PIX 501 connects to VPN server but access is only one-way

[paulgami]

Having a few issues connecting a PIX501 to a Cisco 1700. The 1700 has been configured as a VPN server and has for months been working fine for remote users with the Cisco VPN Client software. I'm trying to get a "site to site" VPN working and have run into a brick wall. I'll paste the PIX config below. The network behind the 1700 is 10.10.10.x and the PIX dhcpd is giving out IPs in the 192.168.100.x range.

The tunnel "seems" ok as I can ping a host on the inside PIX interface from a host on the 1700 LAN. I can ping "some" hosts on the 1700 LAN from a host on the PIX inside interface. I can even view the PIX host's shares and transfer files across to here (behind the 1700). I can't, however, do any of that from a host on the PIX inside interface. I'm hoping it's just a silly routing issue but haven't messed much with Cisco stuff in the past so don't know too much about troubleshooting it.

ipconfig on a host on the inside PIX interface:
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 192.168.100.10
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.100.1
DHCP Server . . . . . . . . . . . : 192.168.100.1
DNS Servers . . . . . . . . . . . : 10.10.10.173
Primary WINS Server . . . . . . . : 10.10.10.163

Any ideas?

PIX config:

PIX Version 6.3(1)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password xxxx encrypted
passwd xxxx encrypted
hostname xxxx
domain-name xxxx
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
names
mtu outside 1500
mtu inside 1500
ip address outside x.x.x.x(public ip on same subnet as 1700 outside ip) 255.255.255.224
ip address inside 192.168.100.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm history enable
arp timeout 14400
route outside 0.0.0.0 0.0.0.0 x.x.x.x(1700 'outside' ip) 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.100.10-192.168.100.20 inside
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd option 150 ip 10.10.10.190
dhcpd enable inside
vpnclient server x.x.x.x(1700 'outside' ip)
vpnclient mode network-extension-mode
vpnclient vpngroup xxxx password xxxx
vpnclient username xxxx password xxxx
vpnclient enable
terminal width 80


pixfirewall# show access-list
access-list cached ACL log flows: total 0, denied 0 (deny-flow-max 256) alert-interval 300
access-list _vpnc_acl; 2 elements
access-list _vpnc_acl line 1 permit ip 192.168.100.0 255.255.255.0 any (hitcnt=23965)
access-list _vpnc_acl line 2 permit ip host x.x.x.x (outside PIX interface) any (hitcnt=108)
pixfirewall# show route
outside 0.0.0.0 0.0.0.0 x.x.x.x (outside 1700 interface) 1 OTHER static
outside x.x.x.x x.x.x.x (our t1 subnet) x.x.x.x (outside PIX interface) 1 CONNECT static
inside 192.168.100.0 255.255.255.0 192.168.100.1 1 CONNECT static


Just plugged a Cisco 7940 phone into the PIX and logged what was happening - was getting a lot of deny requests between the phone and CallManager (behind the 1700). syslogd is noting the phone unable to connect to CCM:
Deny TCP (no connection) from x.x.x.x/2000 (outside 1700 interface) to 192.168.100.11/51825 flags SYN ACK on interface outside

 

[paulgami]

Anyone?

 

[308win]

Looks like the traffic is getting blocked on the outside of the 1700.
Deny TCP (no connection) from x.x.x.x/2000 (outside 1700 interface) to 192.168.100.11/51825 flags SYN ACK on interface outside
Been a while since I have done a VPN with a router but as I recall traffic is sent through the acl on the router's interface after it is decrypted. Try adding a 'permit ip 192.168.100.0 255.255.255.0 any' statement to the ACL on the 1700.

You also might find 'debug icmp trace' helpful
You can see packets coming and going and if they are getting natted or not. With a complementary ACL on your 1700 you can trace the issue further.
through VPN, no nat
154: Inbound ICMP echo reply (len 72 id 19993 seq 9980) 192.168.85.1 > 10.3.6.3 > 10.3.6.3
155: Outbound ICMP echo request (len 72 id 20249 seq 9980) 10.3.6.3 > 10.3.6.3 > 192.168.85.1

internet traffic, the second address is the interface on the firewall
134: Outbound ICMP echo request (len 72 id 14614 seq 8558) 10.3.6.3 > 61.11.11.2 > 6.1.24.9
135: Inbound ICMP echo reply (len 72 id 2816 seq 8558) 6.1.24.9 > 61.11.11.2 > 10.3.6.3