Problems pinging 2 devices through VPN

[rolltidega]

I have a VPN tunnel setup between a customer's PIX and our SonicWALL. No problem. I can ping all the devices from both sides that I need to be able to ping EXCEPT 2. On my side, I cannot ping, telnet or do anything to the PIX internal address. On the customer side, I cannot ping or access the SonicWALL internal address. The VPN tunnel terminates at these devices. Any ideas? The PIX config (with some minor changes) is posted below:

PIX Version 5.3(1)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password XwzhbawvAF4Lggvm encrypted
passwd XwzhbawvAF4Lggvm encrypted
hostname ACME-pix
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
names
access-list pixtosw permit ip 172.20.xxx.0 255.255.255.0 10.xxx.yyy.0 255.255.255.0
pager lines 24
no logging on
interface ethernet0 auto
interface ethernet1 auto
mtu outside 1500
mtu inside 1500
ip address outside ww.xx.yyy.162 255.255.255.240
ip address inside 172.20.xxx.254 255.255.0.0
ip audit info action alarm
ip audit attack action alarm
arp timeout 14400
global (outside) 1 ww.xx.yyy.163 netmask 255.255.255.240
nat (inside) 0 access-list pixtosw
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) ww.xx.yyy.164 172.20.xxx.251 netmask 255.255.255.255 0 0
static (inside,outside) ww.xx.yyy.165 172.20.xxx.250 netmask 255.255.255.255 0 0
conduit permit tcp host ww.xx.yyy.164 eq smtp any
conduit permit tcp host ww.xx.yyy.164 eq 3000 any
conduit permit tcp host ww.xx.yyy.164 eq 3001 any
conduit permit gre host ww.xx.yyy.165 any
conduit permit tcp host ww.xx.yyy.162 eq telnet host aa.bb.cc.2
conduit permit tcp host ww.xx.yyy.165 eq 1723 host aa.bb.cc.2
conduit permit icmp any any echo-reply
route outside 0.0.0.0 0.0.0.0 ww.xx.yyy.161 1
route inside 172.20.xx.0 255.255.255.0 172.20.xxx.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
url-server (inside) host 172.20.xxx.3 timeout 5 protocol TCP version 1
filter url http 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0
snmp-server host inside 10.xxx.yyy.2
no snmp-server location
no snmp-server contact
snmp-server community 5090-silver
snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
no sysopt route dnat
crypto ipsec transform-set strong esp-des esp-md5-hmac
crypto map tosonicwall 20 ipsec-isakmp
crypto map tosonicwall 20 match address pixtosw
crypto map tosonicwall 20 set peer aa.bb.cc.4
crypto map tosonicwall 20 set transform-set strong
crypto map tosonicwall interface outside
isakmp enable outside
isakmp key ******** address aa.bb.cc.4 netmask 255.255.255.255
isakmp identity address
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption des
isakmp policy 20 hash md5
isakmp policy 20 group 1
isakmp policy 20 lifetime 28800
telnet 172.20.xx.250 255.255.255.255 inside
telnet timeout 5
ssh timeout 5
terminal width 80

 

[yizhar]

HI.

The PIX will never let you access the internal address from the outside interface, and vice versa.
This is by design.

I guess that the SonicWall has similar policy but I don't know this product.

Here are some alternate options to access the pix (same principals will probably work the other way also):

* Set up a terminal or telnet server on the pix inside network, and use it to access the pix from inside.

* Allow SSH or PDM directly to the pix outside interface from the registered ip address of your (sonicwall) side.

* Configure the VPN tunnel to also encrypt traffic destined to the pix outside interface, and then you'll be able to telnet to the pix outside ip address.
This is a bit more complex to establish so better try other solutions first.

* Do you realy need to access the pix from the outside?
If not, simply keep it the way it is which is more secure for the client.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar