Split-Tunnel not working

[eseabrook2008]

I'm new to PIX (and job) and need to solve an issue with our PIX. As far as I know, split-tunneling is setup but it is not working. When clients VPN in (using windows client), they can access the internet but not the network. If you check off "use default gateway on remote network" then you can access the network but not the internet. Below is the PIX config. Can anyone give me a hand. I've looked high and low and from what I've read, everything should be setup. I tried using a batch file to enter a static route on the laptop but I need to enter the IF and it changes everytime I connect to the VPN.

PIX Version 7.2(2)
!
interface Ethernet0
nameif outside
security-level 0
ip address xxx.xxx.xxx.xxx 255.255.255.0
ospf cost 10
!
interface Ethernet1
nameif inside
security-level 100
ip address 172.16.0.1 255.255.0.0
ospf cost 10
!
passwd iGGOjJAX0QuZN9ot encrypted
boot system flash:/pix722.bin
boot system flash:/image.bin
no ftp mode passive
clock timezone CST -6
dns server-group DefaultDNS
domain-name somewhere.COM
access-list nonat extended permit ip 172.16.0.0 255.255.0.0 10.10.10.0 255.255.255.0
access-list nonat extended permit ip any 192.168.0.0 255.255.255.192
access-list saskatoon extended permit ip 172.16.0.0 255.255.0.0 192.169.253.0 255.255.255.0
access-list acl_out extended permit tcp any interface outside eq smtp
access-list acl_out extended permit tcp any interface outside range ftp-data ftp inactive
access-list acl_out extended permit tcp any interface outside eq www
access-list acl_out extended permit tcp any interface outside eq https
access-list acl_out extended permit udp any host 204.83.200.72 eq 1701
access-list acl_out extended permit gre any host 204.83.200.72
access-list acl_in extended deny tcp any any eq 136
access-list acl_in extended deny tcp any any eq 137
access-list acl_in extended deny tcp any any eq 138
access-list acl_in extended deny tcp any any eq netbios-ssn
access-list acl_in extended deny udp any any eq 136
access-list acl_in extended deny udp any any eq netbios-ns
access-list acl_in extended deny udp any any eq netbios-dgm
access-list acl_in extended deny udp any any eq 139
access-list acl_in extended permit ip any any
access-list acl_in extended permit icmp any any
access-list test extended permit ip any any
access-list capin extended permit ip host 172.16.100.126 host 172.16.0.1
access-list capin extended permit ip host 172.16.0.1 host 172.16.100.126
access-list DefaultRAGroup_splitTunnelAcl standard permit any
access-list cap_in extended permit ip host 172.16.100.126 any
access-list split standard permit 172.16.0.0 255.255.0.0
pager lines 24
logging enable
logging timestamp
logging buffer-size 40000
logging monitor informational
logging trap debugging
logging history warnings
logging asdm errors
logging facility 23
logging host inside 172.16.0.98 17/1468
mtu outside 1500
mtu inside 1500
ip local pool VPNPool 10.10.10.1-10.10.10.250 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
asdm image flash:/asdm-522.bin
asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list nonat
nat (inside) 1 172.16.0.0 255.255.0.0
static (inside,outside) tcp interface smtp Email_Firewall smtp netmask 255.255.255.255
static (inside,outside) tcp interface

http://www 172.16.0.96

http://www netmask

255.255.255.255
static (inside,outside) tcp interface https 172.16.0.96 https netmask 255.255.255.255
access-group acl_out in interface outside
access-group acl_in in interface inside
route outside 0.0.0.0 0.0.0.0 204.83.200.254 1
timeout xlate 1:00:00
timeout conn 0:10:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
aaa-server ActiveDirectory protocol radius
aaa-server ActiveDirectory host 172.16.0.98
timeout 5
key smiradsecret
group-policy DefaultRAGroup internal
group-policy DefaultRAGroup attributes
wins-server value 172.16.0.98 172.16.0.96
dns-server value 172.16.0.98 172.16.0.96
vpn-tunnel-protocol IPSec l2tp-ipsec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value split
default-domain value somewhere.COM
group-policy DfltGrpPolicy attributes
banner none
wins-server value 172.16.0.98 172.16.0.96
dns-server value 172.16.0.98 172.16.0.96
dhcp-network-scope none
vpn-access-hours none
vpn-simultaneous-logins 3
vpn-idle-timeout 30
vpn-session-timeout none
vpn-filter none
vpn-tunnel-protocol IPSec l2tp-ipsec
password-storage disable
ip-comp disable
re-xauth disable
group-lock none
pfs disable
ipsec-udp disable
ipsec-udp-port 10000
split-tunnel-policy tunnelspecified
split-tunnel-network-list value split
default-domain none
split-dns none
intercept-dhcp enable
secure-unit-authentication disable
user-authentication disable
user-authentication-idle-timeout 30
ip-phone-bypass disable
leap-bypass disable
nem disable
backup-servers keep-client-config
msie-proxy server none
msie-proxy method no-modify
msie-proxy except-list none
msie-proxy local-bypass disable
nac disable
nac-sq-period 300
nac-reval-period 36000
nac-default-acl none
address-pools none
client-firewall none
client-access-rule none
group-policy vpn internal
group-policy vpn attributes
split-tunnel-policy tunnelspecified
split-tunnel-network-list value split
username somewhere_vpn password ZfsPqnEvQQSkO5RLLlMdcg== nt-encrypted
username cisco123 password U4DJrEXzXuJDX32C encrypted privilege 15
username cisco password pr/0i/BvQ65/uQPOewDuog== nt-encrypted privilege 15
username cisco attributes
vpn-group-policy DefaultRAGroup
vpn-tunnel-protocol l2tp-ipsec
aaa authentication ssh console LOCAL
http server enable
http 0.0.0.0 0.0.0.0 inside
no snmp-server location
no snmp-server contact
crypto ipsec transform-set TRANS_ESP_3DES_SHA esp-3des esp-sha-hmac
crypto ipsec transform-set TRANS_ESP_3DES_SHA mode transport
crypto dynamic-map outside_dyn_map 20 set transform-set TRANS_ESP_3DES_SHA
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp nat-traversal 20
tunnel-group DefaultRAGroup general-attributes
address-pool VPNPool
authentication-server-group ActiveDirectory LOCAL
authorization-server-group LOCAL
default-group-policy DefaultRAGroup
tunnel-group DefaultRAGroup ipsec-attributes
pre-shared-key *
isakmp keepalive disable
tunnel-group DefaultRAGroup ppp-attributes
no authentication chap
telnet 0.0.0.0 0.0.0.0 inside
telnet timeout 15
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 60
ssh version 1
console timeout 0
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns migrated_dns_map_1
parameters
message-length maximum 4096
policy-map global_policy
class inspection_default
inspect dns migrated_dns_map_1
inspect ftp strict
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
inspect http
inspect ils
!
service-policy global_policy global
ntp server 142.3.100.2 source outside prefer
ntp server 142.3.100.15 source outside
prompt hostname context
Cryptochecksum:f8166a1052e288061ee0e688710bda13
: end
asdm image flash:/asdm-522.bin
asdm history enable

 

[eseabrook2008]

And the PIX shows:

QM FSM error (P2 struct &0x2b9be58, mess id 0xa8a58b50)!

 

[NetworkGhost]

Which version of the VPN client are you using? I think you will need at least 4.9 or greater to get around this.

http://www.wr-mem.com

 

[eseabrook2008]

I'm using version 5.0 BUT, had to download this from someone's site as I couldn't find an install disc anywhere.

What happens is:

The VPN Client Notification window shows:
Negotiating security policies...
Securing communications channel...
Secure VPN Connection terminated locally by the Client.
Reason 401: An unrecognized error occured while establishing the VPN connection.

The VPN Client Log shows:
Sev=Warning/3 IKE/0xA2000006C
General Error while processing Browser Proxy Configuration.

The PIX Syslog shows:
PHASE 1 COMPLETED
QM FSM error (P2 struct....)
Removing peer from correlator table failed, no match!

I'm not sure where it's getting the Browser Proxy config info from because the only place I can find a reference to a proxy server is in the MS Client Parameters tab but that's set to Do Not use Proxy (and I'm not using the MS client anyways).

A huge THANK YOU goes out to NetworkGhost and garnetbobcat for helping me get to this point!!

 

[eseabrook2008]

I managed to track down our VPN client software (3.5.3) and when I try to connect with it, the PIX show's the same error but the client shows:

GI VPN start callback failed "CM_IKE_RECEIVED_DELETE_NOTIFICATION" 915h)

 

[NetworkGhost]

What is the desktop version? Have your tried it on more than one PC? Are the results the same?

http://www.wr-mem.com

 

[eseabrook2008]

Same error, different PC. This PC has version 4.8.

 

[NetworkGhost]

Windows XP? 2000?

http://www.wr-mem.com

 

[eseabrook2008]

Both running XP SP2.

 

[eseabrook2008]

So I ended up having to call Cisco to get this fixed. 5 mins on the phone and we were up and running. He removed 3 lines of code:

crypto dynamic-map outside_dyn_map 40 set pfs
crypto dynamic-map outside_dyn_map 40 set transform-set ESP-3DES-SHA
crypto ipsec transform-set TRANS_ESP_3DES_SHA mode transport

 

[NetworkGhost]

So I can see why they removed the lines, but doesnt really explain the "General Error while processing Browser Proxy Configuration" error. Oh well. Glad its working for you.

http://www.wr-mem.com

 

[eseabrook2008]

Oh, and I downloaded the newest VPN client....guess I could have mentioned that! After installing, I did not get the General error message any more, but it still didn't connect until the three lines were removed.

Can you explain to me why I had to remove those entries?

 

[NetworkGhost]

The problem had to do with transport mode. Transport mode only encrypts the payload so in your implementation you are limited. The TCP Segment is encrypted and the ESP header is inserted between the encrypted payload and the IP header.

As you can see this can cause a problem especially with phase 2. Proxy IDs for the tunnel wouldnt match and therefore you have failure.

Transport mode is typically used for point to point encryption such as management to the device or for L2TP over IPSEC.

Im no expert but thats my take.

http://www.wr-mem.com