Hi all
I have troubles with a PIX 515-E VPN config. The PIX does a site to site VPN with another PIX which works fine. I have to add a dialin VPN for mobile workers. My configuration shows like below. I can dialin using the VPN Client V 4.0.1 and I receive an IP address (172.17.130.120). The Radius Authentication works fine. The only problem is that there is no back traffic to the VPN client. The statistics show me a number of bytes sent but 0 bytes received. When i delete the access-list ACLVPNTAG permit ip 172.17.128.0 255.255.252.0 host 172.17.130.120 then i receive bytes but only ISAKMP Informational packets. The packets sent from the mobile worker's machine get to the destination machine (something in 172.17.128.0 /22). Has anyone a idea?
Thanks very much
Regards Patrik
when access-list ACLVPNTAG permit ip 172.17.128.0 255.255.252.0 host 172.17.130.120 is deleted:
access-list dynacl16 turbo-configured; 1 elements
access-list dynacl16 line 1 permit ip any host 172.17.130.120 (hitcnt=2)
when access-list ACLVPNTAG permit ip 172.17.128.0 255.255.252.0 host 172.17.130.120 is present:
access-list dynacl14 turbo-configured; 1 elements
access-list dynacl14 line 1 permit ip any host 172.17.130.120 (hitcnt=0)
current config: --> site to site (operational), client to site (not operational)
access-list in2any permit ip 172.17.128.0 255.255.252.0 10.0.4.0 255.255.252.0
access-list ACLVPNTAG permit ip 172.17.128.0 255.255.252.0 10.0.4.0 255.255.252.0 log
access-list ACLVPNTAG permit ip 172.17.128.0 255.255.252.0 host 172.17.130.120
access-list ACLVPNTAG permit ip 172.17.128.0 255.255.252.0 host 172.17.130.121
access-list ACLVPNTAG permit ip 172.17.128.0 255.255.252.0 host 172.17.130.122
ip local pool DIALIN 172.17.130.120-172.17.130.122
global (outside) 1 interface
global (dmz) 1 interface
nat (inside) 0 access-list ACLVPNTAG
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
nat (dmz) 1 0.0.0.0 0.0.0.0 0 0
access-group out2any in interface outside
access-group in2any in interface inside
access-group dmz2any in interface dmz
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
aaa-server partnerauth protocol radius
aaa-server partnerauth (inside) host 172.17.128.75 xxxxx timeout 5
sysopt connection permit-ipsec
crypto ipsec transform-set TRANSVPNTAG esp-aes esp-md5-hmac
crypto ipsec transform-set TRANSDIALIN esp-des esp-md5-hmac
crypto dynamic-map DYNDIALIN 10 set transform-set TRANSDIALIN
crypto map CMAPVPNTAG 1 ipsec-isakmp
crypto map CMAPVPNTAG 1 match address ACLVPNTAG
crypto map CMAPVPNTAG 1 set peer x.x.x.x
crypto map CMAPVPNTAG 1 set transform-set TRANSVPNTAG
crypto map CMAPVPNTAG 10 ipsec-isakmp dynamic DYNDIALIN
crypto map CMAPVPNTAG client authentication partnerauth
crypto map CMAPVPNTAG interface outside
isakmp enable outside
isakmp key ******** address x.x.x.x netmask 255.255.255.255
isakmp identity address
isakmp policy 1 authentication pre-share
isakmp policy 1 encryption aes
isakmp policy 1 hash md5
isakmp policy 1 group 2
isakmp policy 1 lifetime 86400
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
vpngroup vpn3000 address-pool DIALIN
vpngroup vpn3000 dns-server 172.17.128.76 172.17.128.75
vpngroup vpn3000 wins-server 172.17.128.76 172.17.128.75
vpngroup vpn3000 default-domain adsdomain.com
vpngroup vpn3000 idle-time 1800
vpngroup vpn3000 password ********
