cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
559
Views
3
Helpful
11
Replies

Can a PIX 501allow VPN connection through it?

johnroche_2
Level 1
Level 1

Hi

I have a Pix 501 setup with an ADSL providing internet connectivity.

Can a device on the inside (i.e a laptop with a DHCP address from the PIX) initiate a VPN connection through the PIX to connect to another network.

At Present if I want to connect to my office via vpn I have to disconnect the cable on the ouside interface and connect it directly my laptop.

John

11 Replies 11

pcomeaux
Cisco Employee
Cisco Employee

I have a Pix 501 and I vpn to the Cisco network from home. My laptop gets a 192.168.1.x address from the pix 501.

I use the Cisco VPN client to connect back to Cisco. The trick is that Transparent Tunneling needs to be enabled on the client and the concentrator for this to work.

What VPN client and head-end device are you using?

peter

Hi

At the office I have a 3000 series concentrator (3005)

I connect using windows 2000 native client (pptp)

John

If you are using a 3000 series concentrator could you not establish a vpn tunnel using a Lan-to-Lan connection using the Pix501 to your concentrator. This way all your clients would be connected to the home office through that tunnel instead of each client using their own vpn connection.

I could but I use pix to secure my personal isp connection for my home pc and xbox. So I dont really want to be connected to work all the time.

If I used the LAN to LAN tunnel Would I not have to reconfigure the pix each time for normal access?

normal access? do u mean normal internet access from pc and xbox? if so, it shouldn't be a problem.

access-list 101 permit ip host

the only traffic going through the tunnel is what u defined in the access list. moreover, u can set timeout on the tunnel, so that it won't stay up all time.

in version 6.3(1) they added pptp fixup upgrade to 6.3(1) or 6.3(2) and enable that and if your VPN is PPTP it will work.

Hi

I entered the PPTP fixup. however the VPN still does not work. It get as far as trying to verify the username and password. any ideas?

I have included the current config

John

PIX Version 6.3(2)

interface ethernet0 10full

interface ethernet1 100full

nameif ethernet0 outside security0

nameif ethernet1 inside security100

enable password xxxxxx encrypted

passwd xxxxxx encrypted

hostname homefirewall

domain-name ciscopix.com

fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol pptp 1723

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69

names

pager lines 24

mtu outside 1500

mtu inside 1500

ip address outside dhcp setroute

ip address inside xxxx.xxxx.xxx.1 255.255.255.0

ip audit info action alarm

ip audit attack action alarm

pdm logging informational 100

pdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

timeout xlate 0:05:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

aaa-server LOCAL protocol local

http server enable

http xxxx.xxxx.xxx.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

telnet timeout 5

ssh timeout 5

console timeout 0

dhcpd address 192.168.1.2-192.168.1.129 inside

dhcpd dns 192.111.39.1 192.111.39.4

dhcpd lease 3600

dhcpd ping_timeout 750

dhcpd auto_config outside

dhcpd enable inside

terminal width 80

Cryptochecksum:xxxxxx

: end

[OK]

what's the os on your pc?

Windows XP professional

Service pack 1 a

i did open a case with cisco tac and i'm told that vpn client software is not working perfectly with xp.

anyway, you may try to connect your pc directly to adsl modem. in that case, we can make sure what was the issue, pix config or your pc.

I did not try the cisco vpn client software, just set up a PPTP client under network and dial up settings

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: