PIX 501 VPN Wizard

[mbarrett03]

Hi - this is my first attempt to setup a PIX501 for VPN access and thus far I am failing miserably. I am able to authenticate to the PIX using Cisco's VPN client - however I am not able to access any devices on the internal network. As far as I can tell, the PIX DHCP pool is giving me an acceptable IP address, 192.168.1.50, but the default gateway is the same (.50). Surely this can't be right. I walked through the VPN wizard again (through the PDM) from scratch and get the same results. I also can't figure out where in the VPN config via the PDM the default gateway is set. Could anyone help?

Thanks in advance.

 

[fdurham]

mbarrett-

This is a personal recommendation; I would learn to use the cli, before using PDM. The reason behind it is PDM, someimes does some strang things to your configs, that is hard to decipher. If you are setting up an IPSEC vpn, here is a template to follow via client.

172.16.0.0/16 network is protected traffic
192.168.10.0/24 network is your DHCP VPN Traffic

access-list 102 permit ip 172.16.0.0 255.255.0.0 192.168.10.0 255.255.255.0
access-list nonat permit ip 172.16.0.0 255.255.0.0 192.168.10.0 255.255.255.0

nat (vpn) 0 access-list nonat

ip local pool sei-1 192.168.10.10-192.168.10.100

crypto ipsec transform-set vpn0 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set vpn2 esp-des esp-md5-hmac
crypto dynamic-map dynmapsei 10 set transform-set vpn0 vpn2

crypto map vpn 10 ipsec-isakmp dynamic dynmapsei
crypto map vpn client configuration address initiate
crypto map vpn client configuration address respond
crypto map vpn interface <name_of_outside_interface>

isakmp enable <name_of_outside_interface>
isakmp client configuration address-pool local sei-1 internet
isakmp nat-traversal 20
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption aes-256
isakmp policy 10 hash md5
isakmp policy 10 group 5
isakmp policy 10 lifetime 86400
isakmp policy 15 authentication pre-share
isakmp policy 15 encryption aes-256
isakmp policy 15 hash md5
isakmp policy 15 group 2
isakmp policy 15 lifetime 86400
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption des
isakmp policy 20 hash md5
isakmp policy 20 group 1
isakmp policy 20 lifetime 1000

vpngroup <nameofgroup> address-pool sei-1
vpngroup <nameofgroup> dns-server 172.16.xxx.xxx
vpngroup <nameofgroup> wins-server 172.16.xxx.xxx
vpngroup <nameofgroup> default-domain domain.com
vpngroup <nameofgroup> split-tunnel 102
vpngroup <nameofgroup> split-dns domain.com
vpngroup <nameofgroup> idle-time 3600
vpngroup <nameofgroup> password ********

That should get you basic secure VPN Access...

Frank