PIX IPSEC VPN NAT PROBLEM

[Fritjof]

Hi,

I have a problem with my PIX515e. I configured for VPN dial in via the Cisco VPN Client 4.6. Here ist the szenario:

- Pix with outside ip 99.99.99.99 and a VPN-Pool 10.49.13.0 Class C
- Inside PIX Interface 10.49.10.30 (255.255.254.0)
- Some other inside networks behinde the PIX

I can dial in and get a connection. Everything works fine when I dial in directly (Modem, ISDN, UMTS) without nat. When I dial in from behind a nat device it doesn't work anymore. I have searched this place an found out the I need to enable nat-traversal, wich I did. Still I have the same problem. What am I doing wrong? Heres the config:


PIX Version 6.3(4)
interface ethernet0 100full
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100

clock timezone CEST 1
clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol pptp 1723
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69

access-list inside_outbound_nat0_acl permit ip DD_Fuerth 255.255.255.224 10.49.13.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip RV_HDC 255.255.255.0 10.49.13.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip RV_Internet 255.255.255.0 10.49.13.0 255.255.255.0
access-list outside_cryptomap_dyn_20 permit ip any 10.49.13.0 255.255.255.0
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 99.99.99.99 255.255.255.240
ip address inside 10.49.10.30 255.255.254.0
ip audit info action alarm
ip audit attack action alarm
ip local pool VPNPoll 10.49.13.1-10.49.13.254 mask 255.255.255.0
no failover
failover timeout 0:00:00
failover poll 15
no failover ip address outside
no failover ip address inside

pdm history enable
arp timeout 14400
global (outside) 10 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 10 0.0.0.0 0.0.0.0 0 0
route outside 0.0.0.0 0.0.0.0 62.206.41.65 1
route inside RV_HDC 255.255.255.0 10.49.10.3 1
route inside DD_Fuerth 255.255.255.224 10.49.10.26 1
route inside RV_Internet 255.255.255.0 10.49.10.3 1
route inside DD_Bensheim 255.255.255.0 10.49.10.26 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute

floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set TRANS_ESP_3DES_MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set TRANS_ESP_3DES_MD5 mode transport
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5
crypto dynamic-map outside_dyn_map_1 20 match address outside_cryptomap_dyn_20
crypto dynamic-map outside_dyn_map_1 20 set transform-set ESP-3DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map_1
crypto map outside_map client authentication RADIUS
crypto map outside_map interface outside
isakmp enable outside
isakmp identity address
isakmp nat-traversal 120
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup DomainVPNGroup address-pool VPNPoll
vpngroup DomainVPNGroup dns-server Server1
vpngroup DomainVPNGroup wins-server Server1
vpngroup DomainVPNGroup default-domain domainname.local
vpngroup DomainVPNGroup idle-time 1800
vpngroup DomainVPNGroup password ********
console timeout 0
: end

Any hint is welcome. Thank you!

 

[Decryptk33p3r]

First off keep it simple! Kill the names until it's working.
2nd you have an outside ip 99.99.99.99 255.255.255.240
w/a route outside of 62.206.41.65, can you even ping the default route. Ping outside 62.206.41.65 do you get a reply?
Kill these 2 transform sets,
crypto ipsec transform-set TRANS_ESP_3DES_MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set TRANS_ESP_3DES_MD5 mode transport
Also you need this:
isakmp key xxxxxxxxxx address 0.0.0.0
Then go into config mode, clear crypto ipsec sa.
Then test it.
Thanks
Mike