 itself or a windows 2003 server. Is there something on the pix I need to enable to allow my clients to get dhcp addresses? The 3 clients are plugged into the ethernet ports on the 501 itself.

 

[NetworkGhost]

Place your DHCP setings back on pix.

You can do a show dhcpd statistics or show dhcpd binding


dhcpd address 192.168.16.50-192.168.16.80 inside
dhcpd dns 192.168.51.2 192.168.51.3
dhcpd wins 192.168.51.2 192.168.51.3
dhcpd domain pennoni.com
dhcpd enable inside

See if you are able to see your DHCP request stat increment you can also do a debug dhcpd event and debug dhcpd packet to see the requests coming in.

Make sure you also do a term mon so event messages will display on screen.

 

[TheStressFactor]

Sounds good...I will try this tonight. Thanks for all your help!

Is it not possible to have a win2k3 server do dhcp when using a pix? Do you have to use a pix to do the dhcp? Not that it matters either way but I am just curious.

Again, thanks for everything.

 

[NetworkGhost]

You can have the windows server do it. Thats how I would. If you are having problems getting addresses from your Windows Server then there may be other issues,