Hi There
I am new to PIX but have already installed the hardware into the network and am using it as a firewall. The hardware is setup as follows;
LAN -> PIX using NAT inside 172.16.0.0 to outside 172.31.1.0 -> 1605 router using NAt inside 172.31.1.0 to outside INTERNET.
I have setup the VPN client 3.x.x on my XP desktop but I am having difficulty making this to work. I keep getting error messages like GI VPNStart callback failed.
One thing to note is that the VPN clients will need to use the RSA Ace secure token ids to authenticate with the ACE server in the internal network. Here is the config for the cisco router and pix firewall. But I do not think it is getting this far anyway. I do get IKE SA failed error messages as well.
Thank you in advance.
Cisco 1605 router
-----------
Using 3370 out of 7506 bytes
!
version 12.0
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service linenumber
!
hostname xxxxxx
!
no logging buffered
no logging console
no logging monitor
!
ip subnet-zero
no ip source-route
ip tcp path-mtu-discovery
no ip bootp server
clock timezone NZST 12
clock summer-time NZDT recurring 1 Sun Oct 2:00 3 Sun Mar 3:00
!
!
!
interface Ethernet0
description mdc dmz
ip address 172.31.1.1 255.255.255.0
ip broadcast-address 172.31.1.255
no ip directed-broadcast
ip nat inside
no cdp enable
!
interface Ethernet1
no ip address
no ip directed-broadcast
shutdown
no cdp enable
!
interface Serial0
ip address 99.99.99.9 255.255.255.252
ip access-group 103 in
no ip directed-broadcast
ip nat outside
no fair-queue
no cdp enable
!
ip nat pool mdc-int-use 99.99.99.99 netmask 255.255.255.252
ip nat pool internet 99.99.99.99.9 netmask 255.255.255.252
ip nat inside source list 1 interface Serial0 overload
ip nat inside source static 172.31.1.2 99.99.99.9
ip nat inside source static udp 172.31.1.2 500 99.99.99.9 500 extendable
ip nat inside source static tcp 172.31.1.3 25 99.99.99.9 25 extendable
ip nat inside source static tcp 172.31.1.5 8001 99.99.99.9 8001 extendable
ip nat inside source static tcp 172.31.1.7 1023 99.99.99.9 1023 extendable
ip nat inside source static tcp 172.31.1.4 20 99.99.99.9 20 extendable
ip nat inside source static tcp 172.31.1.4 21 99.99.99.9 21 extendable
ip nat inside source static tcp 172.31.1.7 1494 99.99.99.9 1494 extendable
ip classless
ip route 0.0.0.0 0.0.0.0 Serial0
!
access-list 1 permit 172.31.1.50
access-list 1 permit 172.31.1.2
access-list 1 permit 172.31.1.3
access-list 1 permit 172.31.1.6
access-list 1 permit 172.31.1.7
access-list 1 permit 172.31.1.4
access-list 1 permit 172.31.1.5
access-list 1 permit 172.31.1.10
access-list 1 permit 172.31.1.8
access-list 1 permit 172.31.1.9
access-list 1 permit 172.31.1.0 0.0.0.255
access-list 103 permit tcp any any established
access-list 103 permit tcp any any gt 1022
access-list 103 permit tcp any any eq 1023
access-list 103 permit tcp any any eq 1494
access-list 103 permit tcp any any eq 8001
access-list 103 permit tcp any any eq smtp
access-list 103 permit tcp any eq domain any
access-list 103 permit udp any eq domain any
access-list 103 permit tcp any any eq ftp
access-list 103 permit tcp any any eq ftp-data
access-list 103 permit tcp any any eq 10000
access-list 103 permit udp any any eq isakmp
access-list 103 permit tcp any any eq 50
access-list 103 permit tcp any any eq 51
access-list 103 permit esp any any
access-list 103 permit esp any host 172.31.1.2
access-list 103 permit udp any eq isakmp host 172.31.1.2
no cdp run
!
line con 0
exec-timeout 30 0
login
transport preferred none
transport input none
end
Cisco PIX
-----------
Building configuration...
: Saved
:
PIX Version 6.2(2)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 intf2 security10
hostname xxxxxx
domain-name xxx.local
fixup protocol http 80
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
fixup protocol ftp strict 21
names
name 172.16.10.71 ISAProxy
name 172.16.10.53 mdcEMail
name 172.16.10.73 geni
name 172.16.20.32 nc939-grant
name 172.16.150.200 lanonline
name 172.16.60.200 tdclient
name 172.16.10.23 dnsserver
name 172.16.20.34 nc950
name 172.16.10.20 MDCAD
name 172.16.10.2 PrintServ
name 172.16.10.51 mdciis
name 172.16.10.72 rsavpn
access-list compiled
access-list outside_access_in permit tcp any host 172.31.1.3 eq smtp
access-list outside_access_in permit tcp any host 172.31.1.5 eq 8001
access-list outside_access_in permit tcp any any eq 1023
access-list outside_access_in permit tcp any any eq citrix-ica
access-list outside_access_in permit ip any host 172.31.1.6
access-list outside_access_in permit udp any host 172.31.1.6 eq isakmp
access-list inside_access_in permit tcp any any eq ftp
access-list inside_access_in permit tcp any any eq ftp-data
access-list inside_access_in permit tcp any any eq citrix-ica
access-list inside_access_in permit tcp any any eq 1023
access-list inside_access_in permit tcp host dnsserver any eq domain
access-list inside_access_in permit udp host dnsserver any eq domain
access-list inside_access_in permit tcp host PrintServ any eq domain
access-list inside_access_in permit udp host PrintServ any eq domain
access-list inside_access_in permit udp host mdciis any eq domain
access-list inside_access_in permit tcp host mdciis any eq domain
access-list inside_access_in permit udp host MDCAD any eq domain
access-list inside_access_in permit tcp host MDCAD any eq domain
access-list inside_access_in permit tcp host mdcEMail any eq smtp
access-list inside_access_in permit tcp host ISAProxy any eq ftp
access-list inside_access_in permit tcp host ISAProxy any eq ftp-data
access-list inside_access_in permit tcp host ISAProxy any eq www
access-list inside_access_in permit tcp host ISAProxy any eq https
access-list inside_access_in permit tcp host ISAProxy any eq telnet
access-list inside_access_in permit tcp host ISAProxy any eq citrix-ica
access-list inside_access_in permit tcp host ISAProxy any eq 1023
access-list inside_access_in permit udp host ISAProxy any eq domain
access-list inside_access_in permit tcp host ISAProxy any eq domain
access-list inside_access_in permit ip host lanonline any
access-list inside_access_in permit ip host tdclient any
access-list inside_access_in permit udp host MDCAD any eq ntp
access-list inside_access_in permit ip host rsavpn any
access-list inside_access_in permit udp host rsavpn any
access-list inside_access_in permit tcp any any eq telnet
access-list inside_outbound_nat0_acl permit ip any 172.16.30.0 255.255.255.192
access-list outside_cryptomap_dyn_30 permit ip any 172.16.30.0 255.255.255.192
access-list outside_cryptomap_dyn_30 permit udp any 172.16.30.0 255.255.255.192
pager lines 24
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto shutdown
icmp deny any outside
icmp deny any inside
mtu outside 1500
mtu inside 1500
mtu intf2 1500
ip address outside 172.31.1.2 255.255.255.0
ip address inside 172.16.10.70 255.255.0.0
ip address intf2 127.0.0.1 255.255.255.255
ip audit info action alarm
ip audit attack action alarm
ip local pool vpnpool 172.16.30.1-172.16.30.50
pdm location mdcEMail 255.255.255.255 inside
pdm location ISAProxy 255.255.255.255 inside
pdm location 172.17.0.0 255.255.0.0 inside
pdm location 172.18.0.0 255.255.0.0 inside
pdm location 192.168.0.0 255.255.0.0 inside
pdm location geni 255.255.255.255 inside
pdm location nc939-grant 255.255.255.255 inside
pdm location lanonline 255.255.255.255 inside
pdm location tdclient 255.255.255.255 inside
pdm location dnsserver 255.255.255.255 inside
pdm location nc950 255.255.255.255 inside
pdm location 10.0.0.0 255.0.0.0 inside
pdm location MDCAD 255.255.255.255 inside
pdm location PrintServ 255.255.255.255 inside
pdm location mdciis 255.255.255.255 inside
pdm location rsavpn 255.255.255.255 inside
pdm location 172.16.30.0 255.255.255.192 outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 172.31.1.80-172.31.1.240 netmask 255.255.255.0
global (outside) 1 172.31.1.50
nat (inside) 1 172.16.0.0 255.255.0.0 0 0
nat (inside) 1 192.168.0.0 255.255.0.0 0 0
nat (inside) 1 10.0.0.0 255.0.0.0 0 0
static (inside,outside) 172.31.1.3 mdcEMail netmask 255.255.255.255 0 0
static (inside,outside) 172.31.1.5 tdclient netmask 255.255.255.255 0 0
static (inside,outside) 172.31.1.6 rsavpn netmask 255.255.255.255 0 0
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 172.31.1.1 1
route inside 172.17.0.0 255.255.0.0 172.16.10.13 1
route inside 172.18.0.0 255.255.0.0 172.16.10.13 1
route inside 192.168.0.0 255.255.0.0 192.168.10.3 1
timeout xlate 1:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
aaa-server partner-auth protocol radius
aaa-server Authin protocol radius
aaa-server Authin (inside) host rsavpn mdcvpngroup timeout 30
ntp server 139.80.64.119 source outside
ntp server 130.123.128.253 source outside
http server enable
http 172.16.0.0 255.255.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
tftp-server inside ISAProxy c:
floodguard enable
sysopt connection permit-ipsec
sysopt ipsec pl-compatible
no sysopt route dnat
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto dynamic-map vpndynmap 30 match address outside_cryptomap_dyn_30
crypto dynamic-map vpndynmap 30 set pfs group2
crypto dynamic-map vpndynmap 30 set transform-set ESP-3DES-SHA ESP-DES-SHA ESP-DES-MD5 ESP-3DES-MD5
crypto map vpnoutside_map 10 ipsec-isakmp dynamic vpndynmap
crypto map vpnoutside_map client configuration address initiate
crypto map vpnoutside_map client configuration address respond
crypto map vpnoutside_map client token authentication Authin
crypto map vpnoutside_map interface outside
isakmp enable outside
isakmp key ******** address 0.0.0.0 netmask 0.0.0.0
isakmp identity address
isakmp client configuration address-pool local vpnpool outside
isakmp policy 30 authentication pre-share
isakmp policy 30 encryption 3des
isakmp policy 30 hash sha
isakmp policy 30 group 2
isakmp policy 30 lifetime 86400
vpngroup mdcvpngroup address-pool vpnpool
vpngroup mdcvpngroup dns-server dnsserver PrintServ
vpngroup mdcvpngroup wins-server dnsserver PrintServ
vpngroup mdcvpngroup default-domain xxx.local
vpngroup mdcvpngroup idle-time 1800
vpngroup mdcvpngroup password ********
telnet 172.16.0.0 255.255.0.0 inside
telnet timeout 5
ssh 172.16.0.0 255.255.0.0 inside
ssh timeout 5
: end
[OK]
I am new to PIX but have already installed the hardware into the network and am using it as a firewall. The hardware is setup as follows;
LAN -> PIX using NAT inside 172.16.0.0 to outside 172.31.1.0 -> 1605 router using NAt inside 172.31.1.0 to outside INTERNET.
I have setup the VPN client 3.x.x on my XP desktop but I am having difficulty making this to work. I keep getting error messages like GI VPNStart callback failed.
One thing to note is that the VPN clients will need to use the RSA Ace secure token ids to authenticate with the ACE server in the internal network. Here is the config for the cisco router and pix firewall. But I do not think it is getting this far anyway. I do get IKE SA failed error messages as well.
Thank you in advance.
Cisco 1605 router
-----------
Using 3370 out of 7506 bytes
!
version 12.0
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service linenumber
!
hostname xxxxxx
!
no logging buffered
no logging console
no logging monitor
!
ip subnet-zero
no ip source-route
ip tcp path-mtu-discovery
no ip bootp server
clock timezone NZST 12
clock summer-time NZDT recurring 1 Sun Oct 2:00 3 Sun Mar 3:00
!
!
!
interface Ethernet0
description mdc dmz
ip address 172.31.1.1 255.255.255.0
ip broadcast-address 172.31.1.255
no ip directed-broadcast
ip nat inside
no cdp enable
!
interface Ethernet1
no ip address
no ip directed-broadcast
shutdown
no cdp enable
!
interface Serial0
ip address 99.99.99.9 255.255.255.252
ip access-group 103 in
no ip directed-broadcast
ip nat outside
no fair-queue
no cdp enable
!
ip nat pool mdc-int-use 99.99.99.99 netmask 255.255.255.252
ip nat pool internet 99.99.99.99.9 netmask 255.255.255.252
ip nat inside source list 1 interface Serial0 overload
ip nat inside source static 172.31.1.2 99.99.99.9
ip nat inside source static udp 172.31.1.2 500 99.99.99.9 500 extendable
ip nat inside source static tcp 172.31.1.3 25 99.99.99.9 25 extendable
ip nat inside source static tcp 172.31.1.5 8001 99.99.99.9 8001 extendable
ip nat inside source static tcp 172.31.1.7 1023 99.99.99.9 1023 extendable
ip nat inside source static tcp 172.31.1.4 20 99.99.99.9 20 extendable
ip nat inside source static tcp 172.31.1.4 21 99.99.99.9 21 extendable
ip nat inside source static tcp 172.31.1.7 1494 99.99.99.9 1494 extendable
ip classless
ip route 0.0.0.0 0.0.0.0 Serial0
!
access-list 1 permit 172.31.1.50
access-list 1 permit 172.31.1.2
access-list 1 permit 172.31.1.3
access-list 1 permit 172.31.1.6
access-list 1 permit 172.31.1.7
access-list 1 permit 172.31.1.4
access-list 1 permit 172.31.1.5
access-list 1 permit 172.31.1.10
access-list 1 permit 172.31.1.8
access-list 1 permit 172.31.1.9
access-list 1 permit 172.31.1.0 0.0.0.255
access-list 103 permit tcp any any established
access-list 103 permit tcp any any gt 1022
access-list 103 permit tcp any any eq 1023
access-list 103 permit tcp any any eq 1494
access-list 103 permit tcp any any eq 8001
access-list 103 permit tcp any any eq smtp
access-list 103 permit tcp any eq domain any
access-list 103 permit udp any eq domain any
access-list 103 permit tcp any any eq ftp
access-list 103 permit tcp any any eq ftp-data
access-list 103 permit tcp any any eq 10000
access-list 103 permit udp any any eq isakmp
access-list 103 permit tcp any any eq 50
access-list 103 permit tcp any any eq 51
access-list 103 permit esp any any
access-list 103 permit esp any host 172.31.1.2
access-list 103 permit udp any eq isakmp host 172.31.1.2
no cdp run
!
line con 0
exec-timeout 30 0
login
transport preferred none
transport input none
end
Cisco PIX
-----------
Building configuration...
: Saved
:
PIX Version 6.2(2)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 intf2 security10
hostname xxxxxx
domain-name xxx.local
fixup protocol http 80
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
fixup protocol ftp strict 21
names
name 172.16.10.71 ISAProxy
name 172.16.10.53 mdcEMail
name 172.16.10.73 geni
name 172.16.20.32 nc939-grant
name 172.16.150.200 lanonline
name 172.16.60.200 tdclient
name 172.16.10.23 dnsserver
name 172.16.20.34 nc950
name 172.16.10.20 MDCAD
name 172.16.10.2 PrintServ
name 172.16.10.51 mdciis
name 172.16.10.72 rsavpn
access-list compiled
access-list outside_access_in permit tcp any host 172.31.1.3 eq smtp
access-list outside_access_in permit tcp any host 172.31.1.5 eq 8001
access-list outside_access_in permit tcp any any eq 1023
access-list outside_access_in permit tcp any any eq citrix-ica
access-list outside_access_in permit ip any host 172.31.1.6
access-list outside_access_in permit udp any host 172.31.1.6 eq isakmp
access-list inside_access_in permit tcp any any eq ftp
access-list inside_access_in permit tcp any any eq ftp-data
access-list inside_access_in permit tcp any any eq citrix-ica
access-list inside_access_in permit tcp any any eq 1023
access-list inside_access_in permit tcp host dnsserver any eq domain
access-list inside_access_in permit udp host dnsserver any eq domain
access-list inside_access_in permit tcp host PrintServ any eq domain
access-list inside_access_in permit udp host PrintServ any eq domain
access-list inside_access_in permit udp host mdciis any eq domain
access-list inside_access_in permit tcp host mdciis any eq domain
access-list inside_access_in permit udp host MDCAD any eq domain
access-list inside_access_in permit tcp host MDCAD any eq domain
access-list inside_access_in permit tcp host mdcEMail any eq smtp
access-list inside_access_in permit tcp host ISAProxy any eq ftp
access-list inside_access_in permit tcp host ISAProxy any eq ftp-data
access-list inside_access_in permit tcp host ISAProxy any eq www
access-list inside_access_in permit tcp host ISAProxy any eq https
access-list inside_access_in permit tcp host ISAProxy any eq telnet
access-list inside_access_in permit tcp host ISAProxy any eq citrix-ica
access-list inside_access_in permit tcp host ISAProxy any eq 1023
access-list inside_access_in permit udp host ISAProxy any eq domain
access-list inside_access_in permit tcp host ISAProxy any eq domain
access-list inside_access_in permit ip host lanonline any
access-list inside_access_in permit ip host tdclient any
access-list inside_access_in permit udp host MDCAD any eq ntp
access-list inside_access_in permit ip host rsavpn any
access-list inside_access_in permit udp host rsavpn any
access-list inside_access_in permit tcp any any eq telnet
access-list inside_outbound_nat0_acl permit ip any 172.16.30.0 255.255.255.192
access-list outside_cryptomap_dyn_30 permit ip any 172.16.30.0 255.255.255.192
access-list outside_cryptomap_dyn_30 permit udp any 172.16.30.0 255.255.255.192
pager lines 24
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto shutdown
icmp deny any outside
icmp deny any inside
mtu outside 1500
mtu inside 1500
mtu intf2 1500
ip address outside 172.31.1.2 255.255.255.0
ip address inside 172.16.10.70 255.255.0.0
ip address intf2 127.0.0.1 255.255.255.255
ip audit info action alarm
ip audit attack action alarm
ip local pool vpnpool 172.16.30.1-172.16.30.50
pdm location mdcEMail 255.255.255.255 inside
pdm location ISAProxy 255.255.255.255 inside
pdm location 172.17.0.0 255.255.0.0 inside
pdm location 172.18.0.0 255.255.0.0 inside
pdm location 192.168.0.0 255.255.0.0 inside
pdm location geni 255.255.255.255 inside
pdm location nc939-grant 255.255.255.255 inside
pdm location lanonline 255.255.255.255 inside
pdm location tdclient 255.255.255.255 inside
pdm location dnsserver 255.255.255.255 inside
pdm location nc950 255.255.255.255 inside
pdm location 10.0.0.0 255.0.0.0 inside
pdm location MDCAD 255.255.255.255 inside
pdm location PrintServ 255.255.255.255 inside
pdm location mdciis 255.255.255.255 inside
pdm location rsavpn 255.255.255.255 inside
pdm location 172.16.30.0 255.255.255.192 outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 172.31.1.80-172.31.1.240 netmask 255.255.255.0
global (outside) 1 172.31.1.50
nat (inside) 1 172.16.0.0 255.255.0.0 0 0
nat (inside) 1 192.168.0.0 255.255.0.0 0 0
nat (inside) 1 10.0.0.0 255.0.0.0 0 0
static (inside,outside) 172.31.1.3 mdcEMail netmask 255.255.255.255 0 0
static (inside,outside) 172.31.1.5 tdclient netmask 255.255.255.255 0 0
static (inside,outside) 172.31.1.6 rsavpn netmask 255.255.255.255 0 0
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 172.31.1.1 1
route inside 172.17.0.0 255.255.0.0 172.16.10.13 1
route inside 172.18.0.0 255.255.0.0 172.16.10.13 1
route inside 192.168.0.0 255.255.0.0 192.168.10.3 1
timeout xlate 1:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
aaa-server partner-auth protocol radius
aaa-server Authin protocol radius
aaa-server Authin (inside) host rsavpn mdcvpngroup timeout 30
ntp server 139.80.64.119 source outside
ntp server 130.123.128.253 source outside
http server enable
http 172.16.0.0 255.255.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
tftp-server inside ISAProxy c:
floodguard enable
sysopt connection permit-ipsec
sysopt ipsec pl-compatible
no sysopt route dnat
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto dynamic-map vpndynmap 30 match address outside_cryptomap_dyn_30
crypto dynamic-map vpndynmap 30 set pfs group2
crypto dynamic-map vpndynmap 30 set transform-set ESP-3DES-SHA ESP-DES-SHA ESP-DES-MD5 ESP-3DES-MD5
crypto map vpnoutside_map 10 ipsec-isakmp dynamic vpndynmap
crypto map vpnoutside_map client configuration address initiate
crypto map vpnoutside_map client configuration address respond
crypto map vpnoutside_map client token authentication Authin
crypto map vpnoutside_map interface outside
isakmp enable outside
isakmp key ******** address 0.0.0.0 netmask 0.0.0.0
isakmp identity address
isakmp client configuration address-pool local vpnpool outside
isakmp policy 30 authentication pre-share
isakmp policy 30 encryption 3des
isakmp policy 30 hash sha
isakmp policy 30 group 2
isakmp policy 30 lifetime 86400
vpngroup mdcvpngroup address-pool vpnpool
vpngroup mdcvpngroup dns-server dnsserver PrintServ
vpngroup mdcvpngroup wins-server dnsserver PrintServ
vpngroup mdcvpngroup default-domain xxx.local
vpngroup mdcvpngroup idle-time 1800
vpngroup mdcvpngroup password ********
telnet 172.16.0.0 255.255.0.0 inside
telnet timeout 5
ssh 172.16.0.0 255.255.0.0 inside
ssh timeout 5
: end
[OK]
