Need help with modifying PIX config

[cmtoth]

I did a 'sh running config' command and I see that I have:
isakmp identity address

I imagine my VPN issues may clear up if I change it to 'isakmp identity hostname'

Should I do:
no isakmp identity address <enter>
isakmp identity hostname <enter>
wr mem <enter>
reload

That's all I need to change, right?

Thanks!

 

[Supergrrover]

What VPN issues are you having? You generally do want to use
isakmp identity address.


Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[cmtoth]

Brent, thanks for the reply!

I have a Cisco 506e and for the past few months, users who work from home through the VPN, have been experiencing disconnection issues.

What happens, is that they are working fine, then for whatever reason they are disconnected. So they try to log back in with the Cisco VPN client software, but cannot.

The only way for me to "fix" it, is if I log on to the PIX and issue a 'reload' command. After that, they can log in fine.

There is really no pattern to it. Some users use DSL, others various cable connections. Almost all use Windows XP while some use Windows 2000.

But someone on the Cisco newsgroups suggested I use:

isakmp identity hostname

to see if that helps.

Are you suggesting that I don't use this?

Thanks!

 

[Supergrrover]

It depends on how you are set up. You need to have the clients and PIX choose the same way.
I always have my VPN clients set to connect using an IP address and not a resolved name (less DNS issues.)

I would check deeper - spin up a syslog server and have it log all the isakmp and ipsec messages and see what's actually happening on the pix. If you clear connections and xlates does it allow them to reconnect without a reload?

Other things to check,
-You can check to make sure the time is correct (pix and host- I have had it cause problems in the past.)
-Are there other users behind the remote locations router/firewall that are connecting to a VPN as well? (can cause a disconnect.)
-Other connectivity issues (on both ends) dropped internet connections, delays, lost packets.
-PIX CPU usage, timeouts on tcp connections(embryonic, half open), bandwidth saturation.



Brent
Systems Engineer / Consultant
CCNP, CCSP