VPN Connection Refused on PIX 506E

[JGWohlford]

New VPN connections are refused after two connections have been established over my PIX 506E. I am using PPTP to connect from remote clients to a WinNT VPN Server by passing through the PIX. I have checked my NT Server config and it seems to be OK. Is there something wrong with this PIX config? (We have 5 static IP xx.xx.176.8 - 12 on DSL)

PIX Version 6.1(4)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
access-list pptp-list permit tcp any host xx.xx.176.12 eq 1723
access-list pptp-list permit gre any host xx.xx.176.12
interface ethernet0 auto
interface ethernet1 auto
mtu outside 1500
mtu inside 1500
ip address outside xx.xx.176.8 255.255.255.0
ip address inside 10.0.0.254 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location 0.0.0.0 0.0.0.0 inside
pdm location 10.0.0.1 255.255.255.255 inside
pdm location 10.0.0.148 255.255.255.255 inside
arp timeout 14400
global (outside) 1 xx.xx.176.9
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) xx.xx.176.12 10.0.0.1 netmask 255.255.255.255 0 0
access-group pptp-list in interface outside
rip inside default version 1
route outside 0.0.0.0 0.0.0.0 xx.xx.176.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
http server enable
http 10.0.0.148 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
no sysopt route dnat
telnet 10.0.0.148 255.255.255.255 inside
telnet timeout 5
ssh timeout 5

 

[yizhar]

HI.

> ip address outside xx.xx.176.8 255.255.255.0
Do you have public ip addresses here?
Is the xx.xx.176.1 router doing NAT?
If so, then the problem might be the NAT on the router.
Or it could be a problem of another NAT device at the remote client side.
Some NAT devices support PPTP pass-through, but with limitted number of sessions.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[JGWohlford]

The static IP addresses xx.xx.176.8 - xx.xx.176.12 are all public. The PIX is acting as a router and firewall so there is no router on the outside interface. The only NAT is done by the PIX.

I don't think it is client side as I have run at least one test where I was denied a connection coming in from my home network and I have successfully set up multiple VPN connections in the past.

Thanks for the feedback--I had never thought about client side NAT. I'm starting to think that this probably is an NT configuration issue.

 

[yizhar]

> ip address outside xx.xx.176.8 255.255.255.0
> The static IP addresses xx.xx.176.8 - xx.xx.176.12 are all public.

This is not related to the VPN issue, but seems to me that the subnet mask is wrong in the first line above. Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[JGWohlford]

You are absolutely right! I originally installed this PIX for a single IP and missed that mask entry when I reconfigured it. (I agree that it is not causing this problem!)

Thanks!