VPN tunnel establishes, but no access to LAN

[thommynix]

Hello,

I hope you can help with a problem I am working on since DAYS. I have to say I have knowledge about cisco routers, but don´t know much about cisco pix firewall or vpn.
Now the description of the problem:
It is possible to connect from a pc outside our company to the pix using cisco vpn client. A vpn tunnel is established. In the log of the vpn client there are is a warning-message: "received malformed message or negotiation no longer active". I don´t know if this leads to problem?
After vpn is established, the vpn client icon occurs on the task-bar.
But it is not possible to make a connection to our terminal-server or any pc´s inside the lan or the dmz. vpn clients get an ip-address from the pix. This works: It is possible to ping the vpn-client-pc from a pc inside the dmz.
In the statistics of the vpn client, there are two network entries: First is 0.0.0.0 with subnet 0.0.0.0, and the second one is our pix-outside-interface. The problem seems to be that all packets are sent to the first network (0.0.0.0), and none of them to the pix-outside-interface.
In the description of the vpn client, it´s the opposite: There all packets are sent to the pix-outside-interface. Is this the problem? The vpn-client sends the packets not the pix, is this the problem? And why does it not?
The vpn-connection worked till the administrator made changes to our domain (he is not a company member anymore, so I can´t ask him), I don´t know if there any changes in pix-configuration were made.

I hope anyone can give me a hint what the problem could be, or maybe the solution? This would be fantastic!

Thanks a lot in advance.

Thomas

 

[sunyasee]

Post your config here...

----

Sunyasee

 

[yizhar]

HI.

The initial phases of VPN work over UDP port 500 (isakmp).
The actual traffic passes via ESP = IP protocol 50, which has problems going over NAT devices, or might be blocked by a remote firewall (client side - either software firewall or network device).

So, do some testing like:
Connect a different pc using dialup to the ISP, and with a VPN client try to connect. What happens now?
Ask the remote user to do the same (use dial-up connection).
Ask the remote user about his connection to the Internet - any NAT device? Software firewall on PC? Network firewall at the office?

You should also check with syslog messages at the pix for toubleshooting. Do you get any relevant messages?

Read on:

http://www.cisco.com/pcgi-bin/Support/browse/psp_view.pl?p=Internetworking:IPSec

http://www.cisco.com/pcgi-bin/Support/browse/psp_view.pl?p=Hardware:PIX&s=Software_Configuration

> In the statistics of the vpn client, there are two network entries: First is 0.0.0.0 with subnet 0.0.0.0,
...
This is normal because you don't use "split-tunnel".
If you wish, you can configure "split-tunnel" at the pix.

Please also provide more info, partial config, version info, etc...

Bye


Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar