I plan to config my 4 pix 515e at easy VPN mode, one is for central office working as easy server, others in 3 branch office as easy VPN remote device.
each branch should be let one pc just access internet, other pc should access the intranet behind the server, include a WWW server, a AS400 (by telnet), and another AS400 in other subnet. The VPN server should be let the people at home access same resource by VPN via dialup.
What I have done is:
(1) At client side set the PIX as PPPoE can get the IP address from ISP
(2) At server side there is a ADSL router 213.26.xxx.xx5 and the outside ip
(4) access-list 100 permit ip host xxx.xxx.xxx.xxx( Http server, AS400) 10.0.2.0 255.255.255.248 and so on
nat (inside) 0 access-list 100
(5) VPNgroup , isakmp ,crypto map
(6) xauth is a radius. indentity the domain user id and password
I have set up my VPN server, and one pix in one branch as easy VPN mode. it seems fit my needs, but I got some problems.
(1) The pc in branch for internet can not access internet. I try to config split tunneling at server side(by PDM), and finished by VPN wizard, but when I try a test by a dialup access, the PIX server reboot, so no VPN tunnel built.
(2) Without split tunneling, the user in branch can access intranet. It's ok. but, they can ping the IP address of my http server, can not access it. the log file says "%PIX-4-402106: Rec'd packet not an IPSEC packet. (ip) dest_addr= 213.26.xxx.xx6, src_addr= 213.26.xxx.xx5, prot= icmp" what is mean?
(3) In client PIX side I config vpnclient username password as one people's domain user id and password, but he has no right to access a application in AS400, when other people telnet to th AS400 though the VPN and log on, then he fail to access the application. but when I do a test from a dialup user, and try the same thing, this time it works. why make it happen? should I setting a username in "vpnclient username xxx password xxx" command with the enough right?
Show Name: Thoughts on Security at Cisco Live US 2018 in Orlando
Contributors: Kevin Klous, David White Jr., Aaron Woland, Jeff Fanelli
Posting Date: June 2018
Description: The team goes on-site in the Cisco Live Speaker room in...
RADIUS and Symantec VIP.
I will use screenshots of ASDM, and at the end I will add the required CLI commands. the diagram below show a diagram of the steps the FW goes through when using 2FA authentication:
As you can see in Fig. 1&nbs...