Setting up 3.5 VPN client to PIX 515 1

[bleddyn]

Hi I seem to be having some problems setting up the 3.5 VPN client through to a PIX 515.

I have followed the details on the page

http://www.cisco.com/warp/public/110/pix3000.html#configs

which talks about the 3000 client but I presume this is not that different from the 3.5 client setup? I used that config and can now connect but I have a few issues.

In all the CISCO samples they seem to use 10.X.X.X addresses but on my 515 I have three nics. The DMZ is in a 192.168.100.X address range and internaly I am in a 192.168.1.X range. So I created a group for the VPN clients in a 192.168.3.X range is that OK?

When I login it assigns a 192.168.3.X address to the client but when I try and do things I am seeing error messages when I try and access the DMZ.

Deny inbound tcp source outside 192.168.3.1/1123 dst dmz/Hostname/port

I added an access rule to avoid NAT saying 192.168.3.0 255.255.255.0 192.168.100.0 255.255.255.0 ,although when I see this in the PDM client it says its a NULL rule?

So what am I missing why are packets getting denied? I tried adding a specific rule for 192.168.3.1 and it still dropped packets I think its possibly me not understanding the setup

COuld I have assigned some of my 192.168.1.X addresses to the group instead of using a 192.168.3.X group?

Sorry if this sounds a bit confusing its how I feel

Thanks Bleddyn

 

[yizhar]

HI.

>>> So I created a group for the VPN clients in a 192.168.3.X range is that OK?

Yes, that should be OK.

>>> Deny inbound tcp source outside 192.168.3.1/1123 dst dmz/Hostname/port

Remember that VPN clients are considered coming from the outside interface of the pix, so they must have an access list statement like:
access-list .... permit ip 192.168.3.0 255.255.255.0 ...
*OR instead*
sysopt connection permit-ipsec

>>> I added an access rule to avoid NAT saying 192.168.3.0 255.255.255.0 192.168.100.0 255.255.255.0 ,although when I see this in the PDM client it says its a NULL rule?

PDM does not (yet?) support nat 0 nor other VPN related options, so it can only ignore them.


You can build a working VPN configuration with pixcript, then modify it manualy for your exact needs:

http://teachers.sivan.co.il/yizhar#pixcript

Bye


Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar