TermServ Client via IPSEC Tunnel ? 1

[Iota]

Hello all.
I just managed to setup the VPN 3 client to our PIX 515UR running PIX 6.1 OS. Everything seems to work, I can ping both the dmz and locals when connected, but I cannot termserv via Windows Terminal Server Client to a server.

Any ideas/thoughts/tricks ?

Thanks in advance.

-Iota

 

[mavenccie]

Do you have a command to the effect of:
sysopt connection permit-ipsec
This allows the VPN not require a conduit to work correctly.

 

[yizhar]

HI!

Can you post your configuration and network design?
It can help diagnosing your problem.
I'll also need to configure something like this in the near future, and could benefit from your experience.

Anyway, as far as I have learned about VPN is this:
Don't think of the VPN tunnel as ending on the inside of your network, but think of it as ending on the "outside" interface, and think of the VPN tunnel just as a secure channel between networks.
What does it mean -
1) You must allow specific trafic from inside to VPN client using "nat 0" or static.
(if using STATIC, the VPN client should try to connect to the global IP of the Terminal Server).
2) You must allow specific VPN to inside trafic using "sysopt connection permit-ipsec" and/or specific access-list/group commands.
Again - it depends if you're using "nat 0" or STATIC.

Bye
Yizhar


Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[Iota]

Okay.. 3 interfaces, outside, inside, and dmz. Outside interface starts with 209, the dmz is: 192.168.0.1 255.255.255.0 and the internal is 10.1.2.2 255.255.0.0
(Yes, the inside it subnetted a little unusual, but that is how the existing network is, so i have to deal with it.)

The VPN client connects fine, and I can ping all the servers, ftp to them, etc. just fine. I just can't Term Serv.



Building configuration...
: Saved
:
PIX Version 6.1(1)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security50
enable password xxx encrypted
passwd xxx encrypted
hostname xxx
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
no fixup protocol rsh 514
no names
access-list 101 permit ip 10.1.0.0 255.255.0.0 10.250.0.0 255.255.0.0
access-list 102 permit ip 192.168.0.0 255.255.255.0 10.250.0.0 255.255.0.0
pager lines 24
logging on
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip address outside 209.xxx.xxx.xxx 255.255.255.0
ip address inside 10.1.2.2 255.255.0.0
ip address dmz 192.168.0.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool ippool 10.250.0.1-10.250.0.250
no failover
failover timeout 0:00:00
failover poll 15
failover ip address outside 0.0.0.0
failover ip address inside 0.0.0.0
failover ip address dmz 0.0.0.0
pdm history enable
arp timeout 14400
global (outside) 1 209.xxx.xxx.xxx
global (dmz) 1 192.168.0.11-192.168.0.15 netmask 255.255.255.0
nat (inside) 0 access-list 101
nat (dmz) 0 access-list 102
nat (dmz) 1 192.168.0.0 255.255.255.0 0 0
^^^This line will go away once I'm done testing, I don't need dmz users to initiate outside connections--strictly convienence for now.

static (inside,dmz) 192.168.0.254 10.1.1.11 netmask 255.255.255.255 0 0
static (dmz,outside) 209.xxx.xxx.xxx 192.168.0.200 netmask 255.255.255.255 0 0
static (dmz,outside) 209.xxx.xxx.xxx 192.168.0.201 netmask 255.255.255.255 0 0
static (dmz,outside) 209.xxx.xxx.xxx 192.168.0.202 netmask 255.255.255.255 0 0
static (inside,outside) 209.xxx.xxx.xxx 10.1.1.11 netmask 255.255.255.255 0 0
^^ This line will go away once the VPN works the way it needs to with Term Serv.

static (dmz,outside) 209.xxx.xxx.xxx 192.168.0.21 netmask 255.255.255.255 0 0
conduit permit icmp any any
conduit permit tcp host 209.xxx.xxx.xxx eq

http://www any

conduit permit tcp host 209.xxx.xxx.xxx eq

http://www any

conduit permit tcp host 209.xxx.xxx.xxx eq

http://www any

conduit permit tcp host 209.xxx.xxx.xxx eq

http://www any

conduit permit tcp host 192.168.0.254 any
conduit permit ip 209.xxx.xxx.xxx 255.255.255.0 65.xxx.xxx.xxx 255.255.255.224
^^Only temp until VPN works. Currently allows direct access from work to this site

I also need to ditch to the conduits and go to straight access list, but that's another project.
route outside 0.0.0.0 0.0.0.0 209.xxx.xxx.xxx
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
no sysopt route dnat
crypto ipsec transform-set myset esp-des esp-md5-hmac
crypto dynamic-map dynmap 10 set transform-set myset
crypto map mymap 10 ipsec-isakmp dynamic dynmap
crypto map mymap interface outside
isakmp enable outside
isakmp identity address
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
vpngroup abc address-pool ippool
vpngroup abc default-domain xxxxxx
vpngroup abc idle-time 1800
vpngroup abc password xxxxx
vpngroup abc dns-server 192.168.0.21
vpngroup abc idle-time 1800
telnet 10.1.0.0 255.255.0.0 inside
telnet 192.168.0.0 255.255.255.0 dmz
telnet timeout 5
ssh timeout 5
terminal width 80

Again, I can vpn in just fine, ftp/web/ping, etc.. I just can't termserv.

Thanks again.

 

[Bluecrack]

I have a similar setup and have terminal services working just fine. Can you ping the server you want to terminal services into?

Turn on logging, try to connect to the terminal server over the vpn, and then check the logs for signs of trouble.

Bluecrack

 

[yizhar]

HI!

Remember to check the TS configuration also.
Maybe there is an IP filter, IPSEC configuration or other configuration that prevents connection from the remote clients.

Bye
Yizhar
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[Iota]

Okay.. a few days ago, I finally made use of our contract and phoned Cisco. Apparently It is not possible to TermServ into a Windows Terminal Server while VPN'd into the PIX using Cisco's VPN 3 client.

I was told by Cisco that this is a known issue b/c of the way their VPN client tells the OS about the virtual IP. The TermServ Client doesn't query the OS in a way able to determine that a Virtual IP exists.

Cisco plans on reworking the way Virtual IPs are assigned to the OS in version 3.5 which is supposidly due out beginning of 2002.

If anyone has any evidence to the contrary, I'd be interested in seeing their setup. Keep in mind, this does NOT apply to LAN-LAN connections--they work fine. Only when using Cisco's Dialup VPN software.

 

[yizhar]

HI!

Thanks for sharing that info with us.

Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[Bluecrack]

Interesting. Let me describe what I have working and see if this contradicts Cisco's response.

I have PIX running 6.01 and have used several of the 3.x vpnclient versions including the Linux version. We have private addressing setup on the inside of the PIX on the 192.168.x.x networks. Several of my servers are Windows 2000 running Terminal Services in Remote Adminstration mode. I can connect to the VPN and lauch the Terminal Services Advanced Client (TSAC) that is a web-based RDP client for Microsoft Terminal Servers. It connects just fine to my terminal servers. Also, I frequently use Linux at home and use rdesktop which is an implementation of RDP that also works with Terminal Services to connect to my services. I don't know that I have every tried to connect with the Terminal Services client because I don't have it installed on my home PC.
What version of Windows and Terminal Server are you running? What error occurs on the client? Can you ping the server? Can you connect to the Terminal Services port, default is 3389 (I think) for RDP? (Not sure about Citrix). For example, netcat? Or can you portscan that port to make sure it is open and reachably by your client?

I hope this helps.

Bluecrack

 

[Guest_imported]

Hey i noticed that you have access-list 101 and 102 but u didnt set a access-group and telling it what interface you want it on. So I dont think that your access-list is working. one thing you might want to add is this "nat (inside) 0 access-list 101" That should allow your vpn clients to access your internal nated ip's. Other then that i think everything else looks okay. We have the same setup and I have no problem with

 

[PIXFirewall]

I have a vpn tunnel between 2 places newyork and bombay.I have a pix firewall in newyork that is connected via a vpn tunnel to the router in bombay.Iam now using microsoft netmeeting that is from newyork to bombay.form bombay iam able to view the person thru netmeeting but when i try to initite fron bombay iam not able to .the person in newyork is not able to view him.what could be the problem with H323?

 

[jjbogart]

sorry for for intefering in you thread

I have a similar problem not with cisco but novell bordermanger ver 3.6

We have in the company an vpn connetion bm 3.6 we have tryed client 3.6 and client 3.7. One week ago we had one server running windows nt 4.0 terminal server edition, we have changed to windows 2000 with terminal services running, right now we can not connect to the server. We have opened the corresponding port in internet to access directly to the server and it works but it does not thru vpn.it works perfect internally.

to access vpn we have ip and ipx working. Do you think this has something to do that windows 2000 does not support ipx??????

we have used win98 and xp clients

any ideas

thanks for you help