Can't Connect to Pix 501 VPN on Network

drichards38 · ‎09-03-2012

Hi All,

I have a software VPN client that connects just fine to the PIX 501 VPN, but I cannot ping or telnet to any services on the LAN. Below is my config and results of show cry ipsec sa. I would appreciate any suggestions to fix this.

It's been a while since I have done this. When I check the DHCP address received from the VPN, the default gateway is missing. IIRC, that is normal. What is strange is that when I ping, Windows does not show any sent packets.

Thanks,

--Drichards38

PIX Version 6.3(3)

interface ethernet0 auto

interface ethernet1 100full

nameif ethernet0 outside security0

nameif ethernet1 inside security100

enable password bgVy005CZTsaMOwR encrypted

passwd bgVy005CZTsaMOwR encrypted

hostname cisco

domain-name xxxxxx.biz

fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol ftp 1024-2048

fixup protocol ftp 49152-65534

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69

names

access-list acl-out permit tcp any interface outside eq www

access-list acl_out permit tcp any host aa.bb.cc.dd eq telnet

access-list acl_out permit tcp any host aa.bb.cc.dd eq 3389

access-list acl_out permit tcp any host aa.bb.cc.dd eq 60990

access-list acl_out permit tcp any host aa.bb.cc.dd eq www

access-list acl_out permit tcp any host aa.bb.cc.dd eq echo

access-list acl_out permit tcp any host aa.bb.cc.dd eq ftp

access-list acl_out permit tcp any host aa.bb.cc.dd eq https

access-list acl_out permit tcp any interface inside eq www

access-list acl_out permit tcp any interface inside eq ftp

access-list acl_out permit tcp any interface inside eq 3389

access-list acl_out permit tcp any interface inside eq https

access-list acl_out permit tcp any host aa.bb.cc.dd eq www

access-list acl_out permit tcp any host aa.bb.cc.dd eq https

access-list acl_out permit tcp any host aa.bb.cc.dd eq 3389

access-list acl_out permit tcp any host aa.bb.cc.dd eq www

access-list acl_out permit tcp any host aa.bb.cc.dd eq https

access-list acl_out permit tcp any host aa.bb.cc.dd eq 3389

access-list acl_out permit tcp any host aa.bb.cc.dd eq ftp

access-list acl_out permit tcp any host aa.bb.cc.dd eq www

access-list acl_out permit tcp any host aa.bb.cc.dd eq https

access-list acl_out permit tcp any host aa.bb.cc.dd eq 3389

access-list acl_out permit tcp any host aa.bb.cc.dd eq 902

access-list acl_out permit tcp any host aa.bb.cc.dd eq ftp

access-list acl_out permit tcp any host aa.bb.cc.dd eq www

access-list acl_out permit tcp any host aa.bb.cc.dd eq ftp

access-list acl_out permit tcp any host aa.bb.cc.dd eq https

access-list acl_out permit tcp any host aa.bb.cc.dd eq 3389

access-list acl_out permit tcp any host aa.bb.cc.dd eq www

access-list acl_out permit tcp any host aa.bb.cc.dd eq ftp

access-list acl_out permit tcp any host aa.bb.cc.dd eq https

access-list acl_out permit tcp any host aa.bb.cc.dd eq 3389

access-list acl_out permit tcp any host aa.bb.cc.dd eq www

access-list acl_out permit tcp any host aa.bb.cc.dd eq https

access-list acl_out permit tcp any host aa.bb.cc.dd eq ftp

access-list acl_out permit tcp any host aa.bb.cc.dd eq 3389

access-list outside_cryptomap_dyn_20 permit ip any 10.0.0.0 255.0.0.0

access-list split_tunnel_acl permit ip 10.0.0.0 255.0.0.0 any

pager lines 24

mtu outside 1500

mtu inside 1500

ip address outside aa.bb.cc.dd 255.255.255.240

ip address inside 192.168.93.1 255.255.255.0

ip audit info action alarm

ip audit attack action alarm

ip local pool low_vpn_pool 10.0.1.205-10.0.1.210

pdm location 172.16.0.0 255.255.0.0 inside

pdm logging informational 100

pdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 1 192.168.93.0 255.255.255.0 0 0

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

static (inside,outside) aa.bb.cc.dd 192.168.93.67 netmask 255.255.255.255 0 0

static (inside,outside) aa.bb.cc.dd 192.168.93.68 netmask 255.255.255.255 0 0

static (inside,outside) aa.bb.cc.dd 192.168.93.69 netmask 255.255.255.255 0 0

static (inside,outside) aa.bb.cc.dd 192.168.93.70 netmask 255.255.255.255 0 0

static (inside,outside) aa.bb.cc.dd 192.168.93.71 netmask 255.255.255.255 0 0

static (inside,outside) aa.bb.cc.dd 192.168.93.72 netmask 255.255.255.255 0 0

static (inside,outside) aa.bb.cc.dd 192.168.93.73 netmask 255.255.255.255 0 0

static (inside,outside) aa.bb.cc.dd 192.168.93.74 netmask 255.255.255.255 0 0

static (inside,outside) aa.bb.cc.dd 192.168.93.75 netmask 255.255.255.255 0 0

static (inside,outside) aa.bb.cc.dd 192.168.93.76 netmask 255.255.255.255 0 0

static (inside,outside) aa.bb.cc.dd 192.168.93.77 netmask 255.255.255.255 0 0

static (inside,outside) aa.bb.cc.dd 192.168.93.78 netmask 255.255.255.255 0 0

access-group acl_out in interface outside

rip inside default version 1

route outside 0.0.0.0 0.0.0.0 aa.bb.cc.dd 1

timeout xlate 0:05:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

aaa-server LOCAL protocol local

aaa authorization command LOCAL

http server enable

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

sysopt connection permit-ipsec

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20

crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5

crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map

crypto map outside_map client authentication LOCAL

crypto map outside_map interface outside

isakmp enable outside

isakmp nat-traversal 20

isakmp policy 20 authentication pre-share

isakmp policy 20 encryption 3des

isakmp policy 20 hash md5

isakmp policy 20 group 2

isakmp policy 20 lifetime 86400

vpngroup MY_VPN address-pool low_vpn_pool

vpngroup MY_VPN dns-server 4.2.2.1

vpngroup MY_VPN default-domain xxxxx.biz

vpngroup MY_VPN split-tunnel split_tunnel_acl

vpngroup MY_VPN idle-time 1800

vpngroup MY_VPN password ********

telnet 0.0.0.0 255.255.255.255 outside

telnet 192.168.93.0 255.255.255.0 inside

telnet timeout 5

ssh 0.0.0.0 0.0.0.0 outside

ssh timeout 60

console timeout 0

dhcpd address 192.168.93.230-192.168.93.240 inside

dhcpd dns ff.gg.hh.ii ff.gg.hh.ii

dhcpd lease 65536

dhcpd ping_timeout 750

dhcpd domain xxxxxx.biz

dhcpd auto_config outside

dhcpd enable inside

username xxxx password xxxxxxx encrypted privilege 15

cisco(config)# show cry ipsec sa

interface: outside

Crypto map tag: outside_map, local addr. aa.bb.cc.dd

local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)

remote ident (addr/mask/prot/port): (10.0.1.205/255.255.255.255/0/0)

current_peer: jj.kk.ll.mm:1265

dynamic allocated peer ip: 10.0.1.205

PERMIT, flags={transport_parent,}

#pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0

#pkts decaps: 38, #pkts decrypt: 38, #pkts verify 38

#pkts compressed: 0, #pkts decompressed: 0

#pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0

#send errors 0, #recv errors 0

local crypto endpt.: aa.bb.cc.dd, remote crypto endpt.: 97.93.95.133

path mtu 1500, ipsec overhead 64, media mtu 1500

current outbound spi: 3a898e67

inbound esp sas:

spi: 0xeeb64931(4004923697)

transform: esp-3des esp-md5-hmac ,

in use settings ={Tunnel UDP-Encaps, }

slot: 0, conn id: 1, crypto map: outside_map

sa timing: remaining key lifetime (k/sec): (4607993/28610)

IV size: 8 bytes

replay detection support: Y

inbound ah sas:

inbound pcp sas:

outbound esp sas:

spi: 0x3a898e67(982093415)

transform: esp-3des esp-md5-hmac ,

in use settings ={Tunnel UDP-Encaps, }

slot: 0, conn id: 2, crypto map: outside_map

sa timing: remaining key lifetime (k/sec): (4608000/28574)

IV size: 8 bytes

replay detection support: Y

outbound ah sas:

outbound pcp sas:

shikhsha · ‎09-03-2012

Hi Deryck,

Your NAT-Exemption is missing. Issue the following commands on the pix:

access-list nat-exempt permit ip any 10.0.1.0 255.255.255.0

nat (inside) 0 access-list nat-exempt

You can also replace any keyword with your specific internal networks, if you want.

This should fix it.

Shikhar Sharma

CCIE Security # 29741

Cisco TAC - VPN Team

drichards38 · ‎09-03-2012

Hi Shikhar,

Thanks for the response. I added the two lines, but I still cannot ping on the local network.

When I run an ipconfig in Windows after connecting to the VPN, this is what I get:

Ethernet adapter Local Area Connection 3:

Connection-specific DNS Suffix: xxxx.biz

IP Address: 10.0.1.205

Subnet Mask: 255.0.0.0

Default Gateway:

Should I see a default gateway listed here? Is there something I need to do to make the Pix respond on a 10.0.1.x address?

Thanks,

Deryck

drichards38 · ‎09-03-2012

The one thing that I keep seeing is that there are 0 packets being sent from my Windows XP machine when connected to the VPN. Here is a result of route PRINT from Windows while connected to the VPN:

===========================================================================

Interface List

0x1 ........................... MS TCP Loopback interface

0x2 ...00 80 45 22 b8 d3 ...... Realtek RTL8139/810x Family Fast Ethernet NIC - Packet Scheduler Miniport

0x10004 ...7a 79 05 1e 40 28 ...... Hamachi Network Interface - Deterministic Network Enhancer Miniport

0x10005 ...f8 d1 11 12 f1 86 ...... 802.11n USB Wireless LAN Card - Packet Scheduler Miniport

0x30006 ...00 05 9a 3c 78 00 ...... Cisco Systems VPN Adapter - Packet Scheduler Miniport

===========================================================================

Active Routes:

Network Destination Netmask Gateway Interface Metric

0.0.0.0 0.0.0.0 172.16.0.1 172.16.0.11 20

5.0.0.0 255.0.0.0 5.30.64.40 5.30.64.40 20

5.30.64.40 255.255.255.255 127.0.0.1 127.0.0.1 20

5.255.255.255 255.255.255.255 5.30.64.40 5.30.64.40 20

10.0.0.0 255.0.0.0 10.0.1.205 10.0.1.205 1

10.0.1.205 255.255.255.255 127.0.0.1 127.0.0.1 25

10.255.255.255 255.255.255.255 10.0.1.205 10.0.1.205 25

24.43.158.146 255.255.255.255 172.16.0.1 172.16.0.11 1

127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1

172.16.0.0 255.255.0.0 172.16.0.11 172.16.0.11 20

172.16.0.1 255.255.255.255 172.16.0.11 172.16.0.11 1

172.16.0.11 255.255.255.255 127.0.0.1 127.0.0.1 20

172.16.255.255 255.255.255.255 172.16.0.11 172.16.0.11 20

224.0.0.0 240.0.0.0 5.30.64.40 5.30.64.40 20

224.0.0.0 240.0.0.0 10.0.1.205 10.0.1.205 25

224.0.0.0 240.0.0.0 172.16.0.11 172.16.0.11 20

255.255.255.255 255.255.255.255 5.30.64.40 5.30.64.40 1

255.255.255.255 255.255.255.255 10.0.1.205 2 1

255.255.255.255 255.255.255.255 10.0.1.205 10.0.1.205 1

255.255.255.255 255.255.255.255 172.16.0.11 172.16.0.11 1

Default Gateway: 172.16.0.1

===========================================================================

Persistent Routes:

None

drichards38 · ‎09-03-2012

I just set the logging to high on all areas of the Cisco VPN client. Below is the resulting log. Everything looks ok from here:

Cisco Systems VPN Client Version 5.0.03.0530

Client Type(s): Windows, WinNT

Running on: 5.1.2600 Service Pack 3

29 09:57:02.887 09/03/12 Sev=Info/4 CM/0x63100002

Begin connection process

30 09:57:02.897 09/03/12 Sev=Info/4 CM/0x63100004

Establish secure connection

31 09:57:02.897 09/03/12 Sev=Info/4 CM/0x63100024

Attempt connection with server "a.b.c.d"

32 09:57:02.907 09/03/12 Sev=Info/6 IKE/0x6300003B

Attempting to establish a connection with a.b.c.d.

33 09:57:02.917 09/03/12 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK AG (SA, KE, NON, ID, VID(Xauth), VID(dpd), VID(Frag), VID(Nat-T), VID(Unity)) to a.b.c.d

34 09:57:03.228 09/03/12 Sev=Info/4 IPSEC/0x63700008

IPSec driver successfully started

35 09:57:03.228 09/03/12 Sev=Info/4 IPSEC/0x63700014

Deleted all keys

36 09:57:03.228 09/03/12 Sev=Info/6 IPSEC/0x6370002C

Sent 47 packets, 0 were fragmented.

37 09:57:03.979 09/03/12 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = a.b.c.d

38 09:57:03.979 09/03/12 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK AG (SA, VID(Xauth), VID(dpd), VID(Unity), VID(?), KE, ID, NON, VID(?), VID(Nat-T), NAT-D, NAT-D, HASH) from a.b.c.d

39 09:57:04.039 09/03/12 Sev=Info/6 GUI/0x63B00012

Authentication request attributes is 6h.

40 09:57:03.979 09/03/12 Sev=Info/5 IKE/0x63000001

Peer supports XAUTH

41 09:57:03.979 09/03/12 Sev=Info/5 IKE/0x63000001

Peer supports DPD

42 09:57:03.979 09/03/12 Sev=Info/5 IKE/0x63000001

Peer is a Cisco-Unity compliant peer

43 09:57:03.979 09/03/12 Sev=Info/5 IKE/0x63000082

Received IOS Vendor ID with unknown capabilities flag 0x000000A5

44 09:57:03.979 09/03/12 Sev=Info/5 IKE/0x63000001

Peer supports NAT-T

45 09:57:03.999 09/03/12 Sev=Info/6 IKE/0x63000001

IOS Vendor ID Contruction successful

46 09:57:03.999 09/03/12 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK AG *(HASH, NOTIFY:STATUS_INITIAL_CONTACT, NAT-D, NAT-D, VID(?), VID(Unity)) to a.b.c.d

47 09:57:03.999 09/03/12 Sev=Info/6 IKE/0x63000055

Sent a keepalive on the IPSec SA

48 09:57:03.999 09/03/12 Sev=Info/4 IKE/0x63000083

IKE Port in use - Local Port = 0x0421, Remote Port = 0x1194

49 09:57:03.999 09/03/12 Sev=Info/5 IKE/0x63000072

Automatic NAT Detection Status:

Remote end is NOT behind a NAT device

This end IS behind a NAT device

50 09:57:03.999 09/03/12 Sev=Info/4 CM/0x6310000E

Established Phase 1 SA. 1 Crypto Active IKE SA, 0 User Authenticated IKE SA in the system

51 09:57:04.029 09/03/12 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = a.b.c.d

52 09:57:04.029 09/03/12 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:STATUS_INITIAL_CONTACT) from a.b.c.d

53 09:57:04.029 09/03/12 Sev=Warning/2 IKE/0xA3000067

Received Unexpected InitialContact Notify (PLMgrNotify:886)

54 09:57:04.039 09/03/12 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = a.b.c.d

55 09:57:04.039 09/03/12 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:STATUS_RESP_LIFETIME) from a.b.c.d

56 09:57:04.039 09/03/12 Sev=Info/5 IKE/0x63000045

RESPONDER-LIFETIME notify has value of 86400 seconds

57 09:57:04.039 09/03/12 Sev=Info/5 IKE/0x63000047

This SA has already been alive for 2 seconds, setting expiry to 86398 seconds from now

58 09:57:04.039 09/03/12 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = a.b.c.d

59 09:57:04.039 09/03/12 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from a.b.c.d

60 09:57:04.039 09/03/12 Sev=Info/4 CM/0x63100015

Launch xAuth application

61 09:57:09.327 09/03/12 Sev=Info/4 CM/0x63100017

xAuth application returned

62 09:57:09.327 09/03/12 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to a.b.c.d

63 09:57:09.367 09/03/12 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = a.b.c.d

64 09:57:09.367 09/03/12 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from a.b.c.d

65 09:57:09.367 09/03/12 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to a.b.c.d

66 09:57:09.367 09/03/12 Sev=Info/4 CM/0x6310000E

Established Phase 1 SA. 1 Crypto Active IKE SA, 1 User Authenticated IKE SA in the system

67 09:57:09.387 09/03/12 Sev=Info/5 IKE/0x6300005E

Client sending a firewall request to concentrator

68 09:57:09.387 09/03/12 Sev=Info/5 IKE/0x6300005D

Firewall Policy: Product=Cisco Systems Integrated Client Firewall, Capability= (Centralized Protection Policy).

69 09:57:09.387 09/03/12 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to a.b.c.d

70 09:57:09.427 09/03/12 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = a.b.c.d

71 09:57:09.427 09/03/12 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from a.b.c.d

72 09:57:09.427 09/03/12 Sev=Info/5 IKE/0x63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_ADDRESS: , value = 10.0.1.205

73 09:57:09.427 09/03/12 Sev=Info/5 IKE/0x63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS(1): , value = 4.2.2.1

74 09:57:09.427 09/03/12 Sev=Info/5 IKE/0x6300000E

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_DEFDOMAIN: , value = xxxx.biz

75 09:57:09.427 09/03/12 Sev=Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SPLIT_INCLUDE (# of split_nets), value = 0x00000001

76 09:57:09.427 09/03/12 Sev=Info/5 IKE/0x6300000F

SPLIT_NET #1

subnet = 10.0.0.0

mask = 255.0.0.0

protocol = 0

src port = 0

dest port=0

77 09:57:09.427 09/03/12 Sev=Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_PFS: , value = 0x00000000

78 09:57:09.427 09/03/12 Sev=Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = Received and using NAT-T port number , value = 0x00001194

79 09:57:09.427 09/03/12 Sev=Info/4 CM/0x63100019

Mode Config data received

80 09:57:09.427 09/03/12 Sev=Info/4 IKE/0x63000056

Received a key request from Driver: Local IP = 10.0.1.205, GW IP = a.b.c.d, Remote IP = 0.0.0.0

81 09:57:09.437 09/03/12 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK QM *(HASH, SA, NON, ID, ID) to a.b.c.d

82 09:57:09.477 09/03/12 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = a.b.c.d

83 09:57:09.477 09/03/12 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK QM *(HASH, SA, NON, ID, ID, NOTIFY:STATUS_RESP_LIFETIME) from a.b.c.d

84 09:57:09.477 09/03/12 Sev=Info/5 IKE/0x63000045

RESPONDER-LIFETIME notify has value of 28800 seconds

85 09:57:09.477 09/03/12 Sev=Info/5 IKE/0x63000046

RESPONDER-LIFETIME notify has value of 4608000 kb

86 09:57:09.477 09/03/12 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK QM *(HASH) to a.b.c.d

87 09:57:09.477 09/03/12 Sev=Info/5 IKE/0x63000059

Loading IPsec SA (MsgID=D70550E6 OUTBOUND SPI = 0xB335C6DA INBOUND SPI = 0xE99E1A59)

88 09:57:09.477 09/03/12 Sev=Info/5 IKE/0x63000025

Loaded OUTBOUND ESP SPI: 0xB335C6DA

89 09:57:09.477 09/03/12 Sev=Info/5 IKE/0x63000026

Loaded INBOUND ESP SPI: 0xE99E1A59

90 09:57:09.527 09/03/12 Sev=Info/5 CVPND/0x63400013

Destination Netmask Gateway Interface Metric

0.0.0.0 0.0.0.0 172.16.0.1 172.16.0.11 25

127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1

172.16.0.0 255.255.0.0 172.16.0.11 172.16.0.11 25

172.16.0.11 255.255.255.255 127.0.0.1 127.0.0.1 25

172.16.255.255 255.255.255.255 172.16.0.11 172.16.0.11 25

224.0.0.0 240.0.0.0 172.16.0.11 172.16.0.11 25

255.255.255.255 255.255.255.255 172.16.0.11 0.0.0.0 1

255.255.255.255 255.255.255.255 172.16.0.11 172.16.0.11 1

91 09:57:10.448 09/03/12 Sev=Info/4 CM/0x63100034

The Virtual Adapter was enabled:

IP=10.0.1.205/255.0.0.0

DNS=4.2.2.1,0.0.0.0

WINS=0.0.0.0,0.0.0.0

Domain=xxxx.biz

Split DNS Names=

92 09:57:10.458 09/03/12 Sev=Info/5 CVPND/0x63400013

Destination Netmask Gateway Interface Metric

0.0.0.0 0.0.0.0 172.16.0.1 172.16.0.11 25

10.0.0.0 255.0.0.0 10.0.1.205 10.0.1.205 25

10.0.1.205 255.255.255.255 127.0.0.1 127.0.0.1 25

10.255.255.255 255.255.255.255 10.0.1.205 10.0.1.205 25

127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1

172.16.0.0 255.255.0.0 172.16.0.11 172.16.0.11 25

172.16.0.11 255.255.255.255 127.0.0.1 127.0.0.1 25

172.16.255.255 255.255.255.255 172.16.0.11 172.16.0.11 25

224.0.0.0 240.0.0.0 10.0.1.205 10.0.1.205 25

224.0.0.0 240.0.0.0 172.16.0.11 172.16.0.11 25

255.255.255.255 255.255.255.255 10.0.1.205 0.0.0.0 1

255.255.255.255 255.255.255.255 10.0.1.205 10.0.1.205 1

255.255.255.255 255.255.255.255 172.16.0.11 172.16.0.11 1

93 09:57:10.458 09/03/12 Sev=Info/4 CM/0x63100038

Successfully saved route changes to file.

94 09:57:10.458 09/03/12 Sev=Info/5 CVPND/0x63400013

Destination Netmask Gateway Interface Metric

0.0.0.0 0.0.0.0 172.16.0.1 172.16.0.11 25

10.0.0.0 255.0.0.0 10.0.1.205 10.0.1.205 1

10.0.1.205 255.255.255.255 127.0.0.1 127.0.0.1 25

10.255.255.255 255.255.255.255 10.0.1.205 10.0.1.205 25

a.b.c.d 255.255.255.255 172.16.0.1 172.16.0.11 1

127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1

172.16.0.0 255.255.0.0 172.16.0.11 172.16.0.11 25

172.16.0.1 255.255.255.255 172.16.0.11 172.16.0.11 1

172.16.0.11 255.255.255.255 127.0.0.1 127.0.0.1 25

172.16.255.255 255.255.255.255 172.16.0.11 172.16.0.11 25

224.0.0.0 240.0.0.0 10.0.1.205 10.0.1.205 25

224.0.0.0 240.0.0.0 172.16.0.11 172.16.0.11 25

255.255.255.255 255.255.255.255 10.0.1.205 0.0.0.0 1

255.255.255.255 255.255.255.255 10.0.1.205 10.0.1.205 1

255.255.255.255 255.255.255.255 172.16.0.11 172.16.0.11 1

95 09:57:10.458 09/03/12 Sev=Info/6 CM/0x63100036

The routing table was updated for the Virtual Adapter

96 09:57:10.508 09/03/12 Sev=Info/4 CM/0x6310001A

One secure connection established

97 09:57:10.618 09/03/12 Sev=Info/4 CM/0x6310003B

Address watch added for 172.16.0.11. Current hostname: toughone, Current address(es): 10.0.1.205, 172.16.0.11.

98 09:57:10.638 09/03/12 Sev=Info/4 CM/0x6310003B

Address watch added for 10.0.1.205. Current hostname: toughone, Current address(es): 10.0.1.205, 172.16.0.11.

99 09:57:10.638 09/03/12 Sev=Info/4 IPSEC/0x63700014

Deleted all keys

100 09:57:10.638 09/03/12 Sev=Info/4 IPSEC/0x63700010

Created a new key structure

101 09:57:10.638 09/03/12 Sev=Info/4 IPSEC/0x6370000F

Added key with SPI=0xdac635b3 into key list

102 09:57:10.638 09/03/12 Sev=Info/4 IPSEC/0x63700010

Created a new key structure

103 09:57:10.638 09/03/12 Sev=Info/4 IPSEC/0x6370000F

Added key with SPI=0x591a9ee9 into key list

104 09:57:10.638 09/03/12 Sev=Info/4 IPSEC/0x6370002F

Assigned VA private interface addr 10.0.1.205

105 09:57:10.638 09/03/12 Sev=Info/4 IPSEC/0x63700037

Configure public interface: 172.16.0.11. SG: a.b.c.d

106 09:57:10.638 09/03/12 Sev=Info/6 CM/0x63100046

Set tunnel established flag in registry to 1.

107 09:57:19.741 09/03/12 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to a.b.c.d

108 09:57:19.741 09/03/12 Sev=Info/6 IKE/0x6300003D

Sending DPD request to a.b.c.d, our seq# = 3951445672

109 09:57:19.772 09/03/12 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = a.b.c.d

110 09:57:19.772 09/03/12 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:DPD_ACK) from a.b.c.d

111 09:57:19.772 09/03/12 Sev=Info/5 IKE/0x63000040

Received DPD ACK from a.b.c.d, seq# received = 3951445672, seq# expected = 3951445672

112 09:57:30.257 09/03/12 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to a.b.c.d

113 09:57:30.257 09/03/12 Sev=Info/6 IKE/0x6300003D

Sending DPD request to a.b.c.d, our seq# = 3951445673

114 09:57:30.297 09/03/12 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = a.b.c.d

115 09:57:30.297 09/03/12 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:DPD_ACK) from a.b.c.d

116 09:57:30.297 09/03/12 Sev=Info/5 IKE/0x63000040

Received DPD ACK from a.b.c.d, seq# received = 3951445673, seq# expected = 3951445673

117 09:57:40.772 09/03/12 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to a.b.c.d

118 09:57:40.772 09/03/12 Sev=Info/6 IKE/0x6300003D

Sending DPD request to a.b.c.d, our seq# = 3951445674

119 09:57:40.802 09/03/12 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = a.b.c.d

120 09:57:40.802 09/03/12 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:DPD_ACK) from a.b.c.d

121 09:57:40.802 09/03/12 Sev=Info/5 IKE/0x63000040

Received DPD ACK from a.b.c.d, seq# received = 3951445674, seq# expected = 3951445674

122 09:57:54.291 09/03/12 Sev=Info/6 IKE/0x63000055

Sent a keepalive on the IPSec SA

123 09:58:04.306 09/03/12 Sev=Info/6 IKE/0x63000055

Sent a keepalive on the IPSec SA

124 09:58:14.320 09/03/12 Sev=Info/6 IKE/0x63000055

Sent a keepalive on the IPSec SA

125 09:58:24.334 09/03/12 Sev=Info/6 IKE/0x63000055

Sent a keepalive on the IPSec SA

126 09:58:34.349 09/03/12 Sev=Info/6 IKE/0x63000055

Sent a keepalive on the IPSec SA

127 09:58:41.359 09/03/12 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to a.b.c.d

128 09:58:41.359 09/03/12 Sev=Info/6 IKE/0x6300003D

Sending DPD request to a.b.c.d, our seq# = 3951445675

129 09:58:41.389 09/03/12 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = a.b.c.d

130 09:58:41.389 09/03/12 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:DPD_ACK) from a.b.c.d

131 09:58:41.389 09/03/12 Sev=Info/5 IKE/0x63000040

Received DPD ACK from a.b.c.d, seq# received = 3951445675, seq# expected = 3951445675

132 09:58:54.378 09/03/12 Sev=Info/6 IKE/0x63000055

Sent a keepalive on the IPSec SA

133 09:59:04.392 09/03/12 Sev=Info/6 IKE/0x63000055

Sent a keepalive on the IPSec SA

134 09:59:14.406 09/03/12 Sev=Info/6 IKE/0x63000055

Sent a keepalive on the IPSec SA

135 09:59:24.421 09/03/12 Sev=Info/6 IKE/0x63000055

Sent a keepalive on the IPSec SA

136 09:59:34.435 09/03/12 Sev=Info/6 IKE/0x63000055

Sent a keepalive on the IPSec SA

137 09:59:41.946 09/03/12 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to a.b.c.d

138 09:59:41.946 09/03/12 Sev=Info/6 IKE/0x6300003D

Sending DPD request to a.b.c.d, our seq# = 3951445676

139 09:59:41.976 09/03/12 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = a.b.c.d

140 09:59:41.976 09/03/12 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:DPD_ACK) from a.b.c.d

141 09:59:41.976 09/03/12 Sev=Info/5 IKE/0x63000040

Received DPD ACK from a.b.c.d, seq# received = 3951445676, seq# expected = 3951445676

142 09:59:54.464 09/03/12 Sev=Info/6 IKE/0x63000055

Sent a keepalive on the IPSec SA

shikhsha · ‎09-03-2012

Hi Deryck,

Sorry for responding late... was in office actually...hmmm..the issue over here is that i find it hard to beleive that your machine is not encrypting the packets. The reason why is say that is because in the output of " show crypto ipsec sa " we do see decrypted packets but not encrypted packets. The only way that we could see the decrytped packets over here is because PIX is actually receving the packets from your VPN client.

Can you please open up your vpn client, go to statistics and send me a screenshot of statistics and route details ?

Shikhar Sharma

CCIE Security # 29741

Cisco TAC - VPN Team

drichards38 · ‎09-03-2012

Hi Shikhar,

It looks like you may be right about the packets not being encrypted. It looks like it's coming from the Pix???

Below are the screenshots.

Thanks,

Deryck

shikhsha · ‎09-03-2012

Apply captures on the inside interface of the pix to see if you are receiving any replies from the internal network or not. Here are the commands that you need to apply:

access-list capture permit ip host (ip address assigned to vpn client from pool) host (ip address on your internal network which you are pinging from vpn client)

access-list capture permit ip host (ip address on your internal network which you are pinging from vpn client) host (ip address assigned to vpn client from pool)

capture capin access-list capture interface inside

Now to check the captures issue the command:

show capture capin

Please run around 10 pings to the internal ip address and send me the output.

Also issue the command:

management inside

After issuing this command try to ping the inside interface of your pix and see if you can do that from the vpn client.

drichards38 · ‎09-03-2012

Ok. I ran the command and I got:

0 packet captured

0 packet shown

For the record, I am testing with a Windows 7 client and a Windows XP client at the same location. On Tuesday, I will give this to another person to test from another location in case my firewall is blocking something here.

Thanks,

Deryck

shikhsha · ‎09-04-2012

Hi Deryck,

This is the main problem here. The packets which are coming from the VPN client are getting decrypted on the PIX but never leave the inside interface. This means that PIX is dropping the packets or sending it to some other tunnel. I found another problem in your config. Can you tell me why do you have this statement:

crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20

Please try removing it and then try the connection.

Shikhar Sharma

CCIE Security # 29741

Cisco TAC - VPN Team

drichards38 · ‎09-04-2012

Hi Shikhar,

I just removed that line but there is no difference in the VPN. I checked the statistics and pinging hosts on the LAN, but no change.

Thanks,

Deryck

shikhsha · ‎09-04-2012

Hi Deryck,

Do you have a support contract with cisco ? If yes i would recommend opening a TAC case...we can then actually check why exactly packets are not coming on the inside interface.

Also try reloading your pix to see if it makes any difference

Shikhar Sharma

CCIE Security # 29741

Cisco TAC - VPN Team