no connection pcanywhere on pix 506E

[bobby333]

I've been trying to gain access from a remote location with pcanywhere and cannot seem to get it to work. Can anyone see from my config what the problem may be? I have googled around for a few hours and thought I may ask here.

Pix external IP is one assigned by DHCP x.x.x.x
Pix internal IP is 10.180.181.3/24
Remote network is x.x.x.230
Internal pc is 10.180.181.10


PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100

fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list outside_access_in permit tcp any any eq pcanywhere-data
access-list outside_access_in permit udp any any eq pcanywhere-status
pager lines 24
logging on
logging console debugging
logging queue 100
icmp permit host x.x.x.230 outside
icmp deny any outside
mtu outside 1500
mtu inside 1500
ip address outside dhcp setroute
ip address inside 10.180.181.3 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location x.x.x.230 255.255.255.255 outside
pdm location x.x.x.x 255.255.255.255 outside
pdm location 10.180.181.10 255.255.255.255 inside
pdm location 10.180.181.5 255.255.255.255 inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp interface pcanywhere-data 10.180.181.10 pcanywhere-data netmask 255.255.255.255 0 0
static (inside,outside) udp interface pcanywhere-status 10.180.181.10 pcanywhere-status netmask 255.255.255.255 0 0
access-group outside_access_in in interface outside
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
ntp server 10.180.180.8 source inside
http server enable
http 10.180.181.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet 10.180.181.0 255.255.255.0 inside
telnet timeout 5
ssh 10.180.181.0 255.255.255.0 inside
ssh timeout 5
console timeout 0
dhcpd auto_config outside
terminal width 80
: end

I see this in the log file while trying to connect:

302013: Built inbound TCP connection 9 for outside:x.x.x.230/1167 (x.x.x.230/1167) to inside:10.180.181.10/5631 (x.x.x.x/5631)
302014: Teardown TCP connection 7 for outside:x.x.x.230/1160 to inside:10.180.181.10/5631 duration 0:02:01 bytes 0 SYN Timeout

 

[KiscoKid]

On initial review the config seems fine but I do have a couple of queries.

Is the external DHCP address assigned to the PIX the same every time? It will need to be if anyone on the x.x.x.230 network is to have a chance to connect to the PCAnywhere host.

Also, what version of PCAnywhere are you using? I see you are using pcanywhere-data/pcanywhere-status in yoyr config which I believe defaults to ports 5631 and 5632 respectively. These ports became standard from PCAnywhere version 7.52 onwards. Previous to 7.52, the ports used were TCP 65301 for control and UDP 22 for status.

It's also worth noting that the later versions of PCAnywhere allow the user to set any control and status port to anything they want. It's probably worth checking on the PC in the PCAnywhere config (I think it's called Fast Forward under Webconfig) to see what ports have been configured.

You can also open a DOS window and issue the "netstat -an" command to see if you can determine what PCAnywhere ports the PC is listening on. This command is also useful to see if the remote network is actually able to connect to the PC, i.e. you may see an ESTABLISHED connection which would suggest the PIX is correctly configured but PCAnywhere is not.

Hope this helps

 

[bobby333]

Thanks for the information, what I discovered to be wrong was I didn't have the gateway IP assigned to the internal pc only a fixed IP without the gateway. Thats why I could ping it no problem from the pix but it wouldn't connect.