Not so EASYVPN

[br0ck]

i have a 506 as a server and a 501 as a client

now i want to add a 3.x VPN client in to the mix

are there any changes this i need to make to the server end for this to work

i have atttempted to connect the client but i can not pass pings or access the 506's LAN


TIA
b-

 

[ixleplix]

Are you trying to connect through the 501 to the 506 or from another point?

 

[br0ck]

no,

i have a internet user on a cable modem
with the vpn client

 

[ixleplix]

OK, just to make sure, you are trying to have them connect to the PIX 506 with the 3.x client, correct.

Under this assumption, you will have to make some changes on the PIX 506 for it to work propperly. Could you post the VPN config that you have running now? Protecting, of course any sensitive data. This will make it easier to see what commands you might be missing.

 

[br0ck]

PIX Version 6.3(3)


access-list nonat permit ip 192.168.1.0 255.255.255.0 192.168.5.0 255.255.255.0
access-list nonat permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0


ip local pool ipsecpool 192.168.2.1-192.168.2.254

global (outside) 1 interface
nat (inside) 0 access-list nonat
nat (inside) 1 0.0.0.0 0.0.0.0 0 0

access-group 100 in interface outside

sysopt connection permit-ipsec
sysopt connection permit-pptp

crypto ipsec transform-set myset esp-des esp-md5-hmac
crypto dynamic-map dynmap 10 set transform-set myset
crypto map vpn 10 ipsec-isakmp dynamic dynmap
crypto map vpn interface outside

isakmp enable outside
isakmp identity address
isakmp policy 5 authentication pre-share
isakmp policy 5 encryption des
isakmp policy 5 hash md5
isakmp policy 5 group 1
isakmp policy 5 lifetime 86400
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400

vpngroup groupname address-pool ipsecpool
vpngroup groupname dns-server 192.168.1.250
vpngroup groupname default-domain lan.net
vpngroup groupname split-tunnel nonat
vpngroup groupname idle-time 1800
vpngroup groupname password ********
vpngroup idle-time idle-time 1800

 

[yizhar]

HI.

The VPN 3.x (or 4.x a recommended newer version) client should be able to connect without modification to the pix acting as VPN server.

Some side notes:
> isakmp policy 5
What do you need it for?
I think that your "isakmp policy 10" is good enough so why use both of them?

You should also consider using XAUTH (AAA for incoming VPN clients) for a more secure VPN configuration.



Yizhar Hurwitz

http://teachers.sivan.co.il/yizhar

 

[br0ck]

well that was configured by a cisco support tech

AAA is the next step