PIX515E VPN NT DOMAIN

[AldoE]

Need help setting up a VPN with a Cisco PIX 515E. We've successfully been able to connect to the inside of our network but but we can't authenticate on the NT Domain.

Our Inside network is 10.1.1.0/24
Our VPN ip-pool is 10.1.2.0/24
Gateway is 10.1.1.1
Domain Server 10.1.1.5 NT4.0 Server
Cisco VPN Client 3.6 on Windows 98 (Remote Clients)


When we're connected (vpn) to our network we can ping the server 10.1.1.5 but we cannot see other computers or logon to the domain.

Any help would be greatly appreciated

PIX 515E 6.2.2

 

[Amanajaku]

Now, I dont have any expience with the PIX or doing this with Cisco, but we just accomplished this feat with 2k workstations and a 2k server, over Netopia routers.

A few things to throw out there to you

WINS.. Do you have it installed?
DNS is needed, but in this senario, I have never got it to resolve domain names over a VPN tunnel.

You need some sort of netbios resolution. For us there was an option called "netBios proxy" and that worked for us.

LMHOSTS file should do it just fine. Have you looked for anything on Cisco's site?

Amana

 

[AldoE]

We just installed wins server on the Primary Domain Controller. We do not have DNS in our LAN.

About the LMHOSTS how would that entry look like? Do i have to specify the domain name or the server name?

 

[ecowarrior]

access to lan is done by access-list please post you config

 

[XFactor]

I'm not any expert but I've seen issues with PIX and VPN, the problem was with the Consentrator on the server & client side that needed updating. The problem I saw this with was the user was able to get onto the network but couldn't send over 200K for his e-mail.

This maybe something to look into

 

[yizhar]

HI.

LMHOSTS should do the trick.

Simply look at the file:
C:\WINDOWS\LMHOSTS.SAM
on your W98 workstation and you'll get the idea.

You'll need to put the customized LMHOSTS file (with no extension!) in the WINDOWS folder of remote VPN clients.
Computers on the phisical LAN does not need it.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[EddieVenus]

I agree with Yizhar, you need to put the PDC, i.e the WINS server, at least into a lmhosts file (with no extension) into the proper folder of all VPN users ( win98 is c:\windows , 2k and XP are windows(or winNT)\system32\drivers\etc).
Go here for more info on LMHOSTS files

http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q150800&

this should do the trick, but if not, be careful in posting your config, of course do not post sensitive info. But the config might be of use to us if there is a problem with it. Really though you should call the TAC about this, they can resolve it much faster than most people here, not that most people hear are not good, but that is the Cisco TAC agents job and all.