NEWBIE TO VPN Please help. 1

[quell]

I'm new to the VPN, this is my first. I've read a little and made the config changes to the PIX and the router. I'm also trying to install a citrix server also on our network. It works throughout the network but not outside the network. Here is my configs for both. It still doesnt work. Please let me know if you have any ideas. Thanx
Internet
|
Cisco 2600
|
PIX
|
Network
Here is the 2600 config

sing 1167 out of 29688 bytes
!
version 12.1
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
hostname 313-gw
enable password -----
ip subnet-zero
no ip finger
ip domain-name -----.NET
ip name-server 198.-.-.5
interface FastEthernet0/0
description To Office FastEthernet
ip address 65.-.-.241 255.255.255.240
duplex auto
speed auto
interface Serial0/0
description To ---- (313)
bandwidth 1536
no ip address
encapsulation frame-relay IETF
no fair-queue
frame-relay lmi-type ansi
interface Serial0/0.1 point-to-point
bandwidth 1536
ip unnumbered FastEthernet0/0
frame-relay interface-dlci 500 IETF
ip classless
ip route 0.0.0.0 0.0.0.0 Seria
ip http serverEthernet0/0
snmp-server community b841519c74 Roffice FastEthernet
snmp-server enable traps snmps 65.-.-.241 255.255.255.2
!
line con 0
password -------
login
transport preferred none
transport input none
line aux 0
password --------
login
modem InOut
transport preferred none
transport input all
transport output pad v120 telnet rlogin udptn
stopbits 1
flowcontrol hardware
line vty 0 4
password -------
login
transport preferred none
!
no scheduler allocate
end


Here is the PIX config

PIX Version 6.1(1)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password -------- encrypted
passwd --------- encrypted
hostname pix
domain-name --.com
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
access-list 111 permit tcp any host 65.-.-.245 eq www
access-list 111 permit tcp any host 65.-.-.246 eq smtp
access-list 111 permit tcp any host 65.-.-.246 eq www
access-list nonat permit ip 192.168.0.0 255.255.255.0 192.168.0.0 255.255.255.0

pager lines 24
interface ethernet0 auto
interface ethernet1 auto
mtu outside 1500
mtu inside 1500
ip address outside 65.-.-.243 255.255.255.240
ip address inside 192.168.0.253 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool usipool 192.168.0.225-192.168.0.230
pdm history enable
arp timeout 14400
global (outside) 1 65.-.-.244 netmask 255.255.255.255
nat (inside) 0 access-list nonat
nat (inside) 1 192.168.0.0 255.255.255.0 0 0
static (inside,outside) 65.-.-.245 192.168.0.9 netmask 255.255.255.255 0 0
static (inside,outside) 65.-.-.246 192.168.0.6 netmask 255.255.255.255 0 0
access-group 111 in interface outside
route outside 0.0.0.0 0.0.0.0 65.-.-.241 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 si
p 0:30:00 sip_media 0
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
no sysopt route dnat
crypto ipsec transform-set steve esp-des esp-md5-hmac
crypto dynamic-map dyna-brett 10 set transform-set steve
crypto map larkin 99 ipsec-isakmp dynamic dyna-brett
crypto map larkin client configuration address initiate
crypto map larkin client configuration address respond
crypto map larkin interface outside
isakmp enable outside
isakmp identity address
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
vpngroup usi address-pool usipool
vpngroup usi idle-time 1800
vpngroup usi password --------
telnet timeout 5
ssh timeout 5
terminal width 80
Cryptochecksum:----------

 

[yizhar]

HI.

> It works throughout the network but not outside the network.
What do you mean?
What exactly did you try?
Do you plan to access the Citrix over the VPN tunnel?
Do you plan to directly access the Citrix from the Internet?
Does the http and mail server work?

> ip address inside 192.168.0.253 255.255.255.0
> ip local pool usipool 192.168.0.225-192.168.0.230
Unlike MS VPN implementation, in the pix the vpn clients must get addresses that do not overlap with any other network. Something like:
ip local pool usipool 10.10.10.1-10.10.10.10
access-list nonat permit ip 192.168.0.0 255.255.255.0 10.10.10.0 255.255.255.0


Use syslog messages to get more info for troubleshooting.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[quell]

ok heres what I've tried. With the Citrix I can access it with no problems on the LAN. But when I try it from the internet. No Luck. I connect to the internet then put in the ip address of the pix in a web browser. Same as I do on the LAN. But no luck. With the vpn I put in the ip address of the pix o in a cisco vpn client app and no luck anywere, on the LAN or over the internet. Both mail and http work fine. This will be my first VPN. As far as accessing the citrix server over the VPN tunnel....I have no clue on how to do that. I will try what you recommended. Also does the client need to have an address within that ip range? Thanx for your help

 

[yizhar]

HI.

Is the Citrix acting as a HTTP server? Doesn't it need another port open for ICA protocol?

> I connect to the internet then put in the ip address of the pix in a web browser
What address?
You need to supply the address which is mapped to the Citrix server with the STATIC command.

More tips:
* You should clear the ARP cache on the router - to do it simply reboot the router or use the CLI.
* Make sure that the Citrix server has the correct default gateway and can access the Internet.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[quell]

Yes the Cirtix acts like a http server, you have to install it over IIS. As far as the ICA protocol...I'm not sure, I checked the protocols installed and its not there just tcp/ip and a couple other services. I don't know if that is included with the tcp/ip stack or not. Looking at the configerations for both the PIX and router does everything look right for a VPN, other then the changes that you mentioned earlier? I'm tyring to limit the possable probems. Once again thanx for your help.

 

[gbiello]

As the wise and wonderous Yizhar says, you need to map an internal address to an external address with a 'static' command. You also need to open port 1494 to that address.

access-list 111 permit tcp any host 65.-.-.??? eq 1494
static (inside,outside) 65.-.-.??? 192.168.0.??? netmask 255.255.255.255 0 0

Next, you will need to configure an alternate address on the Citrix server with the "altaddr" command. Use this to enter the external address specified in the static line.

To test, telnet to 65.-.-.??? on port 1494. If you see
'--ICA', you've done it correctly. If Citrix still doesn't let us know how you're trying to access it (pn.exe, NFuse) and what version of Citrix you're using. You may need some more configurations.

-gbiello

 

[quell]

Thank you both for your help. I will try that.

 

[quell]

ok day 3 on this dang thing heheh when I put in the access-list and the static configerations, then I type sh config it doesnt pop up that I put hte configurations in. Is there another way to verify that I put the settings in there. After I type the configs in there and hit enter is goes back to the prompt so I no that I'm putting them in right. I tried telneting to the port but nothing pops up. I'm testing telneting to it from the LAN.

 

[quell]

ok know i can verify the access-list with sh access-list
but I can not telnet to the port from the LAN. Were at in Citrix do you configure tthe alt addr? Ive looked everywere in the console mang and can't find anything do deal with that.

 

[gbiello]

altaddr is a command line utility.

 

[quell]

ok heres what I have. I did the altaddr command on the citrix server.
access-list 111 permit tcp any host 65.197.65.- (<--ip # of pix) eq 149
static (inside,outside)65.197.60.- (<--ip # of pix) 192.168.0.9 netmask 255.255.255.255 0 0
This confilicts with another static route. so I need to delete the other route so I can add this one. or is there a way to have both? The VPN is working I just need to get the citrix working. The VPN is slow so I would rather use the Citrix. How can I access the Citrix over the VPN tunnel?
To test it all I'm doing is pluggin the ip address then:1494 into the browser. Am I doing this wrong or is there another way to test it?

 

[gbiello]

You would access Citrix over a VPN with all local addresses. Coming from the outside, you would use the alternate address. Now, if you type &quot;altaddr&quot; from a command prompt on the Citrix server, it should respond with the translated address.

There are some inconsistancies in your last post: 65.197.65.-, and 65.197.60.-. You wouldn't be using both. You might want to post an updated PIX config for us.

-gbiello

 

[quell]

Sorry about all the trouble. I appreciate it greatly. I owe ya a beer or something When I type in altaddr on the citrix server (192.168.0.9) it does come up with the address of the pix. 65.197.60.- Heres what I have so far for access-list and static configurations.

access-list 111 permit tcp any host 65.197.60.- (ISP)eq

http://www (hitcnt=62)

access-list 111 permit tcp any host 65.197.60.- (ISP)eq smtp (hitcnt=4)
access-list 111 permit tcp any host 65.197.60.- (Another ISP) eq

http://www (hitcnt=38)

access-list 111 permit tcp any host 65.197.60.-(ISP) eq 1494 (hitcnt=1)
access-list 111 permit tcp any host 65.197.60.-(Other ISP) eq 1494 (hitcnt=1)
access-list 111 permit tcp any host 65.197.60.-(PIX) eq 1494 (hitcnt=0)
access-list nonat permit ip 192.168.0.0 255.255.255.0 192.168.0.0 255.255.255.0
(hitcnt=202)

static (inside,outside) 65.197.60.-(ISP) 192.168.0.9(Citrix Server) netmask 255.255.255.255 0 0
static (inside,outside) 65.197.60.-(ISP) 192.168.0.6 netmask 255.255.255.255 0 0

When I try and type static (inside,outside) 65.197.60.-(pix)192.168.0.9(citrix server) netmask 255.255.255.255 0 0
it confilicts with the first static route. Is ther a way to get these two to work together or do i even need to do that?

 

[quell]

ok I can get to the Citrix server but cannot open any of the files that are published. The error says taht server cannot me found. Any ideas?

 

[gbiello]

Can you run a full desktop? If yes, than it's just a matter of you not being able to ennumerate your apps. You have two choices:
1) set up an NFuse server
2) open upd port 2512 (if MF XP) to allow apps to be ennumerated with Citrix Program Neighborhood.

You may also have to check the 'Firewalls' check box in Citrix Program Neighborhood when attempted to ennumerate the data set.

-gbiello

 

[yizhar]

HI.

> .. then I type sh config it doesnt pop up that I put hte configurations in ..

show configs - this gives you the saved configuration, not the active one. Similar to &quot;show start&quot; in IOS.

write term - this gives you the active configuration, similar to &quot;show run&quot; in IOS.

write mem - You probably know what this is for.

Most of the other show commands, work on the active configuration:
show access-list
show nat
show global
show xlate
show log
show ...

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[quell]

I can get to the application portal after login but when I click on an app it takes a while for the error to pop up. I installed the ica client app on the client trying to access the server. I read someplace that another port needs to be open 1604 or something like that. Should I open that port also? Thanks yizhar for the commands.

 

[quell]

Everything works fine on the LAN I can access all the programs etc.. Thats why I might think its another port issue with the pix.

 

[yizhar]

HI.

I have no field experience with Citrix, but you can check it this way.
Connect to the server from the LAN, and then issue the command:
netstat -n
At the client and/or server.

Another check - make sure that you have syslog working on the pix, then try to connect from outside.
Check for syslog messages related to the relevant ip addresses.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[gbiello]

You need to have UDP port open to ennumerate the applications. For MF1.8, it is 1604, for MFXP, it is 2512.

Don't forget to look at the 'Firewalls' checkbox.

-gbiello