Remote VPN on PIX 515 problem...

Unanswered Question
Jul 11th, 2009
User Badges:

Hello

I have a problem with my PIX firewall.

I configured a Remote VPN server by the ASDM wizard. It was my first try in configuring such type of service.


Now, when i try to connect to PIX from the outside (using Cisco VPN client for windows and GPRS connection), VPN session starts perfectly, i mean that client gets IP from the pool, and in routing table i have all needed routes. But pinging of any IP in the private network fails.

Split tunneling is off, but i can still ping PIX `outside` interface from the WEB.


In ASDM monitoring i can see Remote VPN session, but can't ping external host.


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
JORGE RODRIGUEZ Sun, 07/12/2009 - 11:11
User Badges:
  • Green, 3000 points or more

Hello Mikhail,


Go over this link.

http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a00807e0aca.shtml#Solution1


But pinging of any IP in the private network fails


Enable NAT-T



PIX/ASA 7.1 and earlier


pix(config)#isakmp nat-traversal 20

PIX/ASA 7.2(1) and later


securityappliance(config)#crypto isakmp nat-traversal 20



As for ICMP outbound you probably need couple of things to do.


ICMP inspection, go over this link for allowing ICMP outbound.


http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml


AS for VPN Network be able to go out internet traffic or ping outbound it will go out same interface it came, so you need same sec intra interface command statement in firewall and nat (outside) rule.


e.i - to PAT your VPN network using outside interface #1


same-security-traffic permit intra-interface

nat (outside) 1

Go over this link

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00805734ae.shtml


If issues let us know


Regards

123456miha Sun, 07/12/2009 - 23:25
User Badges:

Thanx... but now I've discovered another problem

First off all, all woks fine... Probably the First faults were because something was wrong with Cisco VPN-Client. I've downloaded another one ant it works fine, even without NAT-T. I am using GPRS connection and I think that NAT isn't so necessary.

But all works fine only in Windows. When I'm trying to use Linux Cisco VPN client system crashes.

While connection establishes all goes fine, system gets IP addres from the pool, in /etc/resolv.conf appears nameserver and domain, but if I try to connect with any host in private network system freezes and only power button helps.


Actions

This Discussion