CISCO 501 VPN (PPTP) connects but can not browse network

[sanjaymistry]

Hi All

I have a cisco 501 (PIX Version 6.3(5)) and I am trying to configure VPN from outside to into the office. I am using PPTP and local database authentication.

To test this I am using a laptop and a 3G card and I have managed to get the VPN to connect, however I can not browse the local network. Any help to get this working would be much apretiated.

Not sure what to do know as this is the first time I have done this (I have been using the web interface to configure the PIX)

Below is the configuration (I think) -

Building configuration...
: Saved
:
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password EFZmYtQzC3UQzpMd encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname fw
domain-name infomediatechnologies.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
object-group service FTP tcp
description FTP to Rackspace
port-object range 1400 2000
port-object eq ftp-data
port-object eq ftp
access-list outside_access_in remark FTP and passive mode on ports 1400 - 2000
access-list outside_access_in permit tcp any object-group FTP any log
access-list outside_access_in remark VPN - GRE
access-list outside_access_in permit gre any any log
access-list outside_access_in remark VPN - PPTP (port 1723)
access-list outside_access_in permit tcp any range pptp pptp any range pptp pptp log
access-list outside_access_in permit icmp any any log
access-list inside_access_in permit ip any any log
access-list inside_access_in permit icmp any any
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 81.187.237.115 255.255.255.224
ip address inside 192.168.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool VPN 192.168.1.2-192.168.1.9
ip local pool VPN2 192.168.2.2-192.168.2.10
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 81.187.237.97 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-pptp
telnet timeout 5
ssh timeout 5
console timeout 0
vpdn group VPN accept dialin pptp
vpdn group VPN ppp authentication pap
vpdn group VPN ppp authentication chap
vpdn group VPN ppp authentication mschap
vpdn group VPN ppp encryption mppe auto
vpdn group VPN client configuration address local VPN
vpdn group VPN client configuration dns 192.168.1.16
vpdn group VPN client configuration wins 192.168.1.16
vpdn group VPN pptp echo 60
vpdn group VPN client authentication local
vpdn username ben password *********
vpdn enable outside
vpdn enable inside
dhcpd address 192.168.1.20-192.168.1.129 inside
dhcpd dns 192.168.1.16 217.169.20.20
dhcpd wins 192.168.1.16
dhcpd lease 604800
dhcpd ping_timeout 750
dhcpd auto_config outside
dhcpd enable inside
terminal width 80
Cryptochecksum:4e3f760002c12d2f281eac4dda85b1df
: end
[OK]

Many thanks

Sanjay

 

[jfwebber]

Your VPN pool of addresses cannot be the same as your internal network addresses.

ip address inside 192.168.1.1 255.255.255.0
ip local pool VPN 192.168.1.2-192.168.1.9


Just change it to something else.

Jim W MCSE CCNA
Network Manager

 

[sanjaymistry]

Hi Jim

Just tried this, did not work ;-( My new config now is below

Building configuration...
: Saved
:
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password EFZmYtQzC3UQzpMd encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname fw
domain-name infomediatechnologies.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
object-group service FTP tcp
description FTP to Rackspace
port-object range 1400 2000
port-object eq ftp-data
port-object eq ftp
access-list outside_access_in remark FTP and passive mode on ports 1400 - 2000
access-list outside_access_in permit tcp any object-group FTP any log
access-list outside_access_in remark VPN - GRE
access-list outside_access_in permit gre any any log
access-list outside_access_in remark VPN - PPTP (port 1723)
access-list outside_access_in permit tcp any range pptp pptp any range pptp pptp log
access-list outside_access_in permit icmp any any log
access-list inside_access_in permit ip any any log
access-list inside_access_in permit icmp any any
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 81.187.237.115 255.255.255.224
ip address inside 192.168.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool VPN2 192.168.2.2-192.168.2.10
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 81.187.237.97 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-pptp
telnet timeout 5
ssh timeout 5
console timeout 0
vpdn group VPN accept dialin pptp
vpdn group VPN ppp authentication pap
vpdn group VPN ppp authentication chap
vpdn group VPN ppp authentication mschap
vpdn group VPN ppp encryption mppe 40
vpdn group VPN client configuration address local VPN2
vpdn group VPN client configuration dns 192.168.1.16
vpdn group VPN client configuration wins 192.168.1.16
vpdn group VPN pptp echo 60
vpdn group VPN client authentication local
vpdn username ben password *********
vpdn enable outside
vpdn enable inside
dhcpd address 192.168.1.20-192.168.1.129 inside
dhcpd dns 192.168.1.16 217.169.20.20
dhcpd wins 192.168.1.16
dhcpd lease 604800
dhcpd ping_timeout 750
dhcpd auto_config outside
dhcpd enable inside
terminal width 80
Cryptochecksum:74bd0ab26aa9bbe5c7dc4e2731c1bc60
: end
[OK]

 

[jfwebber]

Add the following:

fixup protocol pptp 1723



Jim W MCSE CCNA
Network Manager

 

[sanjaymistry]

Hi

tried that, still no joy. is it a firewall rules thing as the VPN on the ;aptop connects but just can not see the work lan

below is the config

Building configuration...
: Saved
:
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password EFZmYtQzC3UQzpMd encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname fw
domain-name infomediatechnologies.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol pptp 1723
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
object-group service FTP tcp
description FTP to Rackspace
port-object range 1400 2000
port-object eq ftp-data
port-object eq ftp
access-list outside_access_in remark FTP and passive mode on ports 1400 - 2000
access-list outside_access_in permit tcp any object-group FTP any log
access-list outside_access_in remark VPN - GRE
access-list outside_access_in permit gre any any log
access-list outside_access_in remark VPN - PPTP (port 1723)
access-list outside_access_in permit tcp any range pptp pptp any range pptp pptp log
access-list outside_access_in permit icmp any any log
access-list inside_access_in permit ip any any log
access-list inside_access_in permit icmp any any
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 81.187.237.115 255.255.255.224
ip address inside 192.168.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool VPN2 192.168.2.2-192.168.2.10
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 81.187.237.97 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-pptp
telnet timeout 5
ssh timeout 5
console timeout 0
vpdn group VPN accept dialin pptp
vpdn group VPN ppp authentication pap
vpdn group VPN ppp authentication chap
vpdn group VPN ppp authentication mschap
vpdn group VPN ppp encryption mppe 40
vpdn group VPN client configuration address local VPN2
vpdn group VPN client configuration dns 192.168.1.16
vpdn group VPN client configuration wins 192.168.1.16
vpdn group VPN pptp echo 60
vpdn group VPN client authentication local
vpdn username ben password *********
vpdn enable outside
vpdn enable inside
dhcpd address 192.168.1.20-192.168.1.129 inside
dhcpd dns 192.168.1.16 217.169.20.20
dhcpd wins 192.168.1.16
dhcpd lease 604800
dhcpd ping_timeout 750
dhcpd auto_config outside
dhcpd enable inside
terminal width 80
Cryptochecksum:74bd0ab26aa9bbe5c7dc4e2731c1bc60
: end
[OK]

 

[jfwebber]

Try the following:

access-list nonat permit ip host 192.168.1.0 192.168.2.0 255.255.255.0

nat (inside) 0 access-list nonat



Jim W MCSE CCNA
Network Manager

 

[sanjaymistry]

Hi Still no joy

 

[pmore628]

I am doing the same exact thing... How are you authenticating once your vpn connects? What database?Assuming you are using windows server?

 

[sanjaymistry]

Hi

Just using the local db on the cisco to authenticate the VPN user.

Jim - Any other clues to what I could be doing wrong? is it a firewall config thing once I am connected?


Sanjay

 

[jfwebber]

Sanjay...I was hoping someone else would jump in who has a bit more experience with the PIX than I do. I'll have another look and see if I spot anything.

Jim W MCSE CCNA
Network Manager

 

[jfwebber]

I don't believe you need the following access-lists:

access-list outside_access_in remark VPN - GRE
access-list outside_access_in permit gre any any log
access-list outside_access_in remark VPN - PPTP (port 1723)
access-list outside_access_in permit tcp any range pptp pptp any range pptp pptp log

Try removing them and see how it goes.

Jim W MCSE CCNA
Network Manager