Thats the runing config on server side
PIX Version 7.2(2)
!
hostname mvdpix
domain-name moi.az
enable password GkV2YTGaaxu.Wkmk encrypted
names
!
interface Ethernet0
nameif outside
security-level 0
ip address 192.168.1.253 255.255.255.0
!
interface Ethernet1
nameif inside
security-level 100
ip address 172.18.1.253 255.255.255.0
!
interface GigabitEthernet0
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1
shutdown
no nameif
no security-level
no ip address
!
passwd lOkyEYAclKI9EQQq encrypted
ftp mode passive
dns server-group DefaultDNS
domain-name moi.az
same-security-traffic permit inter-interface
object-group network outside_vpn
network-object 172.18.110.0 255.255.255.0
access-list ezvpn1 extended permit ip 172.18.1.0 255.255.255.0 172.18.110.0 255.255.255.0
access-list no-nat extended permit ip 172.18.1.0 255.255.255.0 172.18.110.0 255.255.255.0
access-list inside_access_in extended permit icmp 172.18.1.0 255.255.255.0 object-group outside_vpn
access-list outside_access_in extended permit icmp any 172.18.1.0 255.255.255.0
access-list outside_access_in extended permit icmp object-group outside_vpn 172.18.1.0 255.255.255.0
access-list outside_access_in extended permit ip 172.18.110.0 255.255.255.0 172.18.1.0 255.255.255.0
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
ip local pool mvdpool 172.18.1.150-172.18.1.200 mask 255.255.255.0
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image flash:/asdm-522.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list no-nat
nat (inside) 1 0.0.0.0 0.0.0.0
access-group outside_access_in in interface inside
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 192.168.1.253 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
group-policy amas internal
group-policy amas attributes
vpn-tunnel-protocol IPSec
nem enable
username userxin password teXV.t9n5/RNsrWk encrypted privilege 3
http server enable
http 192.168.1.240 255.255.255.255 outside
http 172.18.1.240 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto dynamic-map outside_dyn_map 20 set pfs
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption des
hash md5
group 2
lifetime 86400
crypto isakmp policy 65535
authentication pre-share
encryption des
hash sha
group 2
lifetime 86400
tunnel-group amas type ipsec-ra
tunnel-group amas general-attributes
address-pool mvdpool
default-group-policy amas
tunnel-group amas ipsec-attributes
pre-shared-key *
telnet 172.18.1.0 255.255.255.0 inside
telnet 0.0.0.0 0.0.0.0 outside
telnet timeout 5
ssh timeout 5
console timeout 0
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:8319b607dee510c545800b7291e829f1
: end
And this is client site
Building configuration...
: Saved
:
PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname xin
domain-name ciscopix.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 192.168.1.250 255.255.255.0
ip address inside 172.18.110.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location 172.18.110.0 255.255.255.0 inside
pdm location 172.18.100.0 255.255.255.0 outside
pdm location 172.18.1.0 255.255.255.0 outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
route outside 0.0.0.0 0.0.0.0 192.168.1.250 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 172.18.110.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
vpnclient server 192.168.1.253
vpnclient mode network-extension-mode
vpnclient vpngroup mvd password ********
vpnclient username user password ********
vpnclient enable
terminal width 80
Cryptochecksum:87ba50c31927ad2bd070e2862e4f59d6
: end
[OK]
When I trying to ping or browse network 172.18.1.0 I cant rich it, at 525 i used debug icmp trace and that's the output
mvdpix(config)# ICMP echo request from outside:172.18.110.2 to inside:172.18.1.1 ID=768 seq=15872 len=32
ICMP echo request from outside:172.18.110.2 to inside:172.18.1.1 ID=768 seq=16128 len=32
ICMP echo request from outside:172.18.110.2 to inside:172.18.1.1 ID=768 seq=16384 len=32
ICMP echo request from outside:172.18.110.2 to inside:172.18.1.1 ID=768 seq=16640 len=32
but i can't recieve reply. I used packet-tracer at pix 525 and have this result (see atachment)
pls help
PIX Version 7.2(2)
!
hostname mvdpix
domain-name moi.az
enable password GkV2YTGaaxu.Wkmk encrypted
names
!
interface Ethernet0
nameif outside
security-level 0
ip address 192.168.1.253 255.255.255.0
!
interface Ethernet1
nameif inside
security-level 100
ip address 172.18.1.253 255.255.255.0
!
interface GigabitEthernet0
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1
shutdown
no nameif
no security-level
no ip address
!
passwd lOkyEYAclKI9EQQq encrypted
ftp mode passive
dns server-group DefaultDNS
domain-name moi.az
same-security-traffic permit inter-interface
object-group network outside_vpn
network-object 172.18.110.0 255.255.255.0
access-list ezvpn1 extended permit ip 172.18.1.0 255.255.255.0 172.18.110.0 255.255.255.0
access-list no-nat extended permit ip 172.18.1.0 255.255.255.0 172.18.110.0 255.255.255.0
access-list inside_access_in extended permit icmp 172.18.1.0 255.255.255.0 object-group outside_vpn
access-list outside_access_in extended permit icmp any 172.18.1.0 255.255.255.0
access-list outside_access_in extended permit icmp object-group outside_vpn 172.18.1.0 255.255.255.0
access-list outside_access_in extended permit ip 172.18.110.0 255.255.255.0 172.18.1.0 255.255.255.0
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
ip local pool mvdpool 172.18.1.150-172.18.1.200 mask 255.255.255.0
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image flash:/asdm-522.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list no-nat
nat (inside) 1 0.0.0.0 0.0.0.0
access-group outside_access_in in interface inside
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 192.168.1.253 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
group-policy amas internal
group-policy amas attributes
vpn-tunnel-protocol IPSec
nem enable
username userxin password teXV.t9n5/RNsrWk encrypted privilege 3
http server enable
http 192.168.1.240 255.255.255.255 outside
http 172.18.1.240 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto dynamic-map outside_dyn_map 20 set pfs
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption des
hash md5
group 2
lifetime 86400
crypto isakmp policy 65535
authentication pre-share
encryption des
hash sha
group 2
lifetime 86400
tunnel-group amas type ipsec-ra
tunnel-group amas general-attributes
address-pool mvdpool
default-group-policy amas
tunnel-group amas ipsec-attributes
pre-shared-key *
telnet 172.18.1.0 255.255.255.0 inside
telnet 0.0.0.0 0.0.0.0 outside
telnet timeout 5
ssh timeout 5
console timeout 0
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:8319b607dee510c545800b7291e829f1
: end
And this is client site
Building configuration...
: Saved
:
PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname xin
domain-name ciscopix.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 192.168.1.250 255.255.255.0
ip address inside 172.18.110.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location 172.18.110.0 255.255.255.0 inside
pdm location 172.18.100.0 255.255.255.0 outside
pdm location 172.18.1.0 255.255.255.0 outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
route outside 0.0.0.0 0.0.0.0 192.168.1.250 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 172.18.110.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
vpnclient server 192.168.1.253
vpnclient mode network-extension-mode
vpnclient vpngroup mvd password ********
vpnclient username user password ********
vpnclient enable
terminal width 80
Cryptochecksum:87ba50c31927ad2bd070e2862e4f59d6
: end
[OK]
When I trying to ping or browse network 172.18.1.0 I cant rich it, at 525 i used debug icmp trace and that's the output
mvdpix(config)# ICMP echo request from outside:172.18.110.2 to inside:172.18.1.1 ID=768 seq=15872 len=32
ICMP echo request from outside:172.18.110.2 to inside:172.18.1.1 ID=768 seq=16128 len=32
ICMP echo request from outside:172.18.110.2 to inside:172.18.1.1 ID=768 seq=16384 len=32
ICMP echo request from outside:172.18.110.2 to inside:172.18.1.1 ID=768 seq=16640 len=32
but i can't recieve reply. I used packet-tracer at pix 525 and have this result (see atachment)
pls help
