PIX 501/VPN and Cisco VPN Client

[jafo18301]

I have been working on this problem for several months now. I have tried everything that I can think of (including reading several books and many internet articles) but I still cannot get my VPN up and running. I am trying to configure my PIX 501 to work with the Cisco VPN 4.0 Client. I keep getting stuck on the Phase 1 and it will not go past it. I am also having an issue with setting up a webserver and having the pix redirect to it. I have a dynamic ip address for the outside. Any help is greatly appreciated:

JAFO

PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password **** encrypted
passwd *** encrypted
hostname ***
domain-name ***.***
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol pptp 1723
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
ip address outside dhcp setroute
ip address inside 10.99.99.1 255.255.255.0
ip verify reverse-path interface outside
ip verify reverse-path interface inside
ip audit info action alarm
ip audit attack action alarm
ip local pool bigpool 192.168.1.1-192.168.1.254
pdm location 10.99.0.0 255.255.0.0 inside
pdm logging informational 100
names
access-list internet_to_inside permit tcp any host 10.99.99.104 eq www
access-list 101 permit ip 10.99.99.0 255.255.255.0 192.168.1.0 255.255.255.0
pager lines 10
mtu outside 1500
mtu inside 1500
ip address outside dhcp setroute
ip address inside 10.99.99.1 255.255.255.0
ip verify reverse-path interface outside
ip verify reverse-path interface inside
ip audit info action alarm
ip audit attack action alarm
ip local pool bigpool 192.168.1.1-192.168.1.254
pdm location 10.99.0.0 255.255.0.0 inside
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list 101
nat (inside) 1 50.1.1.0 255.255.255.0 0 0
nat (inside) 1 90.1.1.0 255.255.255.0 0 0
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp interface

http://www 10.99.99.104

http://www netmask

255.255.255.2
55 0 0
access-group internet_to_inside in interface outside
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
aaa-server tacacs protocol tacacs+
aaa authentication ssh console LOCAL
aaa authentication http console LOCAL
aaa authentication telnet console LOCAL
aaa authentication enable console LOCAL
aaa authorization command LOCAL
http server enable
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
crypto ipsec transform-set myset esp-des esp-md5-hmac
crypto dynamic-map dynmap 10 set transform-set myset
crypto map mymap 10 ipsec-isakmp dynamic dynmap
crypto map mymap client configuration address initiate
crypto map mymap client configuration address respond
crypto map mymap interface outside
isakmp key ******** address 0.0.0.0 netmask 0.0.0.0
isakmp client configuration address-pool local bigpool outside
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup grp3000 idle-time 1800
vpngroup vpn3000-all address-pool bigpool
vpngroup vpn3000-all dns-server ***.***.***.***
vpngroup vpn3000-all default-domain password
vpngroup vpn3000-all idle-time 1800
vpngroup vpn3000-all password ********
telnet 10.99.99.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 10.99.99.50-10.99.99.80 inside
dhcpd dns ***.***.***.*** ***.***.***.***
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd enable inside
username **** password **** encrypted privilege 15
username **** password **** encrypted privilege 15
privilege show level 10 command access-list
privilege configure level 11 command access-list
privilege clear level 12 command access-list
privilege show level 15 mode configure command configure
privilege clear level 15 mode configure command configure
privilege configure level 15 mode configure command configure
privilege configure level 15 mode enable command configure
privilege configure level 0 mode enable command enable
privilege show level 15 mode configure command enable
privilege configure level 15 mode configure command enable
privilege configure level 15 mode configure command igmp
privilege show level 15 mode configure command logging
privilege clear level 15 mode configure command logging
privilege configure level 15 mode configure command logging
privilege clear level 15 mode enable command logging
privilege configure level 15 mode enable command logging
terminal width 80

 

[horus42]

Remove all of the VPN stuff and follow this example and you should be OK, if you only have dynamic IP it will not be easy to host your own website but it's still doable you need to see this site

http://www.dyndns.com

VPN example;

http://www.cisco.com/en/US/products...s_configuration_example09186a00801e71c0.shtml

Hopoe that helps

 

[jafo18301]

Thanks for the reply. I did what you said but I am still unable to make a connection. I am trying it from behind the pix b/c I do not currently have another connection to try it from. I'm wondering if something is blocking the pix from getting past phase 1 or if I'm blocking it from the inside where I am unable to go through a port. I'm not sure which port the Cisco vpn client uses. I have also tried to setup pptp with opening ports 1723 and 47 and still nothing. I will keep trying but if anyone has any ideas as to why I cannot get past phase 1 I would greatly appreciate an explanation. I have been working on this for too long and I would love to understand why I cannot get it to work.

thanks,

JAFO

 

[horus42]

On your config it looks like you haven't enabled ISAKMP on the out side interface, you need this command isakmp enable outside.

What do you mean by "I am trying it from behind the pix b/c I do not currently have another connection to try it from" if you only have one firewall and you want to try this you need to make sure that the test station is on the outside interface of the firewall or enable the VPN on the inside interface.

 

[jafo18301]

I did see that before and enabled it. That was my bad since I forgot to make a copy of the config after I did that. I am enabling the isakmp on the inside as well as the crypto map is being enabled on the inside but I still cannot see the pix. I'm starting to think that my isp is blocking these ports. Which ports does the VPN require? I know that pptp requires 1723 and 47 but I'm not sure about the Cisco VPN for the client. Thanks for the update. I will also continue to find out which ports are being blocked from my isp.

JAFO