i'm vpn'd, but that's it..

[snootalope]

PIX 515

I got a pptp vpn setup on her right now.. I connect fine, get my address from it, but I thought I'd be able to ping an address inside the firewall (like an rdp machine) from the machine that I'm vpning from.. guess not.. I'm not quite sure why, I was thinking that maybe something is blocked..

ip pool - 10.10.1.50 - .57 <-- same ip range as inside lan
subnet - 255.255.255.255 <-- I can't change that!!! it's automatically given that way!!! that could be the problem in itself.. hhmm..

advice?

&quot;tis better to remain silent and be thought of as a fool..
then open your mouth and remove all doubt&quot; Mark Twain

&quot;I should of been a doctor..&quot; Me

 

[jfwebber]

Well, Im not expert, but to I have my ip pool (192.168.12.0) different than my inside lan (192.168.1.0) and use the following access-list:

ip local pool pptp-pool 192.168.12.1-192.168.12.5

access-list vpnlist permit ip 192.168.1.0 255.255.255.0 192.168.12.0 255.255.25.0

Hope this helps.

Jim

Jim Webber
Network Administrator MCSE CNA

 

[jfwebber]

I also should learn to proof read my posts. It should be:

ip local pool pptp-pool 192.168.12.1-192.168.12.5

access-list vpnlist permit ip 192.168.1.0 255.255.255.0 192.168.12.0 255.255.255.0

Jim Webber
Network Administrator MCSE CNA

 

[br0ck]

Can you post your config and i'll take a look at it
and help you out

Regards

 

[yizhar]

HI.

> I got a pptp vpn setup on her right now
Better use the Cisco IPSec VPN client.

> ip pool - 10.10.1.50 - .57 <-- same ip range as inside lan
I agree with &quot;Slainte35&quot; - part of the solution will be to use different address range for VPN clients.

> subnet - 255.255.255.255 <-- I can't change that!!!
That's OK. Don't worry about it.


Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[snootalope]

I added acces-list's and it still isn't working..

I can't even ping inside address from my vpn'd machine.. I connect just fine though!

Also, does anyone have a link to the vpn client? I'm a member of cisco's site and I can't even frickin find it!!!!!

thanks guys

&quot;tis better to remain silent and be thought of as a fool..
then open your mouth and remove all doubt&quot; Mark Twain

&quot;I should of been a doctor..&quot; Me

 

[yizhar]

HI.

> I added acces-list's and it still isn't working
Please provide more details, and reread the posts.

> Also, does anyone have a link to the vpn client?
Contact your Cisco reseller.


Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[snootalope]

whoa..

Whatever happend with that access-list totally screwed my other rules damnit..

Hell with it, I'm going to find white papers somewhere..

yizhar>
I used this
access-list vpnlist permit ip 192.168.1.0 255.255.255.0 192.168.12.0 255.255.255.0
but with my ip scheme.. what more do you wanna know?

I setup a pptp vpn from my home pc.. the vpn on the pix has got a pool of addy's from 192.168.1.2 - .4 - it connects just fine! But I can't ping or see anyting on the inside of the network..

&quot;tis better to remain silent and be thought of as a fool..
then open your mouth and remove all doubt&quot; Mark Twain

&quot;I should of been a doctor..&quot; Me

 

[yizhar]

HI.

> Hell with it, I'm going to find white papers somewhere..
Good idea.
You'll find some here:

http://teachers.sivan.co.il/yizhar/files/pixlinks.htm

> what more do you wanna know?
See the FAQ of this forum, and post your whole config (or at least a more detailed output).
Please describe exactly what you do, and what are the results.
Use syslog messages.
When troubleshooting VPN - please describe the remote client as well - OS, configuration, Internet connection type, firewall in use, NAT devices at the client side, etc.
You should also check if the remote client can ping the pix outside interface (without establishing VPN tunnel).

Choosing the VPN technology to use is also important.
PPTP has several weaknesses - for example the client has the option to save the password on its PC, which means that an attacker can and will easily still it in no time.
Configuring and troubleshooting the pix (and the client) for PPTP is different then for Cisco client.

Good Luck, and don't rush...


Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar