I plan to config my 4 pix 515e at easy VPN mode, one is for central office working as easy server, others in 3 branch office as easy VPN remote device.
each branch should be let one pc just access internet, other pc should access the intranet behind the server, include a WWW server, a AS400 (by telnet), and another AS400 in other subnet. The VPN server should be let the people at home access same resource by VPN via dialup.
What I have done is:
(1) At client side set the PIX as PPPoE can get the IP address from ISP
(2) At server side there is a ADSL router 213.26.xxx.xx5 and the outside ip
(4) access-list 100 permit ip host xxx.xxx.xxx.xxx( Http server, AS400) 10.0.2.0 255.255.255.248 and so on
nat (inside) 0 access-list 100
(5) VPNgroup , isakmp ,crypto map
(6) xauth is a radius. indentity the domain user id and password
I have set up my VPN server, and one pix in one branch as easy VPN mode. it seems fit my needs, but I got some problems.
(1) The pc in branch for internet can not access internet. I try to config split tunneling at server side(by PDM), and finished by VPN wizard, but when I try a test by a dialup access, the PIX server reboot, so no VPN tunnel built.
(2) Without split tunneling, the user in branch can access intranet. It's ok. but, they can ping the IP address of my http server, can not access it. the log file says "%PIX-4-402106: Rec'd packet not an IPSEC packet. (ip) dest_addr= 213.26.xxx.xx6, src_addr= 213.26.xxx.xx5, prot= icmp" what is mean?
(3) In client PIX side I config vpnclient username password as one people's domain user id and password, but he has no right to access a application in AS400, when other people telnet to th AS400 though the VPN and log on, then he fail to access the application. but when I do a test from a dialup user, and try the same thing, this time it works. why make it happen? should I setting a username in "vpnclient username xxx password xxx" command with the enough right?
DocumentationPrerequisite and code download linksGoalLimitations/RestrictionsTopologyHow OpenDNS worksStep by Step ConfigurationUpgrade the router image to Polaris (16.3) or higher imageUpgrade rommomImport CA certificate to the trust poolGet the t...
DocumentationPrerequisite and code download linksGoalLimitations/RestrictionsTopologyHow OpenDNS worksStep by Step ConfigurationUpgrade the router image to Polaris (16.3) or higher imageUpgrade rommomImport CA certificate to the trust poolGet the token to...
Show Name: ASA/FTD Troubleshooting Enhancements and Cisco Live US 2018
Contributors: Kevin Klous, Jay Johnston, and Magnus Mortensen
Posting Date: June 2018
Description: The team discusses the recently released troubleshooting...