Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

PIX501 to VPN Client - cannot access inside network with VPN Session

The following is based on the config at the attached link:

http://www.cisco.com/en/US/partner/tech/tk583/tk372/technologies_configuration_example09186a008009442e.shtml

PIX Ver 6.2(3) - VPN Client 3.3.6(A) - Windows XP Client PC

We can establish the VPN session to the PIX501, however we cannot access the Private Network behind the pix.

Below is the config - I can't determine why this doesn't work, we are desparate to get this done ASAP!!

We have the same problem with client 4.0.3(c)

Thanks in advance for any help!!!

=======================================

AKCPIX00# sh run

: Saved

:

PIX Version 6.2(3)

nameif ethernet0 outside security0

nameif ethernet1 inside security100

hostname AKCPIX00

domain-name domain.com

fixup protocol ftp 21

fixup protocol http 80

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol ils 389

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol sip 5060

fixup protocol skinny 2000

fixup protocol sip udp 5060

names

access-list 101 permit ip 192.168.1.0 255.255.255.0 10.0.0.0 255.255.255.0

pager lines 24

interface ethernet0 10baset

interface ethernet1 10full

mtu outside 1500

mtu inside 1500

ip address outside #.#.#.# 255.255.240.0

ip address inside 192.168.1.5 255.255.255.0

ip audit info action alarm

ip audit attack action alarm

ip local pool akcpool 10.0.0.1-10.0.0.10

pdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list 101

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

route outside 0.0.0.0 0.0.0.0 #.#.#.# 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

aaa-server LOCAL protocol local

aaa authentication ssh console LOCAL

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

sysopt connection permit-ipsec

no sysopt route dnat

crypto ipsec transform-set myset esp-des esp-md5-hmac

crypto dynamic-map dynmap 10 set transform-set myset

crypto map mymap 10 ipsec-isakmp dynamic dynmap

crypto map mymap interface outside

isakmp enable outside

isakmp policy 10 authentication pre-share

isakmp policy 10 encryption des

isakmp policy 10 hash md5

isakmp policy 10 group 2

isakmp policy 10 lifetime 86400

vpngroup akcgroup address-pool akcpool

vpngroup akcgroup dns-server 192.168.1.10

vpngroup akcgroup default-domain domain.com

vpngroup akcgroup split-tunnel 101

vpngroup akcgroup idle-time 1800

vpngroup akcgroup password ********

vpngroup akc idle-time 1800

telnet timeout 5

ssh #.#.#.# 255.255.255.255 outside

ssh timeout 15

dhcpd address 192.168.1.100-192.168.1.130 inside

dhcpd dns 192.168.1.10

dhcpd lease 3600

dhcpd ping_timeout 750

dhcpd enable inside

terminal width 80

Cryptochecksum:xxxxx

: end

AKCPIX00#

1 ACCEPTED SOLUTION

Accepted Solutions
Silver

Re: PIX501 to VPN Client - cannot access inside network with VPN

Config looks good - just like mine for my home lan. Only thing I can think of is that you might have entered commands in the wrong order - meaning, you might have enabled isakmp or the crypto map before the config was complete. Write memory, and reloading the pix is one way to reinitialize everything. If you don't want down time:

crypto map mymap interface outside

isakmp enable outside

Re-entering those two commands should be enough to reinitialize both the ipsec and isakmp functions.

2 REPLIES
Silver

Re: PIX501 to VPN Client - cannot access inside network with VPN

Config looks good - just like mine for my home lan. Only thing I can think of is that you might have entered commands in the wrong order - meaning, you might have enabled isakmp or the crypto map before the config was complete. Write memory, and reloading the pix is one way to reinitialize everything. If you don't want down time:

crypto map mymap interface outside

isakmp enable outside

Re-entering those two commands should be enough to reinitialize both the ipsec and isakmp functions.

New Member

Re: PIX501 to VPN Client - cannot access inside network with VPN

That worked perfectly!

I also realized that in addition to the sequencing problem that I had to remove the PC from the NAT side of my network and give it a static public IP.

Thanks!

93
Views
0
Helpful
2
Replies