RE: help with troubleshooting Cisco VPN connection [7:23695]
Using a different IP subnet is the way to do it. The PIX treats this like a virtual interface and has the intelligence built in to forward traffic between the inside and the VPN address range. Looking at your config, I agree with removing the conduit statement but I don't believe that is causing the issue. Really, besides some unexpected things (such as no NAT for Internet access), I don't see anything glaringly obvious that would cause your issue. The one thing I know I have had issues with is using numbers for access lists on a PIX. Recently, I lost track of what I was configurin and used numbered (extended IP) access lists on a PIX. Nothing worked right! I noticed my mistake, changed the access lists to my normal names and eveything worked again. I suggest trying this. Also, if the access list 80 is not needed, which doesn't look to be in this config, I would remove it as well. Other than that, I might suspect that you have a hardware issue since this same config works on a similar PIX with the same OS. Rik -Original Message- From: chris [mailto:[EMAIL PROTECTED]] Sent: Monday, October 22, 2001 11:36 PM To: [EMAIL PROTECTED] Subject: Re: help with troubleshooting Cisco VPN connection [7:23695] In your config below the vpn client is being assigned an address that is on a different subnet than the inside interface of the pix and there is no sign of a router on that subnet (no default inside route to a router). BTW, you may want to get rid of the conduit permit any any! Chris ""Anh Lam"" wrote in message [EMAIL PROTECTED]">news:[EMAIL PROTECTED]... > Can someone in this group help me with this problem? > > I am trying to setup VPN connections for remote users (people who use > laptops on the road or when people to who are on their own corporate > network) to connect to my home network using IPSec. I am using a > PIX515-UR Firewall at my home network. The external IP address > (outside) of the PIX is 66.61.46.240 while the internal IP address > (inside) of the PIX is 172.16.1.254. > > On the PIX, I also setup an IP pool so that the PIX will assign IP > address to remote clients when they connect to my home network. This > ip pool has ip range of 172.16.2.1-172.16.2.254. > > On the clients side, everyone is running Cisco VPN client software > version 3.0.6.rel2-k9 which I download from Cisco website. The > clients are running either WinNT 4.0 workstation, or Win2k > Professional or RedHat Linux 7.1 with kernel 2.4.10. > > When a client attempts to make a VPN connection to the PIX > (66.61.46.240), the connection is successfully and the client is also > assigned an IP address of 172.16.2.1. So what is the problem you ask? > Well, even though the client is successfully authenticated to my home > network, he/she can NOT ping any of the devices in the 172.16.1.0/24 > network. From the client, I can see the packet gets encrypted before > sending out but nothing coming back (the counter on the packet > decrypted on the client is zero). Rebooting the PIX several times > didnot resolve the situation either. > > At this point, I decided to replace the PIX515 with a PIX520 with the > exact configuration. With the PIX520, everything WORKS. Client can > access devices on the 172.16.1.0/24 network. I am running the same PIX > IOS code on both the 515 and 520. Am I missing something in the > PIX515? I thought since I am running the > Un-Restricted(UR) license, VPN is supported. Below is the > configuration of the PIX515. Please help. > > Thanks. > Anh > > ciscopix#sh ver > > Cisco PIX Firewall Version 6.1(1) > Cisco PIX Device Manager Version 1.0(2) > > Compiled on Tue 11-Sep-01 07:45 by morlee > > ciscopix up 9 hours 37 mins > > Hardware: PIX-515, 96 MB RAM, CPU Pentium 200 MHz > Flash i28F640J5 @ 0x300, 16MB > BIOS Flash AT29C257 @ 0xfffd8000, 32KB > > 0: ethernet0: address is 0050.54ff.7a24, irq 10 > 1: ethernet1: address is 0050.54ff.7a25, irq 7 > 2: ethernet2: address is 00aa.00bc.ba87, irq 11 > > Licensed Features: > Failover: Enabled > VPN-DES:Enabled > VPN-3DES: Disabled > Maximum Interfaces: 6 > Cut-through Proxy: Enabled > Guards: Enabled > Websense: Enabled > Inside Hosts: Unlimited > Throughput: Unlimited > ISAKMP peers: Unlimited > > ciscopix# wr t > Building configuration... > : Saved > : > PIX Version 6.1(1) > nameif ethernet0 outside security0 > nameif ethernet1 inside security100 > nameif ethernet2 dmz security99 > enable password xxx encrypted > passwd x encrypted > hostname ciscopix > domain-name micronet.com > fixup protocol ftp 21 > fixup protocol http 80 > fixup protocol h323 1720 &g
Re: help with troubleshooting Cisco VPN connection [7:23695]
Chris, I don't know how long you have been working with PIX but on the VPN client, the client will get an IP between 172.16.2.1 and 172.16.2.254. The access-list will make the necessary connectivity to 172.16.1.0/24 network. If you've read this post from start to finish, you would know that the exact configuration works on the PIX520 but not the PIX515. Even Cisco TAC guy is also scratching his head over this. >From: "chris" >Reply-To: "chris" >To: [EMAIL PROTECTED] >Subject: Re: help with troubleshooting Cisco VPN connection [7:23695] >Date: Mon, 22 Oct 2001 23:35:41 -0400 > >In your config below the vpn client is being assigned an address that is on >a different subnet than the inside interface of the pix and there is no >sign >of a router on that subnet (no default inside route to a router). > >BTW, you may want to get rid of the conduit permit any any! > >Chris > >""Anh Lam"" wrote in message >[EMAIL PROTECTED]">news:[EMAIL PROTECTED]... > > Can someone in this group help me with this problem? > > > > I am trying to setup VPN connections for remote users (people > > who use laptops on the road or when people to who are on their > > own corporate network) to connect to my home network using > > IPSec. I am using a PIX515-UR Firewall at my home network. > > The external IP address (outside) of the PIX is 66.61.46.240 > > while the internal IP address (inside) of the PIX is 172.16.1.254. > > > > On the PIX, I also setup an IP pool so that the PIX will assign > > IP address to remote clients when they connect to my home > > network. This ip pool has ip range of 172.16.2.1-172.16.2.254. > > > > On the clients side, everyone is running Cisco VPN client > > software version 3.0.6.rel2-k9 which I download from Cisco > > website. The clients are running either WinNT 4.0 workstation, > > or Win2k Professional or RedHat Linux 7.1 with kernel 2.4.10. > > > > When a client attempts to make a VPN connection to the PIX > > (66.61.46.240), the connection is successfully and the client is > > also assigned an IP address of 172.16.2.1. So what is the problem > > you ask? Well, even though the client is successfully authenticated > > to my home network, he/she can NOT ping any of the devices in the > > 172.16.1.0/24 network. From the client, I can see the packet gets > > encrypted before sending out but nothing coming back (the counter > > on the packet decrypted on the client is zero). Rebooting the PIX > > several times didnot resolve the situation either. > > > > At this point, I decided to replace the PIX515 with a PIX520 > > with the exact configuration. With the PIX520, everything WORKS. > > Client can access devices on the 172.16.1.0/24 network. > > I am running the same PIX IOS code on both the 515 and 520. Am > > I missing something in the PIX515? I thought since I am running the > > Un-Restricted(UR) license, VPN is supported. Below is the > > configuration of the PIX515. Please help. > > > > Thanks. > > Anh > > > > ciscopix#sh ver > > > > Cisco PIX Firewall Version 6.1(1) > > Cisco PIX Device Manager Version 1.0(2) > > > > Compiled on Tue 11-Sep-01 07:45 by morlee > > > > ciscopix up 9 hours 37 mins > > > > Hardware: PIX-515, 96 MB RAM, CPU Pentium 200 MHz > > Flash i28F640J5 @ 0x300, 16MB > > BIOS Flash AT29C257 @ 0xfffd8000, 32KB > > > > 0: ethernet0: address is 0050.54ff.7a24, irq 10 > > 1: ethernet1: address is 0050.54ff.7a25, irq 7 > > 2: ethernet2: address is 00aa.00bc.ba87, irq 11 > > > > Licensed Features: > > Failover: Enabled > > VPN-DES:Enabled > > VPN-3DES: Disabled > > Maximum Interfaces: 6 > > Cut-through Proxy: Enabled > > Guards: Enabled > > Websense: Enabled > > Inside Hosts: Unlimited > > Throughput: Unlimited > > ISAKMP peers: Unlimited > > > > ciscopix# wr t > > Building configuration... > > : Saved > > : > > PIX Version 6.1(1) > > nameif ethernet0 outside security0 > > nameif ethernet1 inside security100 > > nameif ethernet2 dmz security99 > > enable password xxx encrypted > > passwd x encrypted > > hostname ciscopix > > domain-name micronet.com > > fixup protocol ftp 21 > > fixup protocol http 80 > > fixup protocol h323 1720 > > fixup protocol rsh 514 > > fixup protocol rtsp 554 > > fixup protocol smtp 25 > > fixup protocol sqlnet 1521 > > fixup protocol sip 5060 >
RE: help with troubleshooting Cisco VPN connection [7:23695]
Looks like you have the NAT 0 in place. I'm wondering about the IP Pool. I see your access-list 101 allows 172.16.1.0 to 172.16.2.0, both subnetted to /24. I wonder if maybe the PIX is looking at the IP Pool as a Class B address since you cannot specify the mask in the IP Pool statement? If so, would it work to do an access-list like: Access-list 101 permit ip 172.16.0.0 255.255.0.0 172.16.0.0 Just a guess. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Anh Lam Sent: Sunday, October 21, 2001 4:01 PM To: [EMAIL PROTECTED] Subject:help with troubleshooting Cisco VPN connection in [7:23695] Can someone in this group help me with this problem? I am trying to setup VPN connections for remote users (people who use laptops on the road or when people to who are on their own corporate network) to connect to my home network using IPSec. I am using a PIX515-UR Firewall at my home network. The external IP address (outside) of the PIX is 66.61.46.240 while the internal IP address (inside) of the PIX is 172.16.1.254. On the PIX, I also setup an IP pool so that the PIX will assign IP address to remote clients when they connect to my home network. This ip pool has ip range of 172.16.2.1-172.16.2.254. On the clients side, everyone is running Cisco VPN client software version 3.0.6.rel2-k9 which I download from Cisco website. The clients are running either WinNT 4.0 workstation, or Win2k Professional or RedHat Linux 7.1 with kernel 2.4.10. When a client attempts to make a VPN connection to the PIX (66.61.46.240), the connection is successfully and the client is also assigned an IP address of 172.16.2.1. So what is the problem you ask? Well, even though the client is successfully authenticated to my home network, he/she can NOT ping any of the devices in the 172.16.1.0/24 network. From the client, I can see the packet gets encrypted before sending out but nothing coming back (the counter on the packet decrypted on the client is zero). Rebooting the PIX several times didnot resolve the situation either. At this point, I decided to replace the PIX515 with a PIX520 with the exact configuration. With the PIX520, everything WORKS. Client can access devices on the 172.16.1.0/24 network. I am running the same PIX IOS code on both the 515 and 520. Am I missing something in the PIX515? I thought since I am running the Un-Restricted(UR) license, VPN is supported. Below is the configuration of the PIX515. Please help. Thanks. Anh ciscopix#sh ver Cisco PIX Firewall Version 6.1(1) Cisco PIX Device Manager Version 1.0(2) Compiled on Tue 11-Sep-01 07:45 by morlee ciscopix up 9 hours 37 mins Hardware: PIX-515, 96 MB RAM, CPU Pentium 200 MHz Flash i28F640J5 @ 0x300, 16MB BIOS Flash AT29C257 @ 0xfffd8000, 32KB 0: ethernet0: address is 0050.54ff.7a24, irq 10 1: ethernet1: address is 0050.54ff.7a25, irq 7 2: ethernet2: address is 00aa.00bc.ba87, irq 11 Licensed Features: Failover: Enabled VPN-DES:Enabled VPN-3DES: Disabled Maximum Interfaces: 6 Cut-through Proxy: Enabled Guards: Enabled Websense: Enabled Inside Hosts: Unlimited Throughput: Unlimited ISAKMP peers: Unlimited ciscopix# wr t Building configuration... : Saved : PIX Version 6.1(1) nameif ethernet0 outside security0 nameif ethernet1 inside security100 nameif ethernet2 dmz security99 enable password xxx encrypted passwd x encrypted hostname ciscopix domain-name micronet.com fixup protocol ftp 21 fixup protocol http 80 fixup protocol h323 1720 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol sip 5060 fixup protocol skinny 2000 no names access-list 101 permit ip 172.16.1.0 255.255.255.0 172.16.2.0 255.255.255.0 access-list 101 permit ip host 66.61.46.240 172.16.2.0 255.255.255.0 access-list 80 permit ip 172.16.1.0 255.255.255.0 172.16.2.0 255.255.255.0 pager lines 24 interface ethernet0 auto interface ethernet1 auto interface ethernet2 100full shutdown mtu outside 1500 mtu inside 1500 mtu dmz 1500 ip address outside 66.61.46.240 255.255.248.0 ip address inside 172.16.1.254 255.255.255.0 ip address dmz 127.0.0.1 255.255.255.0 ip audit info action alarm ip audit attack action alarm ip local pool ippool 172.16.2.1-172.16.2.254 no failover failover timeout 0:00:00 failover poll 15 failover ip address outside 0.0.0.0 failover ip address inside 0.0.0.0 failover ip address dmz 0.0.0.0 pdm location 164.109.0.0 255.255.0.0 outside pdm location 172.16.1.0 255.255.255.0 inside pdm history enable arp timeout 14400 nat (inside) 0 access-list 101 conduit permit ip any any route outside 0.0.0.0 0.0.0.0 66.61.40.1 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server RADIUS protocol radius http 172.16.1.0 255.255.255.0 inside
Re: help with troubleshooting Cisco VPN connection [7:23695]
In your config below the vpn client is being assigned an address that is on a different subnet than the inside interface of the pix and there is no sign of a router on that subnet (no default inside route to a router). BTW, you may want to get rid of the conduit permit any any! Chris ""Anh Lam"" wrote in message [EMAIL PROTECTED]">news:[EMAIL PROTECTED]... > Can someone in this group help me with this problem? > > I am trying to setup VPN connections for remote users (people > who use laptops on the road or when people to who are on their > own corporate network) to connect to my home network using > IPSec. I am using a PIX515-UR Firewall at my home network. > The external IP address (outside) of the PIX is 66.61.46.240 > while the internal IP address (inside) of the PIX is 172.16.1.254. > > On the PIX, I also setup an IP pool so that the PIX will assign > IP address to remote clients when they connect to my home > network. This ip pool has ip range of 172.16.2.1-172.16.2.254. > > On the clients side, everyone is running Cisco VPN client > software version 3.0.6.rel2-k9 which I download from Cisco > website. The clients are running either WinNT 4.0 workstation, > or Win2k Professional or RedHat Linux 7.1 with kernel 2.4.10. > > When a client attempts to make a VPN connection to the PIX > (66.61.46.240), the connection is successfully and the client is > also assigned an IP address of 172.16.2.1. So what is the problem > you ask? Well, even though the client is successfully authenticated > to my home network, he/she can NOT ping any of the devices in the > 172.16.1.0/24 network. From the client, I can see the packet gets > encrypted before sending out but nothing coming back (the counter > on the packet decrypted on the client is zero). Rebooting the PIX > several times didnot resolve the situation either. > > At this point, I decided to replace the PIX515 with a PIX520 > with the exact configuration. With the PIX520, everything WORKS. > Client can access devices on the 172.16.1.0/24 network. > I am running the same PIX IOS code on both the 515 and 520. Am > I missing something in the PIX515? I thought since I am running the > Un-Restricted(UR) license, VPN is supported. Below is the > configuration of the PIX515. Please help. > > Thanks. > Anh > > ciscopix#sh ver > > Cisco PIX Firewall Version 6.1(1) > Cisco PIX Device Manager Version 1.0(2) > > Compiled on Tue 11-Sep-01 07:45 by morlee > > ciscopix up 9 hours 37 mins > > Hardware: PIX-515, 96 MB RAM, CPU Pentium 200 MHz > Flash i28F640J5 @ 0x300, 16MB > BIOS Flash AT29C257 @ 0xfffd8000, 32KB > > 0: ethernet0: address is 0050.54ff.7a24, irq 10 > 1: ethernet1: address is 0050.54ff.7a25, irq 7 > 2: ethernet2: address is 00aa.00bc.ba87, irq 11 > > Licensed Features: > Failover: Enabled > VPN-DES:Enabled > VPN-3DES: Disabled > Maximum Interfaces: 6 > Cut-through Proxy: Enabled > Guards: Enabled > Websense: Enabled > Inside Hosts: Unlimited > Throughput: Unlimited > ISAKMP peers: Unlimited > > ciscopix# wr t > Building configuration... > : Saved > : > PIX Version 6.1(1) > nameif ethernet0 outside security0 > nameif ethernet1 inside security100 > nameif ethernet2 dmz security99 > enable password xxx encrypted > passwd x encrypted > hostname ciscopix > domain-name micronet.com > fixup protocol ftp 21 > fixup protocol http 80 > fixup protocol h323 1720 > fixup protocol rsh 514 > fixup protocol rtsp 554 > fixup protocol smtp 25 > fixup protocol sqlnet 1521 > fixup protocol sip 5060 > fixup protocol skinny 2000 > no names > access-list 101 permit ip 172.16.1.0 255.255.255.0 172.16.2.0 255.255.255.0 > access-list 101 permit ip host 66.61.46.240 172.16.2.0 255.255.255.0 > access-list 80 permit ip 172.16.1.0 255.255.255.0 172.16.2.0 255.255.255.0 > pager lines 24 > interface ethernet0 auto > interface ethernet1 auto > interface ethernet2 100full shutdown > mtu outside 1500 > mtu inside 1500 > mtu dmz 1500 > ip address outside 66.61.46.240 255.255.248.0 > ip address inside 172.16.1.254 255.255.255.0 > ip address dmz 127.0.0.1 255.255.255.0 > ip audit info action alarm > ip audit attack action alarm > ip local pool ippool 172.16.2.1-172.16.2.254 > no failover > failover timeout 0:00:00 > failover poll 15 > failover ip address outside 0.0.0.0 > failover ip address inside 0.0.0.0 > failover ip address dmz 0.0.0.0 > pdm location 164.109.0.0 255.255.0.0 outside > pdm location 172.16.1.0 255.255.255.0 inside > pdm history enable > arp timeout 14400 > nat (inside) 0 access-list 101 > conduit permit ip any any > route outside 0.0.0.0 0.0.0.0 66.61.40.1 1 > timeout xlate 3:00:00 > timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 > h323 0:05:00 sip 0:30:00 sip_media 0:02:00 > timeout uauth 0:05:00 absolute > aaa-server TACACS+ protocol tacacs+ > aaa-server RADIUS protocol radius > http 172.16.1.0 255.255.255.0 inside > http 172.16.1.0 255.255.255.0 dmz > no snmp-server location > no
