VPN Setup

agoodwin · ‎01-16-2002

Hi,

Would anyone be able to give me some help with VPN through the PIX. I have one of the walkthru's on this website. ie:

Internal Network Range: 10.1.1.x

External Range for VPN: 172.16.0.x

Pix Inside: 10.1.1.5

Pix Outside: 192.168.0.5

Router: 192.168.0.2

---------------------------------------------------

access-list VPN permit IP 10.1.1.0 255.255.255.0 172.16.1.0 255.255.255.0

ip local pool pptp-pool 172.16.0.10-172.16.0.40

nat (inside) 0 access-list VPN

sysopt connection permit-pptp

vpdn group 1 accept dialin pptp

vpdn group 1 ppp auth pap

vpdn group 1 ppp auth chap

vpdn group 1 ppp auth mschap

vpdn group 1 client config address local pptp-pool

vpdn group 1 client auth local

vpdn username joe password bloggs

vpdn enable outside

---------------------------------------------------

I have the pix working fine as a firewall and have mail coming in etc so im erasonable sure that side is sorted.

I realise this is the setup for using the vpn connector within windows but if I try and connect it just says no answer when I try and connect to the legal IP address on the internet.

I have a PIX 506 and a 515 to test with as far as im aware the 506 is base (5.2) with DES and the 515 is 6.1(1) with everything enabled and unlimited apart from 3DES.

Am I right in thinking because I don't have 3DES on either of them I cannot use any of the cisco client software?

Does the router need to have a dedicated mapping to the pix for any specific ports for example?

For testing I only have 2 x 2K pro ws with an intel 8100 router and the pixs.

Sorry if this was a bit long winded, many thanks for any help.

regards,

Andy

ciscomoderator · ‎01-22-2002

Often times complex troubleshooting issues are best addressed in an interactive session with one of our trained technical assistance engineers. While other forum users may be able to help, it’s often difficult to do so for this type of issue.

To utilize the resources at our Technical Assistance Center, please visit http://www.cisco.com/tac and to open a case with one of our TAC engineers, visit http://www.cisco.com/tac/caseopen

If anyone else in the forum has some advice, please reply to this thread.

Thank you for posting.

j.joe · ‎01-23-2002

Please check your configuration on your w2k pro ws. The problem likes to be happen in your vpn client.

For the connection type, please ensure you are using custom setting with PAP, MSCHAP enabled.

Also check whether your PIX outside IP is a true IP?

agoodwin · ‎01-24-2002

Hi,

Thanks for the reply. It turns out I was using the wrong example for setting it up. I needed the 3000 client for the v6.1 pix I was using so you were right!

cheers

Andy