L2TP/IPSec VPN access through PIX

pedrosuero · ‎02-12-2010

Hello, i having problem with VPN connection from a windows PC using L2TP/IPsec, i alow all necesary protocols (GRE, ESP, PPTP, UDP-500, UDP-4500 and UDP-1701) on outside interface on PIX (version 8.0(4)), i'm perfectly connect with PPTP but when i tried with L2TP the conecction can't be established, in PIX log i can see the creating session for ports 500 and 4500, on PC have and error that the server can be reach. I'm using a ISA Server cluster for VPN Server, the configuration are like follows:

PC <----> PIX <-----> MS ISA <------> LAN

PC IP 10.3.0.12/28

PIX external IP 10.3.0.1/28

PIX Internal IP 172.16.0.1/28

ISA external IP 172.16.0.2/28

I'm using Static NAT for the external interface of the ISA for the VPN access with IP 10.3.0.3

What might be forgetting???

I will appretiated the help any one can provide me.

sachinraja · ‎02-12-2010

Hi Pedro

The details given looks good.. would you have the configs handy ? Just wanted to check the CLI commands that you had used ?

Just to test, were you able to create L2TP session from inside the PIX, just to make sure the server works good ? Do you see any drops on the "show log" of PIX when you initiate L2TP from outside ? sysopt commands can be useful, but thats more for traffic initiating from inside to outside.. in your case its from internet to inside right ? Just curious, do you have any personal firewalls on your desktop ? You can also try opening ip any on the outside and test, just to test if the NAT and other stuff works good... are there any ACLs on the inside?

Thanks & Regards

Raj

pedrosuero · ‎02-15-2010

Thanks for response Raj,

I attached the config of PIX, in this config you can see that I’m use tree interfaces, one for management with security 100, one DMZ between PIX and MS ISA with security 90 and the Outside with security 0.

Answering your questions, I make tests of L2TP sessions from DMZ Sub-net (Attaching PC to this Subnet) to the MS ISA Server and works perfectly, i can't see any drop packets on PIX log when initiated L2TP session from outside, like you said the traffic are initiated from outside, but to DMZ; i turn off the Windows Firewall and the Antivirus Firewall and the result is the same, i make a test open all traffic from outside (IP, TCP, UDP, ICMP) but can connect anyway; I don't have any ACL applied to inside interface.

Sorry for my English

Regards,

cmcbride · ‎02-13-2010

How about opening TCP/1723?

pedrosuero · ‎02-15-2010

Hello,

thanks for reply, i already have allowed, can connect PPTP but NOT L2TP

Regards.

Panos Kampanakis · ‎02-15-2010

In the outside ACL is open for pptp traffic destined to 10.3.0.3.

Shouldn't this guy be translated (currently there is no static translation for it) and someone would be reaching him with its outside ip?

I hope it helps.

PK

pedrosuero · ‎02-15-2010

Hello, thanks for answer

The IP 10.3.0.3 is an static translation from 172.16.0.2, all traffic iniciated to 10.3.0.3 will be destinated to 172.16.0.2 that is the IP of the MS ISA Server

Regards.

cmcbride · ‎02-15-2010

I would consider removing the PAT configuration for the ISA server. It may be conflicting with the Static NAT configuration.

global (Outside) 1 10.3.0.3 netmask 255.225.255.255

Try using a different IP number for that rather than 10.3.0.3. Allow the static nat to be the only thing using that IP number.

pedrosuero · ‎02-16-2010

Hello, i make tests doing all that you said, remove the PAT configuration, asign a new IP to the NAT, but the result is the same; i atach the logs with the info tath receive from the PIX.

Regards.