Pix506e volunteer newbie needs config help

[dlfeller]

^^^ This "IT mgmt" is a lie - but couldnt decide what else to pick - eeek

Long story short, I "volunteered" to help with IT at my Church. Happened to have a pix laying around, so to "solidify" the internet connection and give me remote access I thought I'd throw it in.

Good news is I've got it up and running - mostly. I still have a small series of questions:

1) It has sat for about 4 years and while it came up right away, it was "flaky" - locking up randomly - console and all ports. After resetting everything to default settings with no change, I opened it up, reset the bios (jumper), reseated the memory and processor and all seems to be good now (the serial is NOT in the recall range) - any thoughts on whether yall think it "might" be stable or I should go buy another? (I'm asking a lot with little info, just curious about opinions)

2) I set it up at home in a simple configuration between my laptop (wired to Pix) and my home network for testing. Got a basic configuration, running PDM via browser, figured out how to set static IP and set static route from any inside to outside port - (Yeah I'm sure that is simple for everyone but it took me hours of reading posts to figure out I had to set a route if I set a hard IP address. - BUT, While I have VPN "working" - I can connect a remote client (another laptop wireless at home) to the PIX using Cisco VPN client, it cannot see anything inside - I want to be able to see all internal hosts AND be able to run PDM over VPN so I don't have to open the external interface to PDM. Also, I'd prefer to be able to access servers by name instead of just IP address.

I read that the proper vpn setup is to use a different subnet for the vpn pool and put in an access-list and nat permit - but I've got something wrong.

The preferred configuration is

199.45.162.6
Qwest DSL modem fixed IP
|
Pix 506e
192.168.0.240
192.168.0.130-230 dynamic 192.168.10.x vpnpool
192.168.0.1-10 some fixed

Note that in my home, I'm using 192.168.2.80 as the outside fixed for testing...

When connecting via Cisco VPN client - the client gets an IP of 192.168.10.1 and a gateway of 192.168.10.1 (strange)

My configuration is below - VPN'd folks can't see my laptop which got 192.168.0.130 or the internal 192.168.0.240 interface of the PIX to run PDM.

3) Last question - on the Qwest DSL modem/firewall, it is currently (pre-pix) set up NOT running DHCP, but it NATs - its internal IP is 192.168.0.2 - So I assume I just turn off NAT and the external static IP "comes through" to the PIX?

Much thanks in advance for the help - I've been configuring/playing via console, telnet, and PDM - just getting something wrong.

Building configuration...
: Saved
:
PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password jKwiV1rq7Lq42I5R encrypted
passwd jKwiV1rq7Lq42I5R encrypted
hostname calvaryfirewall
domain-name CALVARY
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list inside_outbound_nat0_acl permit ip any 192.168.10.0 255.255.255.128
access-list outside_cryptomap_dyn_20 permit ip any 192.168.10.0 255.255.255.128
access-list nonat permit ip 192.168.0.0 255.255.255.0 192.168.10.0 255.255.255.0
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 192.168.2.80 255.255.255.0
ip address inside 192.168.0.240 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool calvpnpool 192.168.10.1-192.168.10.100
pdm location 192.168.0.0 255.255.0.0 inside
pdm location 192.168.10.0 255.255.255.0 outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list nonat
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
route outside 0.0.0.0 0.0.0.0 192.168.2.1 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 192.168.0.0 255.255.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
isakmp enable outside
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup calvpn address-pool calvpnpool
vpngroup calvpn dns-server 8.8.8.8 8.8.4.4
vpngroup calvpn idle-time 1800
vpngroup calvpn password ********
telnet 192.168.0.0 255.255.0.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.0.130-192.168.0.220 inside
dhcpd dns 8.8.8.8 8.8.4.4
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
dhcpd enable inside
terminal width 80
Cryptochecksum:ca885ac82ade443587e14e41088b320a
: end
[OK]

One only realizes how far one is over one's head when one "volunteers"...
David

 

[unclerico]

1) it will probably be fine, but if you want to replace it go with a Cisco ASA.
2) multiple things:
first, set the DSL modem in bridge mode and configure the outside interface of the PIX to use the pppoe client.

ip address outside 199.45.162.6 <mask>

vpdn group <vpdn_group_name> request dialout pppoe
vpdn group <vpdn_group_name> local name <qwest_provided_user_name>
vpdn group <vpdn_group_name> ppp authentication pap | chap
vpdn username <qwest_provided_user_name> password <qwest_provided_password>

second, change the default route to point to the Qwest next hop
third, remove this line

crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20

fourth, if you want name resolution then you need to configure a couple of things:

vpngroup calvpn dns-server <internal_dns_server>
vpngroup calvpn default-domain <church_dns_domain_name>

note that in this configuration you do not have split-tunneling enabled so you will lose connectivity to your local network and all traffic will go through the vpn.

try that and post back with any new issues.

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[dlfeller]

Excellent -
Putting the modem in bridge mode seems to translate (on the GUI) to turning off NAT.

For the purposes of testing (at home) I'll stash your instructions on setting up the PPPOE till I actually install at Church if that is OK - excellent instructions by the way!

The current route

route outside 0.0.0.0 0.0.0.0 192.168.2.1 1

points to my Comcast modem/router at the house - seems like that is equivalent. (And for testing, I have no internal DNS at home, so I set it to the Google open DNS 8.8.8.8 ) Once I'm a but more confident I'll take it to Church late at night and do the "real" setup.

removed the crypto line

Now, when VPNing in (from another laptop on my home net "outisde" the pix - pointing at 192.168.2.80 (the pix outside IP), the client connects. I can put \\192.168.0.130 in an explorer window and browse my laptop (behind pix).

It would not ping however - strange.

Remote desktop would connect using the IP address(192.168.0.130) but not the computer name dfellert42p which will not work for church as all the clients are on dhcp and all I know are their names.

Also , from the VPNd client, it would not open PDM from a browser pointed to

https://192.168.0.240

So,
I added this line

http 192.168.10.0 255.255.255.0 inside

thinking I needed to open the http access to the VPN pool - didn't help. Client cannot PDM through VPN.

Also, question on "internal DNS" - as the Church is "unmanned" I wanted to move DHCP to the Pix and use outside DNS (either qwest's or google) to keep internet access fro being dependent on a flaky server. Thinking the PIX should be more stable. If I do that do I lose internal name resolution - i.e. \\davidst42plaptop - or will windows addresses like that still work ok?

Client (VPNd) cannot resolve any names to ping (

http://www.yahoo.com)

or browse the internet - do I need another route to allow VPNd clients to "get out" like any other internal client?

Thanks again in advance -
David

 

[dlfeller]

Posting the changed config for reference.

Building configuration...
: Saved
:
PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password jKwiV1rq7Lq42I5R encrypted
passwd jKwiV1rq7Lq42I5R encrypted
hostname calvaryfirewall
domain-name CALVARY
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list inside_outbound_nat0_acl permit ip any 192.168.10.0 255.255.255.128
access-list outside_cryptomap_dyn_20 permit ip any 192.168.10.0 255.255.255.128
access-list nonat permit ip 192.168.0.0 255.255.255.0 192.168.10.0 255.255.255.0
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 192.168.2.80 255.255.255.0
ip address inside 192.168.0.240 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool calvpnpool 192.168.10.1-192.168.10.100
pdm location 192.168.0.0 255.255.0.0 inside
pdm location 192.168.10.0 255.255.255.0 outside
pdm location 192.168.10.0 255.255.255.0 inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list nonat
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
route outside 0.0.0.0 0.0.0.0 192.168.2.1 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 192.168.0.0 255.255.0.0 inside
http 192.168.10.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
isakmp enable outside
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup calvpn address-pool calvpnpool
vpngroup calvpn dns-server 8.8.8.8 8.8.4.4
vpngroup calvpn default-domain CALVARY
vpngroup calvpn idle-time 1800
vpngroup calvpn password ********
telnet 192.168.0.0 255.255.0.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.0.130-192.168.0.220 inside
dhcpd dns 8.8.8.8 8.8.4.4
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
dhcpd enable inside
terminal width 80
Cryptochecksum:6300cf79be8223650c772dacf87c8a55
: end
[OK]

 

[unclerico]

1) for remote PDM access enter management-access inside
2) check the 192.168.0.130 client firewall to make sure that you are permitting icmp traffic
3) so the clients at church are workgroup computers and not members of a domain??
4) to browse the internet while connected to the vpn, you need to add nat (outside) 1 192.168.10.0 255.255.255.128

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[dlfeller]

Making great progress...
The "management-access inside" fixed the access to PDM - exceptoinal (not sure how I missed that - set the http and thought that should be all)

I can now also ping the inside laptop and connect to it (remote desktop and windows explorer) with IP address but not by name (dfellert42p) either in windows explorer or remote desktop.

Church clients are about 90% domain and 10% workgroup. I guess I'm confused on browsing by name - does the DNS on server (internal) also keep track of computer names for browsing? Seems like back in the days that was wins. Just thought if I cant browse by name in my test setup it probably wont work there either - unless being on the domain changes things? And if so, what about those computers not on the domain?

Oh, and when I put that nat command in

nat (outside) 1 192.168.10.0 255.255.255.128

I get two "warning" errors -
WARNING: Binding inside nat statement to outermost interface.
WARNING: Keyword "outside" is probably missing.


dfeller

 

[unclerico]

good to hear!

yes, dns is used for name resolution now as opposed to wins. if you have an internal dns server on the domain and those 90% of clients are members of the domain, then they will register their A records (for resolving host names to ip addresses) and PTR records (for resolving ip addresses to host names) automatically and provide name resolution. for those 10% of clients that aren't on the domain, then you're going to see some success and some failure when it comes to name resolution. even in a perfect world windows systems don't always behave themselves. a couple of options:
1) you can use a combination of static ip addresses paired with host file entries.
2) you can move the dhcp server from the pix and onto the domain controller, create dhcp reservations for the workgroup computers, and then manually create A and PTR records in DNS

as for the errors that you are receiving, that's my bad. the 6.3 code doesn't allow nat loopback (traffic entering an interface and then exiting that same interface). your best bet is to configure split-tunneling and have all but the traffic destined for the vpn tunnel go out unencrypted like normal.

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[dlfeller]

Sweeet...

I am actually writing this from a client VPNs in - but with the split route enabled it is surfing in the clear.
(All the companies I've worked for have never had this enabled - I always had to connect/disconnect repeatedly to switch between internal/web tasks) - you are a King... I figured out how to implement via PDM...

I think my host resolution is simple to force - all laptops MUST be on the domain, desktops I can hard assign an IP if there is a good reason not to have them on there...

I'm thinking I like vnc instead of remote desktop for remote "helpdesk" - seems faster.

My next task is to load wdrt on a few access points to implement a guest network - my switches do not support vlan so I have to kludge it.

dfeller

 

[unclerico]

awesome!! i'm glad you have it working. your setup sounds just fine with me.



I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[dlfeller]

Unclerico:

I wonder if I could trouble you with one more request for "wise advice"... (I can go post this elsewhere if appropriate).

I'm running a Windows Small Business Server 2003 on a Dell poweredge platform - not bad 3GHz, lots of memory, stable. But looking into it, it is an all SCSI system - looks like 8 drives ranging in capacity from 60 to 300GB (mostly smaller ones) - no raid, just nice fast SCSI drives in what look like hot-swappable slots.

The server is almost exclusively for backup - there are a very few shared drives, but the folks here do not really use them - total of 5 or 6 in the office at any given time.

So my question is this - fast expensive SCSI drives in this application seem unjustified. I'm thinking of getting a couple of 1.5TB SATA drives, and a SATA raid mcie card and upgrading storage on the machine. Am I missing something - a reason to stick with SCSI?

dfeller

 

[unclerico]

Would you be retiring the box or repurposing it for a different role?? It doesn't sound like they pound on the box, so the SATA drives would be fine. Just make sure that the card supports RAID5 or, even better, RAID6.

Did everything else go smoothly with your changes??

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[dlfeller]

The qwest guy did not show up so I postponed putting in the firewall - figured I would do it all at once. Waiting on a reschedule now. Goobers. And another helper now wants to talk through turning the whole thing over to West for $1500/month - eek - think there are better uses of Church money than that myself.

On storage, I figured I'd just throw in a Raid 1 mirrored set of 1.5TB drives (In the heart of HDD country here, the test engineers are saying stay away from 2TB drives at all costs yet)... The controller I have (like the PIX, was laying in my basement for a few years) I do not think supports Raid 5 or 6. So I thought that if/when they need more than the 1.5TB between backup and a couple small shared folders, I could dump contents, add another 1.5TB drive, install a new controller and upgrade the Raid level.

Wondering if my reasoning seems at least "semi-sound"...

dfeller

 

[unclerico]

$1500/mo?? what is this guy thinking?? my only concern with rockin a mirror is the lack of partiy for rebuild in case one of the drives goes on the fritz.

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[dlfeller]

I need to go read some it seems - I thought that if one of the two drives in a mirror goes bad, you just replace it and on boot tell it to rebuild. But, I've never had to do it before. That's how I built my home server - now I'm worried about all my wife's pictures... eek.

In fact, I always assumed that you could take a drive out of a raid 1 mirror and run it stand alone but I suppose that does not make sense since one drive of the pair would be different than the other.

Nothing like some volunteering to force you to learn new things.

DF
bocsco

 

[unclerico]

a mirror will function when one goes bad, however, when you're dealing with backup data you want to have parity bits in place for data integrity sake.

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)