PIX501 VPN Frustration

[QCumber]

Hi there,

firstly, an apology for posting about a problem that's already been discussed in earlier threads. Namely, accessing network resources through a PIX 501 VPN.

I've been dropped in at the VERY deep end, I've recently started a new job and one of my first tasks is to setup a new leased line / VPN solution based around a PIX 501. I have no previous Cisco experience either.

I have the firewall running, allowing everything out, and very little in. I can connect to the PIX using the native XP VPN client, and get authenticated (PIX administered ID's & P/W), and issued a PIX DHCP address and there everything stops. No browsing, pinging, nothing.

Looking through other threads, I've seen others with similar problems and have tried to copy the configs provided. That too causes problems because when I enter commands such as "access-list 101 permit ip........" the PDM utility just gives "unparsed command" errors. Trying to "map" simple ACL names that others use (such as 101) to the long names PDM creates by default is VERY frustrating!

The config below is currently running on the box, there are almost certainly bits in there I don't need that are left over from my frantic efforts to get the damn thing working!

Constructive comments greatly appreciated

TIA.

PIX Version 6.2(2)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password XXXXXXXX encrypted
passwd XXXXXXXX encrypted
hostname firewall
domain-name here.com
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
name 192.168.1.0 Remote_VPN
access-list outside_access_in permit icmp any any echo-reply
access-list inside_outbound_nat0_acl permit ip any 192.168.1.192 255.255.255.224
access-list inside_outbound_nat0_acl permit ip any 192.168.0.0 255.255.255.0
access-list outside_cryptomap_dyn_20 permit ip any 192.168.1.192 255.255.255.224
pager lines 24
logging on
interface ethernet0 10baset
interface ethernet1 10full
mtu outside 1500
mtu inside 1500
ip address outside 81.101.xxx.xxx 255.255.255.192
ip address inside 192.168.1.19 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool Dialin 192.168.0.1-192.168.0.254
pdm location 192.168.1.20 255.255.255.255 inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 81.101.xxx.xxx-81.101.xxx.xxx netmask 255.255.255.192
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) 192.168.1.3 192.168.1.3 netmask 255.255.255.255 0 0
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 81.101.xxx.xxx 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http Remote_VPN 255.255.255.0 inside
http 192.168.1.29 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community public
snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
sysopt connection permit-pptp
sysopt connection permit-l2tp
no sysopt route dnat
crypto ipsec transform-set TRANS_ESP_DES_SHA esp-des esp-sha-hmac
crypto ipsec transform-set TRANS_ESP_DES_SHA mode transport
crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20
crypto dynamic-map outside_dyn_map 20 set transform-set TRANS_ESP_DES_SHA
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
isakmp enable outside
isakmp key ******** address 0.0.0.0 netmask 0.0.0.0
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption des
isakmp policy 20 hash sha
isakmp policy 20 group 1
isakmp policy 20 lifetime 86400
telnet timeout 20
ssh timeout 5
vpdn group PPTP-VPDN-GROUP accept dialin pptp
vpdn group PPTP-VPDN-GROUP ppp authentication mschap
vpdn group PPTP-VPDN-GROUP ppp encryption mppe auto
vpdn group PPTP-VPDN-GROUP client configuration address local Dialin
vpdn group PPTP-VPDN-GROUP client configuration dns 194.168.xxx.xxx 194.168.xxx.xxx
vpdn group PPTP-VPDN-GROUP client configuration wins 192.168.1.1
vpdn group PPTP-VPDN-GROUP pptp echo 60
vpdn group PPTP-VPDN-GROUP client authentication local
vpdn username simon password ********
vpdn enable outside
terminal width 80

 

[yizhar]

HI.

I suggest starting from scratch in your case, and use only one method for VPN (Cisco IPSec VPN should be preferred over PPTP, but requires installation of the client on the remote machine).
Connect a serial console cable, then issue the "write erase" command followed by a "reload".

Some comments regarding the current configuration:

> static (inside,outside) 192.168.1.3 192.168.1.3 netmask 255.255.255.255 0 0
This should be removed, or the 192.168.1.3 will not be able to access the Internet with private ip address.

> access-list inside_outbound_nat0_acl permit ip any 192.168.0.0 255.255.255.0
Should be removed.

> ip local pool Dialin 192.168.0.1-192.168.0.254
Many small networks use the 192.168.0.x which may cause conflicts in the future. Better choose something else like 192.168.222.X

> isakmp policy 20 hash sha
Use MD5 instead (the DES+SHA combination is not compatible with newer Cisco VPN clients).

> vpdn group PPTP-VPDN-GROUP client configuration dns 194.168.xxx.xxx 194.168.xxx.x
There is a typo mistake here - should be 192.168.x.x

> access-list outside_cryptomap_dyn_20 permit ip any 192.168.1.192 255.255.255.224
This is wrong, and should be something like:
access-list outside_cryptomap_dyn_20 permit ip 192.168.1.0 255.255.255.0 192.168.0.0 255.255.255.0

* You don't have any "vpngroup" commands to work with Cisco IPSec VPN client.
Yes I know that you worked primarily on PPTP (VPDN) connections, but if you're switching to Cisco IPSec then you'll need the "vpngroup" commands.

> isakmp key ******** address 0.0.0.0 netmask 0.0.0.0
No need for the above line. It is for older obsolete VPN clients.
Nowadays you should use "vpngroup ... password ..." instead.


Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[QCumber]

Hi Yizhar,

many thanks for the suggestions. I think you're right, starting again from scratch will be the best idea!

Q.

 

[QCumber]

Hi yizhar,

As suggested, I reconfigured the PIX from scratch and configured the VPN settings for Cisco VPN Client which is much easier to set up

I connect and get authenticated OK, but still can't access (ping) the internal network. As a test a added (and removed) rules allowing any protocol from 192.168.111.x (the DHCP pool on the pix) into the network, but still couldn't access the LAN. The "allow local lan access" box is ticked on the VPN client, but I guess I'm missing the corresponding setting at the PIX end.

I'd appreciate it if you could have another look over the config. Oh the DNS servers are 194.168.x.x - they are our ISP's servers.

Again, many thanks for your help with this.

PIX Version 6.2(2)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password XXXXXXXXX encrypted
passwd XXXXXXXXXX encrypted
hostname firewall
domain-name here.com
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
name 192.168.1.0 Remote_VPN
access-list outside_access_in permit icmp any any echo-reply
access-list inside_outbound_nat0_acl permit ip any 192.168.1.192 255.255.255.224
access-list inside_outbound_nat0_acl permit ip any 192.168.111.0 255.255.255.0
access-list outside_cryptomap_dyn_20 permit ip any 192.168.111.0 255.255.255.0
access-list Mynet_splitTunnelAcl permit ip Remote_VPN 255.255.255.0 any
pager lines 24
logging on
interface ethernet0 10baset
interface ethernet1 10full
mtu outside 1500
mtu inside 1500
ip address outside 81.101.xxx.xxx 255.255.255.192
ip address inside 192.168.1.19 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool Remote 192.168.111.1-192.168.111.254
pdm location 192.168.1.20 255.255.255.255 inside
pdm location 192.168.1.29 255.255.255.255 inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 81.101.xxx.xxx-81.101.xxx.xxx netmask 255.255.255.192
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 81.101.xxx.xxx 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 192.168.1.20 255.255.255.255 inside
http Remote_VPN 255.255.255.0 inside
http 192.168.1.29 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community public
snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
sysopt connection permit-pptp
sysopt connection permit-l2tp
no sysopt route dnat
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map outside_dyn_map_1 20 match address outside_cryptomap_dyn_20
crypto dynamic-map outside_dyn_map_1 20 set transform-set ESP-3DES-MD5
crypto map outside_map_1 65535 ipsec-isakmp dynamic outside_dyn_map_1
crypto map outside_map_1 interface outside
isakmp enable outside
isakmp policy 20 authentication rsa-sig
isakmp policy 20 encryption des
isakmp policy 20 hash sha
isakmp policy 20 group 1
isakmp policy 20 lifetime 86400
isakmp policy 40 authentication pre-share
isakmp policy 40 encryption 3des
isakmp policy 40 hash md5
isakmp policy 40 group 2
isakmp policy 40 lifetime 86400
vpngroup Mynet address-pool Remote
vpngroup Mynet dns-server 194.168.xxx.xxx 194.168.xxx.xxx
vpngroup Mynet wins-server 192.168.1.1
vpngroup Mynet default-domain here.com
vpngroup Mynet split-tunnel Mynet_splitTunnelAcl
vpngroup Mynet idle-time 1800
vpngroup Mynet password ********
telnet 192.168.1.20 255.255.255.255 inside
telnet 192.168.1.29 255.255.255.255 inside
telnet timeout 20
ssh timeout 5
terminal width 80

 

[yizhar]

HI.

> access-list inside_outbound_nat0_acl permit ip any 192.168.1.192 255.255.255.224
> access-list inside_outbound_nat0_acl permit ip any 192.168.111.0 255.255.255.0
> nat (inside) 0 access-list inside_outbound_nat0_acl

Try this instead:
no access-list inside_outbound_nat0_acl
access-list inside_outbound_nat0_acl permit ip 192.168.1.0 255.255.255.0 192.168.111.0 255.255.255.0
nat (inside) 0 access-list inside_outbound_nat0_acl

If it still does not work, check also the split-tunnel configuration.

> name 192.168.1.0 Remote_VPN
This is confusing - 192.168.1.0 is your private network.

> isakmp policy ...
I suggest defining a single policy that you're going to use, instead of multiple options, unless neccessary.

> logging on
Add logging to buffer/pdm/syslog at level 4 to get some info from your pix. syslog server is the best choice because it can keep messages history.

Bye


Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar