Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

Register Log in
  • Congratulations Mike Lewis on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

VPN issue - Cannot access network

Status
Not open for further replies.
jheine

jheine

MIS
Aug 17, 2006
15
US
Hello,

I am trying to get a VPN running between a PIX 506E running 6.3(5) and the Cisco VPN client version 4.6. I am able to connect and authenticate, but I am unable to ping or access servers on the internal network. I've been beeting my head on this for a week now, and would really appreciate a fresh set of eyes. Thanks.

Jarrett


: Saved
: Written by enable_15 at 13:30:34.185 EDT Fri Jun 6 2008
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password XXXXXXXXX encrypted
passwd XXXXXXXXXX encrypted
hostname PFW1
domain-name pcnet-inc.com
clock timezone EST -5
clock summer-time EDT recurring
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 10.0.0.200 cam3
name 10.0.0.2 Cam2
name 10.0.0.1 Cam1
name 10.0.0.121 EldoradoLLC
name 10.0.0.120 Tashua
name 10.0.0.25 Citizens
name 10.0.0.134 TrumbullProfessional
name 10.0.0.34 extranet
name 10.0.0.138 ESPN
name 10.0.0.133 PCNetWeb
name 10.0.0.10 PCNFAX
object-group service ftpboth tcp
port-object eq ftp
port-object eq ftp-data
access-list outside_access_in permit tcp any host 71.XXX.XXX.XXX eq www
access-list outside_access_in permit tcp any host 71.XXX.XXX.XXX eq www
access-list outside_access_in permit tcp any host 71.XXX.XXX.XXX eq www
access-list outside_access_in permit tcp any host 71.XXX.XXX.XXX eq www
access-list outside_access_in permit tcp any host 71.XXX.XXX.XXX eq www
access-list outside_access_in permit tcp any host 71.XXX.XXX.XXX eq www
access-list outside_access_in permit tcp any host 71.XXX.XXX.XXX eq www
access-list outside_access_in permit tcp any host 71.XXX.XXX.XXX eq www
access-list outside_access_in permit tcp any host 71.XXX.XXX.XXX eq www
access-list outside_access_in permit tcp any host 71.XXX.XXX.XXX eq www
access-list outside_access_in permit tcp any host 71.XXX.XXX.XXX object-group ftpboth
access-list outside_access_in permit icmp any any
access-list nonat permit ip 10.0.0.0 255.255.255.0 10.10.10.0 255.255.255.0
access-list nonat permit ip any 10.10.10.0 255.255.255.0
access-list inside_access_in permit ip any any
access-list inside_access_in deny tcp any any eq 2967
access-list outside_cryptomap_dyn_20 permit ip any 10.10.10.0 255.255.255.0
access-list vpn_split permit ip 10.0.0.0 255.255.255.0 10.10.10.0 255.255.255.0
access-list inside_nat0_outside permit ip 10.0.0.0 255.255.255.0 10.10.10.0 255.255.255.0
pager lines 24
logging on
logging timestamp
logging buffered warnings
logging trap warnings
logging host inside 10.0.0.230
mtu outside 1500
mtu inside 1500
ip address outside 71.XXX.XXX.XXX 255.255.255.224
ip address inside 10.0.0.4 255.255.255.0
ip verify reverse-path interface outside
ip audit info action alarm
ip audit attack action alarm
ip local pool VPNPool 10.10.10.1-10.10.10.15 mask 255.255.255.0
pdm location Cam1 255.255.255.255 inside
pdm location Cam2 255.255.255.255 inside
pdm location Citizens 255.255.255.255 inside
pdm location extranet 255.255.255.255 inside
pdm location Tashua 255.255.255.255 inside
pdm location EldoradoLLC 255.255.255.255 inside
pdm location PCNetWeb 255.255.255.255 inside
pdm location TrumbullProfessional 255.255.255.255 inside
pdm location ESPN 255.255.255.255 inside
pdm location cam3 255.255.255.255 inside
pdm location PCNFAX 255.255.255.255 inside
pdm location 10.0.0.230 255.255.255.255 inside
pdm location 10.0.0.0 255.255.255.224 inside
pdm location 10.10.10.0 255.255.255.0 outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outside
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) 71.xxx.xxx.xxx PCNetWeb netmask 255.255.255.255 0 0
static (inside,outside) 71.xxx.xxx.xxx ESPN netmask 255.255.255.255 0 0
static (inside,outside) 71.xxx.xxx.xxx extranet netmask 255.255.255.255 0 0
static (inside,outside) 71.xxx.xxx.xxx TrumbullProfessional netmask 255.255.255.255 0 0
static (inside,outside) 71.xxx.xxx.xxx Citizens netmask 255.255.255.255 0 0
static (inside,outside) 71.xxx.xxx.xxx Tashua netmask 255.255.255.255 0 0
static (inside,outside) 71.xxx.xxx.xxx EldoradoLLC netmask 255.255.255.255 0 0
static (inside,outside) 71.xxx.xxx.xxx Cam1 netmask 255.255.255.255 0 0
static (inside,outside) 71.xxx.xxx.xxx Cam2 netmask 255.255.255.255 0 0
static (inside,outside) 71.xxx.xxx.xxx cam3 netmask 255.255.255.255 0 0
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
rip outside passive version 2
rip inside default version 2
route outside 0.0.0.0 0.0.0.0 71.xxx.xxx.xxx 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server RADIUS (inside) host PCNFAX XXXXXXXX timeout 5
aaa-server LOCAL protocol local
http server enable
http 10.0.0.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map client authentication RADIUS
crypto map outside_map interface outside
isakmp enable outside
isakmp nat-traversal 20
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup PCN_VPN address-pool VPNPool
vpngroup PCN_VPN dns-server PCNFAX
vpngroup PCN_VPN default-domain pcnet-inc.com
vpngroup PCN_VPN split-tunnel vpn_split
vpngroup PCN_VPN idle-time 1800
vpngroup PCN_VPN password XXXXXXXXX
telnet 10.0.0.0 255.255.255.0 inside
telnet timeout 30
ssh 10.10.10.0 255.255.255.0 outside
ssh 10.0.0.0 255.255.255.0 inside
ssh timeout 10
console timeout 0
dhcpd lease 3600
dhcpd ping_timeout 750
terminal width 80
banner exec Unauthorized Access is Prohibited
banner login Unauthorized Access is Prohibited
Cryptochecksum:49ea07055086da104d7b483c7321f9e0
: end
 
Status
Not open for further replies.

Similar threads

Shmid
  • Locked
  • Question
Restricting Sonicwall SSL-VPN users for WAN access
Replies
7
Views
424
Shmid
Shmid
intel233
  • Locked
  • Question
Cisco ASA - VPN Question
Replies
6
Views
348
intel233
intel233
ciscokid1984
  • Locked
  • Question
Watchguard RDP from external network
Replies
1
Views
174
hairlessupportmonkey
hairlessupportmonkey
ISDPCMAN
  • Locked
  • Question
RDP fails over VPN
Replies
1
Views
140
gkittelson
gkittelson
WhosYourDiffie
  • Locked
  • Question
Cisco ASA 5506 VPN for Avaya Phones
Replies
0
Views
96
WhosYourDiffie
WhosYourDiffie

Part and Inventory Search

Sponsor

Back
Top