Banging my head against VPN Clients

[irregular]

I’ve been trying to set-up a VPN (3.5 Client -> PIX 515 6.1(2)) for the last couple of weeks. Config follows.

I finally have it to the stage where the client is connecting fine, with the connection status statistics showing tunnel connections to both the PIX’s public address and my internal subnet.

However, I am unable to ping or access any resource on the internal network from the client machine. Similarly, I cannot ping the client from the internal network.

But, I can ping the client from the PIX command line, and ping the PIX from the client.

What does this indicate, and what am I doing wrong?

Thanks in advance,

Irregular

PIX Version 6.1(2)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
hostname MyPIX
domain-name acme.com
fixup protocol ftp 21
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
no fixup protocol http 80
no fixup protocol smtp 25
names

access-list 150 permit ip 10.0.0.0 255.255.255.0 10.1.1.0 255.255.255.0
access-list localtovpnclient permit ip 10.0.0.0 255.255.255.0 10.1.1.0 255.255.255.0

interface ethernet0 10full
interface ethernet1 100full
mtu outside 1500
mtu inside 1500
ip address outside XX.XX.XX.XX 255.255.255.240
ip address inside 10.0.0.254 255.255.255.0
arp timeout 14400
global (outside) 1 XX.XX.XX.XX netmask 255.255.255.255
global (outside) 2 XX.XX.XX.XX netmask 255.255.255.255
global (outside) 3 XX.XX.XX.XX netmask 255.255.255.255
nat (inside) 2 10.0.0.55 255.255.255.255 0 0
nat (inside) 3 10.0.0.72 255.255.255.255 0 0
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) XX.XX.XX.XX 10.0.0.3 netmask 255.255.255.255 0 0
static (inside,outside) XX.XX.XX.XX 10.0.0.72 netmask 255.255.255.255 0 0
static (inside,outside) XX.XX.XX.XX 10.0.0.55 netmask 255.255.255.255 0 0
static (inside,outside) XX.XX.XX.XX 10.0.0.102 netmask 255.255.255.255 0 0
static (inside,outside) XX.XX.XX.XX 10.0.0.247 netmask 255.255.255.255 0 0

route outside 0.0.0.0 0.0.0.0 XX.XX.XX.XX 1
http 10.0.0.0 255.255.255.0 inside
sysopt connection permit-ipsec
no sysopt route dnat

crypto ipsec transform-set mytransform esp-des esp-sha-hmac
crypto dynamic-map dyn 10 set transform-set mytransform
crypto dynamic-map dyn 10 set security-association lifetime seconds 2700 kilobytes 4608000
crypto map mymap 200 ipsec-isakmp dynamic dyn
crypto map mymap client configuration address initiate
crypto map mymap interface outside
isakmp enable outside
isakmp key ******** address 0.0.0.0 netmask 0.0.0.0
isakmp identity address
isakmp client configuration address-pool local vpn_pool outside
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash sha
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
vpngroup vpn_users address-pool vpn_pool
vpngroup vpn_users wins-server 10.0.0.3
vpngroup vpn_users split-tunnel localtovpnclient
vpngroup vpn_users idle-time 1800
vpngroup vpn_users password ********

 

[yizhar]

HI.

Please post a more complete configuration.

Do you have this line:
nat (inside) 0 access-list 150

Where is the "ip local pool" command?

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar