Buy or Renew
Buy or Renew
Duo Security forums now LIVE! Get answers to all your Duo Security questions. Learn more
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
530
Views
0
Helpful
3
Replies

PPTP PIX 506 WIN XP

jjdesimone
Level 1
Level 1

‎12-06-2002 09:53 AM - edited ‎02-20-2020 10:25 PM

I set up a PPTP connection.

I can connect with out any problem but I cannot browse the network.

Here is my configuration:

PIX Version 6.2(2)

nameif ethernet0 outside security0

nameif ethernet1 inside security100

enable password **moderator edit** encrypted

passwd **moderator edit** encrypted

hostname **moderator edit**

domain-name **moderator edit**

fixup protocol ftp 21

fixup protocol http 80

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol ils 389

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol sip 5060

fixup protocol skinny 2000

names

access-list nonat permit ip 10.10.10.0 255.255.255.0 172.16.1.0 255.255.255.0

no pager

logging on

logging trap debugging

logging host inside 10.10.10.10

interface ethernet0 10baset

interface ethernet1 10baset

mtu outside 1500

mtu inside 1500

ip address outside nnn.nnn.nn.98 255.255.255.240

ip address inside 10.10.10.1 255.255.255.0

ip audit info action alarm

ip audit attack action alarm

ip local pool test 172.16.1.1-172.16.1.255

ip local pool pptp-pool 11.11.11.1-11.11.11.50

pdm history enable

arp timeout 14400

global (outside) 1 nnn.nnn.61.99-nnn.nnn.61.107

global (outside) 1 nnn.nnn.61.108

nat (inside) 0 access-list nonat

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

static (inside,outside) nnn.nnn.nn.110 10.10.10.30 netmask 255.255.255.255 0 0

static (inside,outside) nnn.nnn.nn.65 10.10.10.28 netmask 255.255.255.255 0 0

static (inside,outside) nnn.nnn.nn.66 10.10.10.27 netmask 255.255.255.255 0 0

static (inside,outside) nnn.nnn.nn.67 10.10.10.26 netmask 255.255.255.255 0 0

static (inside,outside) nnn.nnn.nn.68 10.10.10.25 netmask 255.255.255.255 0 0

static (inside,outside) nnn.nnn.nn.69 10.10.10.24 netmask 255.255.255.255 0 0

static (inside,outside) nnn.nnn.nn.70 10.10.10.23 netmask 255.255.255.255 0 0

static (inside,outside) nnn.nnn.nn.71 10.10.10.22 netmask 255.255.255.255 0 0

static (inside,outside) nnn.nnn.nn.72 10.10.10.21 netmask 255.255.255.255 0 0

static (inside,outside) nnn.nnn.nn.73 10.10.10.20 netmask 255.255.255.255 0 0

static (inside,outside) nnn.nnn.nn.74 10.10.10.19 netmask 255.255.255.255 0 0

static (inside,outside) nnn.nnn.nn.75 10.10.10.18 netmask 255.255.255.255 0 0

static (inside,outside) nnn.nnn.nn.76 10.10.10.17 netmask 255.255.255.255 0 0

static (inside,outside) nnn.nnn.nn.77 10.10.10.16 netmask 255.255.255.255 0 0

static (inside,outside) nnn.nnn.nn.78 10.10.10.15 netmask 255.255.255.255 0 0

static (inside,outside) nnn.nnn.nn.79 10.10.10.14 netmask 255.255.255.255 0 0

static (inside,outside) nnn.nnn.nn.80 10.10.10.13 netmask 255.255.255.255 0 0

static (inside,outside) nnn.nnn.nn.81 10.10.10.12 netmask 255.255.255.255 0 0

static (inside,outside) nnn.nnn.nn.82 10.10.10.10 netmask 255.255.255.255 0 0

static (inside,outside) nnn.nnn.61.109 10.10.10.3 netmask 255.255.255.255 0 0

conduit permit icmp any any

conduit permit udp host nnn.nnn.61.110 any

conduit permit tcp host nnn.nnn.61.110 eq www any

conduit permit tcp host nnn.nnn.61.110 any

conduit permit tcp host nnn.nnn.61.109 eq www any

conduit permit tcp host nnn.nnn.61.16 any

conduit permit udp host nnn.nnn.61.16 any

conduit permit tcp host nnn.nnn.61.109 eq smtp any

conduit permit tcp host nnn.nnn.nn.65 eq pcanywhere-data any

conduit permit tcp host nnn.nnn.nn.66 eq pcanywhere-data any

conduit permit tcp host nnn.nnn.nn.67 eq pcanywhere-data any

conduit permit tcp host nnn.nnn.nn.68 eq pcanywhere-data any

conduit permit tcp host nnn.nnn.nn.69 eq pcanywhere-data any

conduit permit tcp host nnn.nnn.nn.70 eq pcanywhere-data any

conduit permit tcp host nnn.nnn.nn.71 eq pcanywhere-data any

conduit permit tcp host nnn.nnn.nn.72 eq pcanywhere-data any

conduit permit tcp host nnn.nnn.nn.73 eq pcanywhere-data any

conduit permit tcp host nnn.nnn.nn.74 eq pcanywhere-data any

conduit permit tcp host nnn.nnn.nn.75 any

conduit permit tcp host nnn.nnn.nn.76 any

conduit permit tcp host nnn.nnn.nn.77 any

conduit permit tcp host nnn.nnn.nn.78 any

conduit permit tcp host nnn.nnn.nn.79 eq pcanywhere-data any

conduit permit tcp host nnn.nnn.nn.80 eq pcanywhere-data any

conduit permit tcp host nnn.nnn.nn.81 eq pcanywhere-data any

conduit permit tcp host nnn.nnn.nn.82 eq pcanywhere-data any

conduit permit udp host nnn.nnn.nn.65 eq pcanywhere-status any

conduit permit udp host nnn.nnn.nn.66 eq pcanywhere-status any

conduit permit udp host nnn.nnn.nn.67 eq pcanywhere-status any

conduit permit udp host nnn.nnn.nn.68 eq pcanywhere-status any

conduit permit udp host nnn.nnn.nn.69 eq pcanywhere-status any

conduit permit udp host nnn.nnn.nn.70 eq pcanywhere-status any

conduit permit udp host nnn.nnn.nn.71 eq pcanywhere-status any

conduit permit udp host nnn.nnn.nn.72 eq pcanywhere-status any

conduit permit udp host nnn.nnn.nn.73 eq pcanywhere-status any

conduit permit udp host nnn.nnn.nn.74 eq pcanywhere-status any

conduit permit udp host nnn.nnn.nn.75 any

conduit permit udp host nnn.nnn.nn.76 any

conduit permit udp host nnn.nnn.nn.77 any

conduit permit udp host nnn.nnn.nn.78 any

conduit permit udp host nnn.nnn.nn.79 eq pcanywhere-status any

conduit permit udp host nnn.nnn.nn.80 eq pcanywhere-status any

conduit permit udp host nnn.nnn.nn.81 eq pcanywhere-status any

conduit permit udp host nnn.nnn.nn.82 eq pcanywhere-status any

conduit permit tcp host nnn.nnn.nn.83 eq pcanywhere-data any

conduit permit udp host nnn.nnn.nn.83 eq pcanywhere-status any

conduit permit tcp host nnn.nnn.61.109 eq pop3 any

route outside 0.0.0.0 0.0.0.0 nnn.nnn.61.97 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 si

p 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

aaa-server LOCAL protocol local

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

sysopt connection permit-ipsec

sysopt connection permit-pptp

no sysopt route dnat

crypto ipsec transform-set myset esp-des esp-md5-hmac

crypto dynamic-map dynmap 10 set transform-set myset

crypto map mymap 10 ipsec-isakmp dynamic dynmap

crypto map mymap client configuration address initiate

crypto map mymap client configuration address respond

crypto map mymap interface outside

isakmp enable outside

isakmp key ******** address 0.0.0.0 netmask 0.0.0.0

isakmp identity address

isakmp client configuration address-pool local test outside

isakmp policy 10 authentication pre-share

isakmp policy 10 encryption des

isakmp policy 10 hash md5

isakmp policy 10 group 1

isakmp policy 10 lifetime 86400

vpngroup vpn3000-all idle-time 1800

vpngroup vpn3000-all password ********

ca identity jmaggio 10.10.10.20:/certserv/mscep/mscep.dll

ca configure jmaggio ra 1 20 crloptional

telnet 10.10.10.0 255.255.255.0 inside

telnet timeout 20

ssh timeout 5

vpdn group 1 accept dialin pptp

vpdn group 1 ppp authentication pap

vpdn group 1 ppp authentication chap

vpdn group 1 ppp authentication mschap

vpdn group 1 client configuration address local pptp-pool

vpdn group 1 pptp echo 60

vpdn group 1 client authentication local

vpdn username cisco password *********

vpdn username twolcson password *********

vpdn enable outside

terminal width 80

Cryptochecksum:**moderator edit**

: end

What's wrong or what do I need to do?

0 Helpful
3 Replies 3

gfullage
Cisco Employee
Cisco Employee

‎12-06-2002 07:07 PM

Your PC needs a WINS server to browse any Microsoft network, but you're not sending one down to it. Try:

> vpdn group 1 client configuration wins x.x.x.x y.y.y.y

where x.x.x.x and y.y.y.y are your internal WINS servers. You can also send down DNS servers with the same command but replace "wins" with "dns".

See http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_62/cmdref/tz.htm#xtocid10

0 Helpful

jjdesimone
Level 1
Level 1
In response to gfullage

‎12-09-2002 06:03 AM

I tried that and wins is being sent to the remote pc, but I still cannot browse the network. I get an error message saying that I may not have permission, and I do have permission..... Please help!

0 Helpful

gfullage
Cisco Employee
Cisco Employee
In response to jjdesimone

‎12-11-2002 08:43 PM

I can't say I've ever seen a permission problem before, sounds like it is actually being able to browse it correctly but that you have some Windows issues. Were you getting the permissions problem before you sent down the WINS server in the PIX config?

You could try adding this WINS server inot the LMHOSTS file on the PC, but I doubt that'll make any difference, cause it does sound like you're getting past that point.

0 Helpful
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Customers Also Viewed These Support Documents
Review Cisco Networking products for a $25 gift card