Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

Register Log in
  • Congratulations bkrike on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

Pix 506E Config 1

Status
Not open for further replies.
vtgman

vtgman

IS-IT--Management
Sep 30, 2004
46
US
I just got into a new job and was left with this config. I need to get the VPN working this week. Can someone help me out. I have the PIX 506E and I am trying to the 3des and VPN client 4.X

Thanks,



PIX Version 6.3(1)
interface ethernet0 100full
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
hostname pixfirewall
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
names
name xxx.111.XX.XX
access-list smtp permit tcp any host XXX.145.XX.XX eq smtp
access-list inside_outbound_nat0_acl permit ip any 192.168.1.0 255.255.255.0
access-list outside_cryptomap_dyn_20 permit ip any 192.168.1.0 255.255.255.0
pager lines 24
icmp deny any outside
mtu outside 1500
mtu inside 1500
ip address outside XXX.XXX.XXX.XXX 255.255.255.248
ip address inside 192.168.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool vpnclients 192.168.1.126-192.168.1.134
pdm location xxx.145.XX.XX 255.255.255.255 outside
pdm location xxx.145.XX.XX 255.255.255.255 outside
pdm location 192.168.1.2 255.255.255.255 inside
pdm location 255.255.255.255 outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
global (outside) 1 XXX.xxx.xxx.xxx
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 192.168.1.0 255.255.255.0 0 0
static (inside,outside) 209.xxx.xxx.xxx 192.168.1.2 netmask 255.255.255.255 0 0
access-group smtp in interface outside
route outside 0.0.0.0 0.0.0.0 209.145.88.65 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map client authentication LOCAL
crypto map outside_map interface outside
isakmp enable outside
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup bridgewatervpn address-pool vpnclients
vpngroup bridgewatervpn dns-server
vpngroup bridgewatervpn default-domain
vpngroup bridgewatervpn idle-time 1800
vpngroup bridgewatervpn password
telnet timeout 5
ssh timeout 5
console timeout 0
terminal width 80
Cryptochecksum:27682e5f20e22a1da58487693444802f
: end
 
Sort by date Sort by votes
Hi,

I am not sure if you have cutted some out of your cfg or what. But here is what I would do:
ip local pool vpnclients 172.16.1.10-172.16.1.41

access-list inside_outbound_nat0_acl permit ip 192.168.1.0 255.255.255.0 172.16.1.0 255.255.255.0
access-list outside_cryptomap_dyn_20 permit ip 192.168.1.0 255.255.255.0
172.16.1.0 255.255.255.0

isakmp nat-t
(ipsec nat traversal, encap in udp/4500)

Then you have local auth, but no usernames.
create some users with username cmdd.

HTH
Martin

 
Upvote 0 Downvote
That worked. The only problem I am having at this time is my remote users can not see the local network. They can can browse the internet but not my local network to check email and see network resources.
 
Upvote 0 Downvote
please post your running cfg - its alot easier to diagnose.
 
Upvote 0 Downvote
PIX Version 6.3(1)
interface ethernet0 100full
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password fu7sLfi3l9qcq0ns encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname pixfirewall
domain-name bridgewaterretirement.org
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
names
access-list smtp permit tcp any host xxx.xxx.xxx.xxx eq smtp
access-list inside_outbound_nat0_acl permit ip any 192.168.5.0 255.255.255.0
access-list outside_cryptomap_dyn_20 permit ip any 192.168.5.0 255.255.255.0
access-list mygroup_splitTunnelAcl permit ip 192.168.1.0 255.255.255.0 any
access-list nonat permit ip 192.168.1.0 255.255.255.0 192.168.5.0 255.255.255.0
pager lines 24
icmp deny any outside
mtu outside 1500
mtu inside 1500
ip address outside xxx.xxx.xxx.xxx 255.255.255.248
ip address inside 192.168.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool VPNpool 192.168.5.1-192.168.5.25
pdm location xxx.xxx.xxx.xxx 255.255.255.255 outside
pdm location xxx.xxx.xxx.xxx 255.255.255.255 outside
pdm location 192.168.1.2 255.255.255.255 inside
pdm location xxx.xxx.xxx.xxx 255.255.255.255 outside
pdm location 192.168.5.0 255.255.255.0 outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
global (outside) 1 xxx.xxx.xxx.xxx
nat (inside) 1 192.168.1.0 255.255.255.0 0 0
static (inside,outside) xxx.xxx.xxx.xxx 192.168.1.2 netmask 255.255.255.255 0 0
access-group smtp in interface outside
route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx 1
route outside 192.168.5.0 255.255.255.0 xxx.xxx.xxx.xxx 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
aaa authentication ssh console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map client authentication LOCAL
crypto map outside_map interface outside
isakmp enable outside
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup mygroup address-pool VPNpool
vpngroup mygroup dns-server 216.12.92.130 216.12.92.131
vpngroup mygroup default-domain bridgewaterretirement.org
vpngroup mygroup split-tunnel mygroup_splitTunnelAcl
vpngroup mygroup idle-time 1800
vpngroup mygroup password ********
vpngroup mygtoup idle-time 1800
telnet 192.168.5.0 255.255.255.0 outside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 5
console timeout 0
username password atwx3/o/iOebDPQn encrypted privilege 2
username password em0L74EtUCaSXrcZ encrypted privilege 15
username password Y4lyiTTw.N.UQctl encrypted privilege 15
terminal width 80
 
Upvote 0 Downvote
Can anyone provide assistance. My clients can connect but do not have local access to local resources. The clients can get out to the Internet but can not ping an internal server they need to get to on my network.

Thanks,
Jeff
 
Upvote 0 Downvote
I think the split tunnel acl is the problem.

access-list mygroup_splitTunnelAcl permit ip 192.168.1.0 255.255.255.0 any

Shouldn't it be:

access-list mygroup_splitTunnelAcl permit ip any 192.168.1.0 255.255.255.0
or
ip local pool VPNpool 192.168.5.1-192.168.5.30
access-list mygroup_splitTunnelAcl permit ip 192.168.5.0 255.255.255.224 192.168.1.0 255.255.255.0
 
Upvote 0 Downvote
Thanks for everyones help......I got it working. I needed to add a nat statement and an access list statement.
 
Upvote 0 Downvote
Status
Not open for further replies.

Similar threads

Sparrow4
  • Locked
  • Question
Configure Avaya IPO R11 / VM Pro + Office365 or Exchange for voicemail to email
Replies
2
Views
811
Johnkite
Johnkite
tjbradford
  • Locked
  • Question
ASAX 5508 - basic config - packet loss
Replies
0
Views
281
tjbradford
tjbradford
xwray
  • Locked
  • Question
PIX 501 DHCP Server function
Replies
0
Views
208
xwray
xwray
RMurr34
  • Locked
  • Question
ASA Config - Open port 3389 for all IPs
Replies
1
Views
320
iggsterman
iggsterman
brownmab53
  • Locked
  • Question
PIX 525 ASA not allowing DHCP addresses to pass through to router
Replies
0
Views
260
brownmab53
brownmab53

Part and Inventory Search

Sponsor

Back
Top