I just installed a VPN client version 5.0.07.0290 on my new Windows 7 Professional Laptop. Our server is a Windows Small Business Server 2003 with a PIx 501 firewall. I got a connection but could not get into the server. I set the VPN client the same way as I did with a previous version of the Cisco VPN client that was on a Windows XP Pro laptop.
If your computer is currently behind a PAT device, you need to check that the client has NAT-T enabled.
Check this by going to the VPN client and under the transport tab, nat-transparency enabled.
Also, some ISPs might block ESP.
Try to PING the inside IP of the PIX.
Also, the server has a default gateway pointing to the PIX?
Nothing else has changed like IP addresses?
Do you have access to the PIX 501?
Anyway, if it worked from your home previously, it should work now with this version.
You say the tunnel establishes, but cannot reach the server.
Check the following:
When the VPN client is connected, right click on the yellow closed lock and choose statistics.
Check that the transport says Active on UDP port 4500
Check that the packets are being encrypted/decrypted
Do you see the server's network under the ''route details'' tab?
Here is what I saw:
Transport is Active on UDP port 4500
Encrypted = 270
Decrypted = 4
Discarded = 23
Nothing shows under Route Details.
Packets are sent and received through the tunnel (that's good).
Please check again under route details under the Secured Routes portion, you should have at least 1 network or a bunch of zeros.
You don't have access to the PIX-501?
From the client, what we can do is check the logs (make sure the logs are enabled and the severity up to 3-High on all categories and send the text file when attempting the connection).
Since the tunnel establishes and the problem is just passing traffic through the tunnel, the normal reasons for this are:
ESP being blocked
NAT-T not enabled --> we have verified this is not the case
Changes in IPs
Do you know what is the IP address of the PIX-501 to see if you can PING it from your VPN client?
I do not know what the IP Address is to the Pix unit. The IP address to the server I do know.
Is there a way that I can find out without being at the Pix location??
The thing is that if nothing has really changed (besides the version of the VPN client software), you should be able connect to the server.
We know that the VPN client is sending the packets through the tunnel (and its receiving some).
But we're not sure if the communication is reaching the server.
Honestly, I believe something must have changed, but without having access to the PIX we don't know.
We can look at the logs from the client...
What do you mean with this:
I just pinged the IP address that is being used by the client and it worked.
Ok. The vpn set-up requires a Host, right?? So I used this address using the ping command and it worked. Is that not right??
After all the troubleshooting could you please give me the status of where are we right now?
Still not communicating with the server?
After all of our discussions I could not get into the server. I am currently at the work location and can access any information
that I could not when I was offsite.
I had a Laptop with XP Pro and a Cisco VPN client. I got a new laptop running Windows 7 Pro. So I downloaded a 64-bit Cisco CLient for Windows 7. Set it up the same way and even showed that I got a connection. But on the server side there were just zeros. So evidently did not get through.
We have a Pix 501 unit. What information do I need and how can I configure from the work side so that I can properly test it offsite??
Do the following:
Get a ''sh run'' from the PIX and we can configure it later to make it work.
We will need to know the network information of the PIX (IP address, mask, default gateway,etc)
I got the "sho run" information:
name 192.168.2.0 VPN Connections
permit ip any VPN Connections 255.255.255.0
access-list 101 permit icmp any any echo-reply
access-list permit tcp any host 220.127.116.11 eq smtp
access-list permit tcp any host 18.104.22.168 eq https
logging host inside 192.168.1.10
mtu outside 1500
mtu inside 1500
ip address outside 22.214.171.124 255.255.255.248
ip address inside 192.168.1.1 255.255.255.0
ip local pool vpn_pool 192.168.2.150
anything else we need?
Have you been able to review sh run? I have no idea as to why this is not working. I uninstalled the client, reinstalled it with the same results.
Let me know what you think.
Add this command:
Also add this command:
sysopt connection permit-vpn
Then, check if you can PING 192.168.1.1 from the VPN client.
What is the IP of the server? 192.168.1.x?
Check that the default gateway of the server is 192.168.1.1
Do I make the entry at the Pix unit or from the client? If from the client do I do this from a DOS prompt?
Thanks so much for your help. The server IP Address is 192.168.1.10
I opened the Pix Manager and entered the first command and it seemed to accept this. I attempted the second command and it failed. So what is next??
If it took the command: management-access inside
Make sure that you can PING 192.168.1.1 from the VPN client when connected.
sometime the problem is related to the MTU. There is a "SetMTU" utility in the same folder with the vpn client exec file (i think it is also in the VPN client start menu). Setup the valut 1300 for all connections, reboot and then try the access again.