Problem Accessing Remote Hosts

Unanswered Question
Jul 25th, 2008

I've setup our Pix 515's to allow remote access. Locally we are in the process of migrating users between 2 networks. We can access the remote hosts from the old local network, but not from the one we are migrating to. I don't know if it has something to do with the ip addressing scheme. We are moving from a 192.168.0.0 255.255.255.0 subnet to a 10.224.0.0 255.255.0.0 subnet (yeah, I know, I just inherited this mess). Here is the config from the PIX:

interface ethernet0 auto

interface ethernet1 auto

nameif ethernet0 outside security0

nameif ethernet1 inside security100

nameif ethernet2 intf2 security4

nameif ethernet3 intf3 security6

nameif ethernet4 intf4 security8

nameif ethernet5 intf5 security10

fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69

names

access-list 101 permit ip 10.35.0.0 255.255.255.0 10.160.0.0 255.255.255.0

access-list 105 permit tcp host 10.40.0.46 host 10.35.0.21 eq 57001

access-list 105 permit tcp host 10.40.0.47 host 10.35.0.31 eq 57001

access-list 105 permit tcp host 10.40.0.40 host 10.35.0.21 eq 58000

access-list 105 permit tcp host 10.40.0.41 host 10.35.0.31 eq 58000

access-list 105 permit tcp host 10.40.0.52 host 10.35.0.21 eq 55000

access-list 105 permit tcp host 10.40.0.53 host 10.35.0.31 eq 55000

access-list 105 permit tcp host 10.40.0.54 host 10.35.0.21 eq 51010

access-list 105 permit tcp host 10.40.0.55 host 10.35.0.31 eq 51010

access-list 105 permit tcp host 10.40.0.46 host 10.35.0.21 eq 54500

access-list 105 permit tcp host 10.40.0.47 host 10.35.0.31 eq 54500

access-list 105 permit tcp host 10.40.0.44 host 10.35.0.21 eq 54000

access-list 105 permit tcp host 10.40.0.45 host 10.35.0.31 eq 54000

access-list 105 permit tcp host 10.40.0.56 host 10.35.0.21 eq 56000

access-list 105 permit tcp host 10.40.0.57 host 10.35.0.31 eq 56000

pager lines 24

mtu outside 1500

mtu inside 1500

mtu intf2 1500

mtu intf3 1500

mtu intf4 1500

mtu intf5 1500

ip address outside x.x.x.x 255.255.255.0

ip address inside 10.35.0.5 255.255.255.0

ip audit info action alarm

ip audit attack action alarm

ip local pool ippool 10.160.0.1-10.160.0.254

pdm history enable

arp timeout 14400

nat (inside) 0 access-list 101

static (inside,outside) 10.35.0.20 10.35.0.20 netmask 255.255.255.255 0 0

static (inside,outside) 10.35.0.21 10.35.0.21 netmask 255.255.255.255 0 0

static (inside,outside) 10.35.0.30 10.35.0.30 netmask 255.255.255.255 0 0

static (inside,outside) 10.35.0.31 10.35.0.31 netmask 255.255.255.255 0 0

access-group 105 in interface outside

route outside 0.0.0.0 0.0.0.0 x.x.x.x 1

route outside 10.40.0.0 255.255.255.0 x.x.x.x 1

route outside 10.37.0.0 255.255.255.0 x.x.x.x 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

floodguard enable

fragment chain 1 outside

fragment chain 1 inside

sysopt connection permit-ipsec

crypto ipsec transform-set myset esp-des esp-md5-hmac

crypto dynamic-map dynmap 10 set transform-set myset

crypto map mymap 10 ipsec-isakmp dynamic dynmap

crypto map mymap interface outside

isakmp enable outside

isakmp identity address

isakmp policy 10 authentication pre-share

isakmp policy 10 encryption des

isakmp policy 10 hash md5

isakmp policy 10 group 2

isakmp policy 10 lifetime 86400

vpngroup #### address-pool ippool

vpngroup #### default-domain ######.###

vpngroup #### idle-time 1800

vpngroup #### password ############

There are no errors in the client log.

Can anyone tell me what I'm doing wrong here? Thanks in advance!

C'mon somebody must have an idea

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
roberts.geo Mon, 07/28/2008 - 06:16

Ok, I've been digging through the posts and will try the following. Adding

crypto isakmp nat-traversal

and changing the nat pool to something in the 172.x.x.x network.

I'll post something after I've tried that.

Actions

This Discussion