Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

PIX Management via VPN not working anymore


I have a weird problem that began after I upgraded a PIX 515 failover pair from 7.2(2) to 8.0(3). Everything seems to work OK, except remote management via VPN-client.

I've tried telnet and https but once the management connection is established there is no data received from the firewall, hence login is not possible… I used Wireshark to verify that a connection is established but after the 3-way handshake, there is nothing except a TCP packet that seems to be out of sequence.

I can manage the firewall using a PC on the inside network but that is a somewhat troublesome workaround.

VPN-client IP:

Firewall inside IP:

Some lines from the configuration:

access-list nonat extended permit ip

nat (inside) 0 access-list nonat

sysopt connection permit-vpn

management-access inside

telnet inside

route outside x.x.x.x

Any ideas?


Anders Fredriksson


Re: PIX Management via VPN not working anymore

For a /26 vpn pool net shouldn't nonat acl be more of:

access-list nonat extended permit ip

or perhaps /24 mask is a typo in your post?

other than this I do not see a reason what you would not be able to access firewall via vpn.. can you add above acl line and try, otherwise we'll think of something else..



New Member

Re: PIX Management via VPN not working anymore

Actually, there are some 5505 firewalls placed at network/system administrators homes. They use subnets within the same network as VPN clients, hence the difference in masks.

The thing is that packets are allowed in both directions but “sessions” aren't, e.g. ping works from a VPN client to the inside address. Also, when I connect using telnet there is a three-way handshake. The telnet window stays empty due to a session that never disconnects nor receives any data.


Re: PIX Management via VPN not working anymore


If ping works then it could be a fragmentation issue . Try to adjust TCP MSS value on PIX.

sysopt connection tcp-mss MSS_size_in_bytes

example : sysopt connection tcp-mss 1360

You can also find the exact size for your connection using extended ping utility from your workstation as explained in following link .



Pls rate it if it helps

CreatePlease login to create content