Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

Trouble Passing through to the Server

Hi,

I just installed a VPN client version 5.0.07.0290 on my new Windows 7 Professional Laptop.  Our server is a Windows Small Business Server 2003 with a PIx 501 firewall.  I got a connection but could not get into the server.  I set the VPN client the same way as I did with a previous version of the Cisco VPN client that was on a Windows XP Pro laptop.

Any suggestions??

28 REPLIES

Re: Trouble Passing through to the Server

Wes,

If your computer is currently behind a PAT device, you need to check that the client has NAT-T enabled.

Check this by going to the VPN client and under the transport tab, nat-transparency enabled.

Also, some ISPs might block ESP.

Try to PING the inside IP of the PIX.

Also, the server has a default gateway pointing to the PIX?

Federico.

New Member

Re: Trouble Passing through to the Server

Hi Frederico,

I set it as UDP.  My home location uses a wireless access to our ISP and it worked under the previous version.  See attachment.

Thanks for the response.

Wes

New Member

Re: Trouble Passing through to the Server

I checked the Transport tab and I do have it enabled.  I am

a novice.

Re: Trouble Passing through to the Server

Wes,


Nothing else has changed like IP addresses?
Do you have access to the PIX 501?

Anyway, if it worked from your home previously, it should work now with this version.
You say the tunnel establishes, but cannot reach the server.


Check the following:
When the VPN client is connected, right click on the yellow closed lock and choose statistics.
Check that the transport says Active on UDP port 4500
Check that the packets are being encrypted/decrypted
Do you see the server's network under the ''route details'' tab?

Federico.

New Member

Re: Trouble Passing through to the Server

Frederico,

Here is what I saw:

Transport is Active on UDP port 4500

Encrypted = 270

Decrypted = 4

Discarded = 23

Nothing shows under Route Details.

Thanks.

Re: Trouble Passing through to the Server

Wes,

Packets are sent and received through the tunnel (that's good).

Please check again under route details under the Secured Routes portion, you should have at least 1 network or a bunch of zeros.

Federico.

New Member

Re: Trouble Passing through to the Server

Federico,

There are a bunch of zeros.

Wes

Re: Trouble Passing through to the Server

Wes,

You don't have access to the PIX-501?

From the client, what we can do is check the logs (make sure the logs are enabled and the severity up to 3-High on all categories and send the text file when attempting the connection).

Since the tunnel establishes and the problem is just passing traffic through the tunnel, the normal reasons for this are:

ESP being blocked

NAT-T not enabled --> we have verified this is not the case

Changes in IPs

Do you know what is the IP address of the PIX-501 to see if you can PING it from your VPN client?

Federico.

New Member

Re: Trouble Passing through to the Server

Federico,

I do not know what the IP Address is to the Pix unit.  The IP address to the server I do know.

Is there a way that I can find out without being at the Pix location??

Wes

Re: Trouble Passing through to the Server

Should be the same IP as the server's default gateway.

Federico.

New Member

Re: Trouble Passing through to the Server

Federico,

So I used the same one as the previous client that worked and it is correct.  That's odd.

Wes

Re: Trouble Passing through to the Server

The thing is that if nothing has really changed (besides the version of the VPN client software), you should be able connect to the server.

We know that the VPN client is sending the packets through the tunnel (and its receiving some).

But we're not sure if the communication is reaching the server.

Honestly, I believe something must have changed, but without having access to the PIX we don't know.

We can look at the logs from the client...

Federico.

New Member

Re: Trouble Passing through to the Server

Federico,

Sorry about the potential frustration, but you are a great help.  I attached the log using notepad to this post.

Wes

New Member

Re: Trouble Passing through to the Server

I just pinged the IP address that is being used by the client and it worked.

Re: Trouble Passing through to the Server

Wes,

What do you mean with this:

I just pinged the IP address that is being used by the client and it worked.

Federico.

New Member

Re: Trouble Passing through to the Server

Ok.  The vpn set-up requires a Host, right??  So I used this address using the ping command and it worked.  Is that not right??

Re: Trouble Passing through to the Server

Ok Wes,

After all the troubleshooting could you please give me the status of where are we right now?

Still not communicating with the server?

Federico.

New Member

Re: Trouble Passing through to the Server

Federico,

After all of our discussions I could not get into the server.  I am currently at the work location and can access any information

that I could not when I was offsite.

I had a Laptop with XP Pro and a Cisco VPN client.  I got a new laptop running Windows 7 Pro.  So I downloaded a 64-bit Cisco CLient for Windows 7.  Set it up the same way and even showed that I got a connection.  But on the server side there were just zeros.  So evidently did not get through.

We have a Pix 501 unit.  What information do I need and how can I configure from the work side so that I can properly test it offsite??

Thanks,

Wes

Re: Trouble Passing through to the Server

Wes,

Do the following:

Get a ''sh run'' from the PIX and we can configure it later to make it work.

We will need to know the network information of the PIX (IP address, mask, default gateway,etc)

Federico.

New Member

Re: Trouble Passing through to the Server

Federico,

I got the "sho run" information:

name 192.168.2.0  VPN Connections

permit ip any VPN Connections 255.255.255.0

access-list 101 permit icmp any any echo-reply

access-list permit tcp any host 96.11.167.10 eq smtp

access-list permit tcp any host 96.11.167.10 eq https

logging host inside 192.168.1.10

mtu outside 1500

mtu inside 1500

ip address outside 96.11.167.10 255.255.255.248

ip address inside 192.168.1.1  255.255.255.0

ip local pool vpn_pool 192.168.2.150

anything else we need?

Thanks,

Wes

Re: Trouble Passing through to the Server

Wes,

You just got a snipnet of the sh run.

Can you post the complete ''sh run''?

Federico.

New Member

Re: Trouble Passing through to the Server

I have attached it to the reply.

Thanks,

Wes

New Member

Re: Trouble Passing through to the Server

Federico,

Have you been able to review sh run?  I have no idea as to why this is not working.  I uninstalled the client, reinstalled it with the same results.

Let me know what you think.

Wes

Re: Trouble Passing through to the Server

Wes,

Add this command:
management-access inside

Also add this command:
sysopt connection permit-vpn
Then, check if you can PING 192.168.1.1 from the VPN client.

What is the IP of the server? 192.168.1.x?
Check that the default gateway of the server is 192.168.1.1

Federico.

New Member

Re: Trouble Passing through to the Server

Federico,

Do I make the entry at the Pix unit or from the client?  If from the client do I do this from a DOS prompt?

Thanks so much for your help.  The server IP Address is 192.168.1.10

Wes

New Member

Re: Trouble Passing through to the Server

Federico,

I opened the Pix Manager and entered the first command and it seemed to accept this.  I attempted the second command and it failed.  So what is next??

Wes

Re: Trouble Passing through to the Server

Wes,

If it took the command: management-access inside

Make sure that you can PING 192.168.1.1 from the VPN client when connected.

Federico.

Re: Trouble Passing through to the Server

Hi Jacobs,

sometime the problem is related to the MTU. There is a "SetMTU" utility in the same folder with the vpn client exec file (i think it is also in the VPN client start menu). Setup the valut 1300 for all connections, reboot and then try the access again.

Regards,
Daniel

537
Views
45
Helpful
28
Replies
CreatePlease to create content