I plan to config my 4 pix 515e at easy VPN mode, one is for central office working as easy server, others in 3 branch office as easy VPN remote device.
each branch should be let one pc just access internet, other pc should access the intranet behind the server, include a WWW server, a AS400 (by telnet), and another AS400 in other subnet. The VPN server should be let the people at home access same resource by VPN via dialup.
What I have done is:
(1) At client side set the PIX as PPPoE can get the IP address from ISP
(2) At server side there is a ADSL router 213.26.xxx.xx5 and the outside ip
(4) access-list 100 permit ip host xxx.xxx.xxx.xxx( Http server, AS400) 10.0.2.0 255.255.255.248 and so on
nat (inside) 0 access-list 100
(5) VPNgroup , isakmp ,crypto map
(6) xauth is a radius. indentity the domain user id and password
I have set up my VPN server, and one pix in one branch as easy VPN mode. it seems fit my needs, but I got some problems.
(1) The pc in branch for internet can not access internet. I try to config split tunneling at server side(by PDM), and finished by VPN wizard, but when I try a test by a dialup access, the PIX server reboot, so no VPN tunnel built.
(2) Without split tunneling, the user in branch can access intranet. It's ok. but, they can ping the IP address of my http server, can not access it. the log file says "%PIX-4-402106: Rec'd packet not an IPSEC packet. (ip) dest_addr= 213.26.xxx.xx6, src_addr= 213.26.xxx.xx5, prot= icmp" what is mean?
(3) In client PIX side I config vpnclient username password as one people's domain user id and password, but he has no right to access a application in AS400, when other people telnet to th AS400 though the VPN and log on, then he fail to access the application. but when I do a test from a dialup user, and try the same thing, this time it works. why make it happen? should I setting a username in "vpnclient username xxx password xxx" command with the enough right?
Helps meet PCI* compliance.
Threat protection built into ISR and ISRv branch routers and CSR
Complements ISR Integrated Security
Lightweight IPS solution with low TCO (Total Cost of Ownership) and automated signature updates
Supports VRF (16.6)
Login to the FXOS chassis manager.
Direct your browser to https://hostname/, and log-in using the user-name and password.
Go to Help > About and check the current version:
Check the current version availa...
We have configured the outside and inside Interface with official ipv6 adresses, set a default route on outside Interface to our router, we also have definied a rule , which also gets hits, to permit tcp from inside Interface to any6.
In Syslog I also se...