Cisco pix 501 VPN question

Hi,
We have a customer with a Pix 501(v6.3.4)(PDM v3.02) Firewall.
We can succesfully setup a VPN connection, but the client loses the Internet connection when the VPN connection is up. I found some articles on the Internet about split tunneling, but I cant figure out how to do this.
Can someone please help me out?

I suppose 501 is Easy VPN server
Split tunnel says what traffic goes to VPN tunnel if you dont have split tunnel enabled all traffic iis encrypted you need specify with ACL what traffic should be encrypted
check following example whe is ACL 80 used for split tunnel
http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_configuration_guide_chapter09186a0080172787.html#wp1062497
M.
Hope that helps rate if it does

Similar Messages

  • Cisco Pix 501 - Need help with VPN passthrough

    Greetings!
    Currently I have a Cisco Pix 501 version 6.3(1) which is in front of my Windows Server 2008 box. I am fairly new to firewalling, especially with the Cisco Pix; I have been able to accomplish some port forwarding for CCTV camera software, etc. but am coming to a standstill attempting to connect a company laptop (Windows 7 Professional) to the server via VPN.
    Previously we had another facility which was able to connect through VPN but it has since been removed (and always seemed to not be very stable to begin with - though it was connecting to a Server 2003 box rather than 2008).
    I have been through several articles both here and other forums and have attempted several of the proposed fixes. I'm almost sure at this point I've probably opened up more of my firewall then necessary and may have duplicate information attempted to complete this passthrough. My Server 2008 resides at 192.168.1.15, below is what I have thus far. The "crypto map" sections were all completed long before I took over, I believe this is how the old VPN was set up. What I have added since beginning this endevour is the "fixup protocol pptp 1723", the "access-list" entries relating to both pptp and gre, and the "static (inside, outside)" relating to the pptp.
    I am still continuously getting an error on the laptop of "800" whenever I try to connect to the VPN. Any help would be greatly appreciated as I am rapidly losing hair attempting to get this situated.
    : Saved
    PIX Version 6.3(1)
    interface ethernet0 auto
    interface ethernet1 100full
    nameif ethernet0 outside security0
    nameif ethernet1 inside security100
    enable password RysZD25GpRAOMhF. encrypted
    passwd 0I6TSwviLDtVwaTr encrypted
    hostname Lorway-PIX
    domain-name lorwayco.com
    fixup protocol ftp 21
    fixup protocol ftp 22
    fixup protocol h323 h225 1720
    fixup protocol h323 ras 1718-1719
    fixup protocol http 80
    fixup protocol ils 389
    fixup protocol pptp 1723
    fixup protocol rsh 514
    fixup protocol rtsp 554
    fixup protocol sip 5060
    fixup protocol sip udp 5060
    fixup protocol skinny 2000
    no fixup protocol smtp 25
    fixup protocol sqlnet 1521
    names
    access-list 80 permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
    access-list 80 permit ip 192.168.1.0 255.255.255.0 192.168.4.0 255.255.255.0
    access-list outside_access_in permit icmp any any
    access-list outside_access_in permit tcp any any eq 50000
    access-list outside_access_in permit udp any any eq 50000
    access-list outside_access_in permit tcp any any eq smtp
    access-list outside_access_in permit tcp any any eq www
    access-list outside_access_in permit tcp host 66.242.236.26 any eq smtp
    access-list outside_access_in permit tcp host 208.21.46.12 any eq smtp
    access-list outside_access_in permit tcp host 68.59.232.176 any eq smtp
    access-list outside_access_in permit tcp any any eq pop3
    access-list outside_access_in permit tcp any any eq https
    access-list outside_access_in permit tcp any any eq ftp
    access-list outside_access_in permit tcp host 68.53.192.139 any eq smtp
    access-list outside_access_in permit tcp any any eq ftp-data
    access-list outside_access_in permit tcp any any eq 1009
    access-list outside_access_in permit tcp any host 192.168.1.122 eq 7000
    access-list outside_access_in permit tcp host 192.168.1.122 any eq 7000
    access-list outside_access_in permit tcp any any eq 7000
    access-list outside_access_in permit tcp any any eq pptp
    access-list outside_access_in permit gre any any
    access-list 10 permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
    access-list 20 permit ip 192.168.1.0 255.255.255.0 192.168.4.0 255.255.255.0
    access-list 30 permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
    pager lines 24
    mtu outside 1500
    mtu inside 1500
    ip address outside 74.221.188.249 255.255.255.0
    ip address inside 192.168.1.1 255.255.255.0
    ip audit info action alarm
    ip audit attack action alarm
    pdm logging informational 100
    pdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list 80
    nat (inside) 1 0.0.0.0 0.0.0.0 0 0
    static (inside,outside) tcp interface 3389 192.168.1.15 3389 netmask 255.255.255.255 0 0
    static (inside,outside) tcp interface 50000 192.168.1.160 50000 netmask 255.255.255.255 0 0
    static (inside,outside) udp interface 50000 192.168.1.160 50000 netmask 255.255.255.255 0 0
    static (inside,outside) tcp interface smtp 192.168.1.15 smtp netmask 255.255.255.255 0 0
    static (inside,outside) tcp interface https 192.168.1.15 https netmask 255.255.255.255 0 0
    static (inside,outside) tcp interface www 192.168.1.15 www netmask 255.255.255.255 0 0
    static (inside,outside) tcp interface pop3 192.168.1.15 pop3 netmask 255.255.255.255 0 0
    static (inside,outside) tcp interface 7000 192.168.1.122 7000 netmask 255.255.255.255 0 0
    static (inside,outside) tcp interface pptp 192.168.1.15 pptp netmask 255.255.255.255 0 0
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 74.221.188.1 1
    timeout xlate 0:05:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
    timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout uauth 0:05:00 absolute
    aaa-server TACACS+ protocol tacacs+
    aaa-server RADIUS protocol radius
    aaa-server LOCAL protocol local
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    snmp-server host inside 192.168.1.118
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    snmp-server enable traps
    floodguard enable
    sysopt connection permit-ipsec
    sysopt connection permit-pptp
    sysopt connection permit-l2tp
    crypto ipsec transform-set lorway1 esp-3des esp-sha-hmac
    crypto map lorwayvpn 30 ipsec-isakmp
    crypto map lorwayvpn 30 match address 30
    crypto map lorwayvpn 30 set peer 66.18.55.250
    crypto map lorwayvpn 30 set transform-set lorway1
    crypto map lorwayvpn interface outside
    isakmp enable outside
    isakmp key ******** address 66.18.50.178 netmask 255.255.255.255
    isakmp key ******** address 66.18.55.250 netmask 255.255.255.255
    isakmp identity address
    isakmp nat-traversal 20
    isakmp policy 9 authentication pre-share
    isakmp policy 9 encryption 3des
    isakmp policy 9 hash sha
    isakmp policy 9 group 2
    isakmp policy 9 lifetime 86400
    telnet timeout 5
    ssh 0.0.0.0 0.0.0.0 outside
    ssh 0.0.0.0 0.0.0.0 inside
    ssh timeout 60
    console timeout 0
    dhcpd lease 3600
    dhcpd ping_timeout 750
    dhcpd auto_config outside
    terminal width 80
    Cryptochecksum:5c7b250c008519fe970262aa3bc28bb5
    : end

    Config looks good to me.
    I would actually upgrade your PIX to the latest version of 6.3.x if you still have access to the software center as this PIX is on its EOL and you are running an extremely old version of code.
    If you place your Windows server bypassing the PIX temporarily, I assume you are able to connect to the VPN?

  • Can't Connect to Pix 501 VPN on Network

    Hi All,
    I have a software VPN client that connects just fine to the PIX 501 VPN, but I cannot ping or telnet to any services on the LAN. Below is my config and results of show cry ipsec sa. I would appreciate any suggestions to fix this.
    It's been a while since I have done this. When I check the DHCP address received from the VPN, the default gateway is missing. IIRC, that is normal. What is strange is that when I ping, Windows does not show any sent packets.
    Thanks,
    --Drichards38
    PIX Version 6.3(3)
    interface ethernet0 auto
    interface ethernet1 100full
    nameif ethernet0 outside security0
    nameif ethernet1 inside security100
    enable password bgVy005CZTsaMOwR encrypted
    passwd bgVy005CZTsaMOwR encrypted
    hostname cisco
    domain-name xxxxxx.biz
    fixup protocol dns maximum-length 512
    fixup protocol ftp 21
    fixup protocol ftp 1024-2048
    fixup protocol ftp 49152-65534
    fixup protocol h323 h225 1720
    fixup protocol h323 ras 1718-1719
    fixup protocol http 80
    fixup protocol rsh 514
    fixup protocol rtsp 554
    fixup protocol sip 5060
    fixup protocol sip udp 5060
    fixup protocol skinny 2000
    fixup protocol smtp 25
    fixup protocol sqlnet 1521
    fixup protocol tftp 69
    names
    access-list acl-out permit tcp any interface outside eq www
    access-list acl_out permit tcp any host aa.bb.cc.dd eq telnet
    access-list acl_out permit tcp any host aa.bb.cc.dd eq 3389
    access-list acl_out permit tcp any host aa.bb.cc.dd eq 60990
    access-list acl_out permit tcp any host aa.bb.cc.dd eq www
    access-list acl_out permit tcp any host aa.bb.cc.dd eq www
    access-list acl_out permit tcp any host aa.bb.cc.dd eq echo
    access-list acl_out permit tcp any host aa.bb.cc.dd eq ftp
    access-list acl_out permit tcp any host aa.bb.cc.dd eq https
    access-list acl_out permit tcp any interface inside eq www
    access-list acl_out permit tcp any interface inside eq ftp
    access-list acl_out permit tcp any interface inside eq 3389
    access-list acl_out permit tcp any interface inside eq https
    access-list acl_out permit tcp any host aa.bb.cc.dd eq www
    access-list acl_out permit tcp any host aa.bb.cc.dd eq www
    access-list acl_out permit tcp any host aa.bb.cc.dd eq https
    access-list acl_out permit tcp any host aa.bb.cc.dd eq https
    access-list acl_out permit tcp any host aa.bb.cc.dd eq 3389
    access-list acl_out permit tcp any host aa.bb.cc.dd eq 3389
    access-list acl_out permit tcp any host aa.bb.cc.dd eq www
    access-list acl_out permit tcp any host aa.bb.cc.dd eq https
    access-list acl_out permit tcp any host aa.bb.cc.dd eq 3389
    access-list acl_out permit tcp any host aa.bb.cc.dd eq ftp
    access-list acl_out permit tcp any host aa.bb.cc.dd eq www
    access-list acl_out permit tcp any host aa.bb.cc.dd eq https
    access-list acl_out permit tcp any host aa.bb.cc.dd eq 3389
    access-list acl_out permit tcp any host aa.bb.cc.dd eq 902
    access-list acl_out permit tcp any host aa.bb.cc.dd eq ftp
    access-list acl_out permit tcp any host aa.bb.cc.dd eq www
    access-list acl_out permit tcp any host aa.bb.cc.dd eq ftp
    access-list acl_out permit tcp any host aa.bb.cc.dd eq https
    access-list acl_out permit tcp any host aa.bb.cc.dd eq 3389
    access-list acl_out permit tcp any host aa.bb.cc.dd eq www
    access-list acl_out permit tcp any host aa.bb.cc.dd eq ftp
    access-list acl_out permit tcp any host aa.bb.cc.dd eq https
    access-list acl_out permit tcp any host aa.bb.cc.dd eq 3389
    access-list acl_out permit tcp any host aa.bb.cc.dd eq www
    access-list acl_out permit tcp any host aa.bb.cc.dd eq https
    access-list acl_out permit tcp any host aa.bb.cc.dd eq ftp
    access-list acl_out permit tcp any host aa.bb.cc.dd eq 3389
    access-list outside_cryptomap_dyn_20 permit ip any 10.0.0.0 255.0.0.0
    access-list split_tunnel_acl permit ip 10.0.0.0 255.0.0.0 any
    pager lines 24
    mtu outside 1500
    mtu inside 1500
    ip address outside aa.bb.cc.dd 255.255.255.240
    ip address inside 192.168.93.1 255.255.255.0
    ip audit info action alarm
    ip audit attack action alarm
    ip local pool low_vpn_pool 10.0.1.205-10.0.1.210
    pdm location 172.16.0.0 255.255.0.0 inside
    pdm logging informational 100
    pdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 1 192.168.93.0 255.255.255.0 0 0
    nat (inside) 1 0.0.0.0 0.0.0.0 0 0
    static (inside,outside) aa.bb.cc.dd 192.168.93.67 netmask 255.255.255.255 0 0
    static (inside,outside) aa.bb.cc.dd 192.168.93.68 netmask 255.255.255.255 0 0
    static (inside,outside) aa.bb.cc.dd 192.168.93.69 netmask 255.255.255.255 0 0
    static (inside,outside) aa.bb.cc.dd 192.168.93.70 netmask 255.255.255.255 0 0
    static (inside,outside) aa.bb.cc.dd 192.168.93.71 netmask 255.255.255.255 0 0
    static (inside,outside) aa.bb.cc.dd 192.168.93.72 netmask 255.255.255.255 0 0
    static (inside,outside) aa.bb.cc.dd 192.168.93.73 netmask 255.255.255.255 0 0
    static (inside,outside) aa.bb.cc.dd 192.168.93.74 netmask 255.255.255.255 0 0
    static (inside,outside) aa.bb.cc.dd 192.168.93.75 netmask 255.255.255.255 0 0
    static (inside,outside) aa.bb.cc.dd 192.168.93.76 netmask 255.255.255.255 0 0
    static (inside,outside) aa.bb.cc.dd 192.168.93.77 netmask 255.255.255.255 0 0
    static (inside,outside) aa.bb.cc.dd 192.168.93.78 netmask 255.255.255.255 0 0
    access-group acl_out in interface outside
    rip inside default version 1
    route outside 0.0.0.0 0.0.0.0 aa.bb.cc.dd 1
    timeout xlate 0:05:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
    timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout uauth 0:05:00 absolute
    aaa-server TACACS+ protocol tacacs+
    aaa-server RADIUS protocol radius
    aaa-server LOCAL protocol local
    aaa authorization command LOCAL
    http server enable
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    no snmp-server enable traps
    floodguard enable
    sysopt connection permit-ipsec
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20
    crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5
    crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map client authentication LOCAL
    crypto map outside_map interface outside
    isakmp enable outside
    isakmp nat-traversal 20
    isakmp policy 20 authentication pre-share
    isakmp policy 20 encryption 3des
    isakmp policy 20 hash md5
    isakmp policy 20 group 2
    isakmp policy 20 lifetime 86400
    vpngroup MY_VPN address-pool low_vpn_pool
    vpngroup MY_VPN dns-server 4.2.2.1
    vpngroup MY_VPN default-domain xxxxx.biz
    vpngroup MY_VPN split-tunnel split_tunnel_acl
    vpngroup MY_VPN idle-time 1800
    vpngroup MY_VPN password ********
    telnet 0.0.0.0 255.255.255.255 outside
    telnet 192.168.93.0 255.255.255.0 inside
    telnet timeout 5
    ssh 0.0.0.0 0.0.0.0 outside
    ssh timeout 60
    console timeout 0
    dhcpd address 192.168.93.230-192.168.93.240 inside
    dhcpd dns ff.gg.hh.ii ff.gg.hh.ii
    dhcpd lease 65536
    dhcpd ping_timeout 750
    dhcpd domain xxxxxx.biz
    dhcpd auto_config outside
    dhcpd enable inside
    username xxxx password xxxxxxx encrypted privilege 15
    cisco(config)# show cry ipsec sa
    interface: outside
        Crypto map tag: outside_map, local addr. aa.bb.cc.dd
       local  ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
       remote ident (addr/mask/prot/port): (10.0.1.205/255.255.255.255/0/0)
       current_peer: jj.kk.ll.mm:1265
       dynamic allocated peer ip: 10.0.1.205
         PERMIT, flags={transport_parent,}
        #pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0
        #pkts decaps: 38, #pkts decrypt: 38, #pkts verify 38
        #pkts compressed: 0, #pkts decompressed: 0
        #pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0
        #send errors 0, #recv errors 0
         local crypto endpt.: aa.bb.cc.dd, remote crypto endpt.: 97.93.95.133
         path mtu 1500, ipsec overhead 64, media mtu 1500
         current outbound spi: 3a898e67
         inbound esp sas:
          spi: 0xeeb64931(4004923697)
            transform: esp-3des esp-md5-hmac ,
            in use settings ={Tunnel UDP-Encaps, }
            slot: 0, conn id: 1, crypto map: outside_map
            sa timing: remaining key lifetime (k/sec): (4607993/28610)
            IV size: 8 bytes
            replay detection support: Y
         inbound ah sas:
         inbound pcp sas:
         outbound esp sas:
          spi: 0x3a898e67(982093415)
            transform: esp-3des esp-md5-hmac ,
            in use settings ={Tunnel UDP-Encaps, }
            slot: 0, conn id: 2, crypto map: outside_map
            sa timing: remaining key lifetime (k/sec): (4608000/28574)
            IV size: 8 bytes
            replay detection support: Y
         outbound ah sas:
         outbound pcp sas:

    I just set the logging to high on all areas of the Cisco VPN client. Below is the resulting log. Everything looks ok from here:
    Cisco Systems VPN Client Version 5.0.03.0530
    Copyright (C) 1998-2007 Cisco Systems, Inc. All Rights Reserved.
    Client Type(s): Windows, WinNT
    Running on: 5.1.2600 Service Pack 3
    29     09:57:02.887  09/03/12  Sev=Info/4    CM/0x63100002
    Begin connection process
    30     09:57:02.897  09/03/12  Sev=Info/4    CM/0x63100004
    Establish secure connection
    31     09:57:02.897  09/03/12  Sev=Info/4    CM/0x63100024
    Attempt connection with server "a.b.c.d"
    32     09:57:02.907  09/03/12  Sev=Info/6    IKE/0x6300003B
    Attempting to establish a connection with a.b.c.d.
    33     09:57:02.917  09/03/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK AG (SA, KE, NON, ID, VID(Xauth), VID(dpd), VID(Frag), VID(Nat-T), VID(Unity)) to a.b.c.d
    34     09:57:03.228  09/03/12  Sev=Info/4    IPSEC/0x63700008
    IPSec driver successfully started
    35     09:57:03.228  09/03/12  Sev=Info/4    IPSEC/0x63700014
    Deleted all keys
    36     09:57:03.228  09/03/12  Sev=Info/6    IPSEC/0x6370002C
    Sent 47 packets, 0 were fragmented.
    37     09:57:03.979  09/03/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = a.b.c.d
    38     09:57:03.979  09/03/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK AG (SA, VID(Xauth), VID(dpd), VID(Unity), VID(?), KE, ID, NON, VID(?), VID(Nat-T), NAT-D, NAT-D, HASH) from a.b.c.d
    39     09:57:04.039  09/03/12  Sev=Info/6    GUI/0x63B00012
    Authentication request attributes is 6h.
    40     09:57:03.979  09/03/12  Sev=Info/5    IKE/0x63000001
    Peer supports XAUTH
    41     09:57:03.979  09/03/12  Sev=Info/5    IKE/0x63000001
    Peer supports DPD
    42     09:57:03.979  09/03/12  Sev=Info/5    IKE/0x63000001
    Peer is a Cisco-Unity compliant peer
    43     09:57:03.979  09/03/12  Sev=Info/5    IKE/0x63000082
    Received IOS Vendor ID with unknown capabilities flag 0x000000A5
    44     09:57:03.979  09/03/12  Sev=Info/5    IKE/0x63000001
    Peer supports NAT-T
    45     09:57:03.999  09/03/12  Sev=Info/6    IKE/0x63000001
    IOS Vendor ID Contruction successful
    46     09:57:03.999  09/03/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK AG *(HASH, NOTIFY:STATUS_INITIAL_CONTACT, NAT-D, NAT-D, VID(?), VID(Unity)) to a.b.c.d
    47     09:57:03.999  09/03/12  Sev=Info/6    IKE/0x63000055
    Sent a keepalive on the IPSec SA
    48     09:57:03.999  09/03/12  Sev=Info/4    IKE/0x63000083
    IKE Port in use - Local Port =  0x0421, Remote Port = 0x1194
    49     09:57:03.999  09/03/12  Sev=Info/5    IKE/0x63000072
    Automatic NAT Detection Status:
       Remote end is NOT behind a NAT device
       This   end IS behind a NAT device
    50     09:57:03.999  09/03/12  Sev=Info/4    CM/0x6310000E
    Established Phase 1 SA.  1 Crypto Active IKE SA, 0 User Authenticated IKE SA in the system
    51     09:57:04.029  09/03/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = a.b.c.d
    52     09:57:04.029  09/03/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:STATUS_INITIAL_CONTACT) from a.b.c.d
    53     09:57:04.029  09/03/12  Sev=Warning/2    IKE/0xA3000067
    Received Unexpected InitialContact Notify (PLMgrNotify:886)
    54     09:57:04.039  09/03/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = a.b.c.d
    55     09:57:04.039  09/03/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:STATUS_RESP_LIFETIME) from a.b.c.d
    56     09:57:04.039  09/03/12  Sev=Info/5    IKE/0x63000045
    RESPONDER-LIFETIME notify has value of 86400 seconds
    57     09:57:04.039  09/03/12  Sev=Info/5    IKE/0x63000047
    This SA has already been alive for 2 seconds, setting expiry to 86398 seconds from now
    58     09:57:04.039  09/03/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = a.b.c.d
    59     09:57:04.039  09/03/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from a.b.c.d
    60     09:57:04.039  09/03/12  Sev=Info/4    CM/0x63100015
    Launch xAuth application
    61     09:57:09.327  09/03/12  Sev=Info/4    CM/0x63100017
    xAuth application returned
    62     09:57:09.327  09/03/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to a.b.c.d
    63     09:57:09.367  09/03/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = a.b.c.d
    64     09:57:09.367  09/03/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from a.b.c.d
    65     09:57:09.367  09/03/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to a.b.c.d
    66     09:57:09.367  09/03/12  Sev=Info/4    CM/0x6310000E
    Established Phase 1 SA.  1 Crypto Active IKE SA, 1 User Authenticated IKE SA in the system
    67     09:57:09.387  09/03/12  Sev=Info/5    IKE/0x6300005E
    Client sending a firewall request to concentrator
    68     09:57:09.387  09/03/12  Sev=Info/5    IKE/0x6300005D
    Firewall Policy: Product=Cisco Systems Integrated Client Firewall, Capability= (Centralized Protection Policy).
    69     09:57:09.387  09/03/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to a.b.c.d
    70     09:57:09.427  09/03/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = a.b.c.d
    71     09:57:09.427  09/03/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from a.b.c.d
    72     09:57:09.427  09/03/12  Sev=Info/5    IKE/0x63000010
    MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_ADDRESS: , value = 10.0.1.205
    73     09:57:09.427  09/03/12  Sev=Info/5    IKE/0x63000010
    MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS(1): , value = 4.2.2.1
    74     09:57:09.427  09/03/12  Sev=Info/5    IKE/0x6300000E
    MODE_CFG_REPLY: Attribute = MODECFG_UNITY_DEFDOMAIN: , value = xxxx.biz
    75     09:57:09.427  09/03/12  Sev=Info/5    IKE/0x6300000D
    MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SPLIT_INCLUDE (# of split_nets), value = 0x00000001
    76     09:57:09.427  09/03/12  Sev=Info/5    IKE/0x6300000F
    SPLIT_NET #1
        subnet = 10.0.0.0
        mask = 255.0.0.0
        protocol = 0
        src port = 0
        dest port=0
    77     09:57:09.427  09/03/12  Sev=Info/5    IKE/0x6300000D
    MODE_CFG_REPLY: Attribute = MODECFG_UNITY_PFS: , value = 0x00000000
    78     09:57:09.427  09/03/12  Sev=Info/5    IKE/0x6300000D
    MODE_CFG_REPLY: Attribute = Received and using NAT-T port number , value = 0x00001194
    79     09:57:09.427  09/03/12  Sev=Info/4    CM/0x63100019
    Mode Config data received
    80     09:57:09.427  09/03/12  Sev=Info/4    IKE/0x63000056
    Received a key request from Driver: Local IP = 10.0.1.205, GW IP = a.b.c.d, Remote IP = 0.0.0.0
    81     09:57:09.437  09/03/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK QM *(HASH, SA, NON, ID, ID) to a.b.c.d
    82     09:57:09.477  09/03/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = a.b.c.d
    83     09:57:09.477  09/03/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK QM *(HASH, SA, NON, ID, ID, NOTIFY:STATUS_RESP_LIFETIME) from a.b.c.d
    84     09:57:09.477  09/03/12  Sev=Info/5    IKE/0x63000045
    RESPONDER-LIFETIME notify has value of 28800 seconds
    85     09:57:09.477  09/03/12  Sev=Info/5    IKE/0x63000046
    RESPONDER-LIFETIME notify has value of 4608000 kb
    86     09:57:09.477  09/03/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK QM *(HASH) to a.b.c.d
    87     09:57:09.477  09/03/12  Sev=Info/5    IKE/0x63000059
    Loading IPsec SA (MsgID=D70550E6 OUTBOUND SPI = 0xB335C6DA INBOUND SPI = 0xE99E1A59)
    88     09:57:09.477  09/03/12  Sev=Info/5    IKE/0x63000025
    Loaded OUTBOUND ESP SPI: 0xB335C6DA
    89     09:57:09.477  09/03/12  Sev=Info/5    IKE/0x63000026
    Loaded INBOUND ESP SPI: 0xE99E1A59
    90     09:57:09.527  09/03/12  Sev=Info/5    CVPND/0x63400013
        Destination           Netmask           Gateway         Interface   Metric
            0.0.0.0           0.0.0.0        172.16.0.1       172.16.0.11       25
          127.0.0.0         255.0.0.0         127.0.0.1         127.0.0.1        1
         172.16.0.0       255.255.0.0       172.16.0.11       172.16.0.11       25
        172.16.0.11   255.255.255.255         127.0.0.1         127.0.0.1       25
    172.16.255.255   255.255.255.255       172.16.0.11       172.16.0.11       25
          224.0.0.0         240.0.0.0       172.16.0.11       172.16.0.11       25
    255.255.255.255   255.255.255.255       172.16.0.11           0.0.0.0        1
    255.255.255.255   255.255.255.255       172.16.0.11       172.16.0.11        1
    91     09:57:10.448  09/03/12  Sev=Info/4    CM/0x63100034
    The Virtual Adapter was enabled:
        IP=10.0.1.205/255.0.0.0
        DNS=4.2.2.1,0.0.0.0
        WINS=0.0.0.0,0.0.0.0
        Domain=xxxx.biz
        Split DNS Names=
    92     09:57:10.458  09/03/12  Sev=Info/5    CVPND/0x63400013
        Destination           Netmask           Gateway         Interface   Metric
            0.0.0.0           0.0.0.0        172.16.0.1       172.16.0.11       25
           10.0.0.0         255.0.0.0        10.0.1.205        10.0.1.205       25
         10.0.1.205   255.255.255.255         127.0.0.1         127.0.0.1       25
    10.255.255.255   255.255.255.255        10.0.1.205        10.0.1.205       25
          127.0.0.0         255.0.0.0         127.0.0.1         127.0.0.1        1
         172.16.0.0       255.255.0.0       172.16.0.11       172.16.0.11       25
        172.16.0.11   255.255.255.255         127.0.0.1         127.0.0.1       25
    172.16.255.255   255.255.255.255       172.16.0.11       172.16.0.11       25
          224.0.0.0         240.0.0.0        10.0.1.205        10.0.1.205       25
          224.0.0.0         240.0.0.0       172.16.0.11       172.16.0.11       25
    255.255.255.255   255.255.255.255        10.0.1.205           0.0.0.0        1
    255.255.255.255   255.255.255.255        10.0.1.205        10.0.1.205        1
    255.255.255.255   255.255.255.255       172.16.0.11       172.16.0.11        1
    93     09:57:10.458  09/03/12  Sev=Info/4    CM/0x63100038
    Successfully saved route changes to file.
    94     09:57:10.458  09/03/12  Sev=Info/5    CVPND/0x63400013
        Destination           Netmask           Gateway         Interface   Metric
            0.0.0.0           0.0.0.0        172.16.0.1       172.16.0.11       25
           10.0.0.0         255.0.0.0        10.0.1.205        10.0.1.205        1
         10.0.1.205   255.255.255.255         127.0.0.1         127.0.0.1       25
    10.255.255.255   255.255.255.255        10.0.1.205        10.0.1.205       25
      a.b.c.d   255.255.255.255        172.16.0.1       172.16.0.11        1
          127.0.0.0         255.0.0.0         127.0.0.1         127.0.0.1        1
         172.16.0.0       255.255.0.0       172.16.0.11       172.16.0.11       25
         172.16.0.1   255.255.255.255       172.16.0.11       172.16.0.11        1
        172.16.0.11   255.255.255.255         127.0.0.1         127.0.0.1       25
    172.16.255.255   255.255.255.255       172.16.0.11       172.16.0.11       25
          224.0.0.0         240.0.0.0        10.0.1.205        10.0.1.205       25
          224.0.0.0         240.0.0.0       172.16.0.11       172.16.0.11       25
    255.255.255.255   255.255.255.255        10.0.1.205           0.0.0.0        1
    255.255.255.255   255.255.255.255        10.0.1.205        10.0.1.205        1
    255.255.255.255   255.255.255.255       172.16.0.11       172.16.0.11        1
    95     09:57:10.458  09/03/12  Sev=Info/6    CM/0x63100036
    The routing table was updated for the Virtual Adapter
    96     09:57:10.508  09/03/12  Sev=Info/4    CM/0x6310001A
    One secure connection established
    97     09:57:10.618  09/03/12  Sev=Info/4    CM/0x6310003B
    Address watch added for 172.16.0.11.  Current hostname: toughone, Current address(es): 10.0.1.205, 172.16.0.11.
    98     09:57:10.638  09/03/12  Sev=Info/4    CM/0x6310003B
    Address watch added for 10.0.1.205.  Current hostname: toughone, Current address(es): 10.0.1.205, 172.16.0.11.
    99     09:57:10.638  09/03/12  Sev=Info/4    IPSEC/0x63700014
    Deleted all keys
    100    09:57:10.638  09/03/12  Sev=Info/4    IPSEC/0x63700010
    Created a new key structure
    101    09:57:10.638  09/03/12  Sev=Info/4    IPSEC/0x6370000F
    Added key with SPI=0xdac635b3 into key list
    102    09:57:10.638  09/03/12  Sev=Info/4    IPSEC/0x63700010
    Created a new key structure
    103    09:57:10.638  09/03/12  Sev=Info/4    IPSEC/0x6370000F
    Added key with SPI=0x591a9ee9 into key list
    104    09:57:10.638  09/03/12  Sev=Info/4    IPSEC/0x6370002F
    Assigned VA private interface addr 10.0.1.205
    105    09:57:10.638  09/03/12  Sev=Info/4    IPSEC/0x63700037
    Configure public interface: 172.16.0.11. SG: a.b.c.d
    106    09:57:10.638  09/03/12  Sev=Info/6    CM/0x63100046
    Set tunnel established flag in registry to 1.
    107    09:57:19.741  09/03/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to a.b.c.d
    108    09:57:19.741  09/03/12  Sev=Info/6    IKE/0x6300003D
    Sending DPD request to a.b.c.d, our seq# = 3951445672
    109    09:57:19.772  09/03/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = a.b.c.d
    110    09:57:19.772  09/03/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:DPD_ACK) from a.b.c.d
    111    09:57:19.772  09/03/12  Sev=Info/5    IKE/0x63000040
    Received DPD ACK from a.b.c.d, seq# received = 3951445672, seq# expected = 3951445672
    112    09:57:30.257  09/03/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to a.b.c.d
    113    09:57:30.257  09/03/12  Sev=Info/6    IKE/0x6300003D
    Sending DPD request to a.b.c.d, our seq# = 3951445673
    114    09:57:30.297  09/03/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = a.b.c.d
    115    09:57:30.297  09/03/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:DPD_ACK) from a.b.c.d
    116    09:57:30.297  09/03/12  Sev=Info/5    IKE/0x63000040
    Received DPD ACK from a.b.c.d, seq# received = 3951445673, seq# expected = 3951445673
    117    09:57:40.772  09/03/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to a.b.c.d
    118    09:57:40.772  09/03/12  Sev=Info/6    IKE/0x6300003D
    Sending DPD request to a.b.c.d, our seq# = 3951445674
    119    09:57:40.802  09/03/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = a.b.c.d
    120    09:57:40.802  09/03/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:DPD_ACK) from a.b.c.d
    121    09:57:40.802  09/03/12  Sev=Info/5    IKE/0x63000040
    Received DPD ACK from a.b.c.d, seq# received = 3951445674, seq# expected = 3951445674
    122    09:57:54.291  09/03/12  Sev=Info/6    IKE/0x63000055
    Sent a keepalive on the IPSec SA
    123    09:58:04.306  09/03/12  Sev=Info/6    IKE/0x63000055
    Sent a keepalive on the IPSec SA
    124    09:58:14.320  09/03/12  Sev=Info/6    IKE/0x63000055
    Sent a keepalive on the IPSec SA
    125    09:58:24.334  09/03/12  Sev=Info/6    IKE/0x63000055
    Sent a keepalive on the IPSec SA
    126    09:58:34.349  09/03/12  Sev=Info/6    IKE/0x63000055
    Sent a keepalive on the IPSec SA
    127    09:58:41.359  09/03/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to a.b.c.d
    128    09:58:41.359  09/03/12  Sev=Info/6    IKE/0x6300003D
    Sending DPD request to a.b.c.d, our seq# = 3951445675
    129    09:58:41.389  09/03/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = a.b.c.d
    130    09:58:41.389  09/03/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:DPD_ACK) from a.b.c.d
    131    09:58:41.389  09/03/12  Sev=Info/5    IKE/0x63000040
    Received DPD ACK from a.b.c.d, seq# received = 3951445675, seq# expected = 3951445675
    132    09:58:54.378  09/03/12  Sev=Info/6    IKE/0x63000055
    Sent a keepalive on the IPSec SA
    133    09:59:04.392  09/03/12  Sev=Info/6    IKE/0x63000055
    Sent a keepalive on the IPSec SA
    134    09:59:14.406  09/03/12  Sev=Info/6    IKE/0x63000055
    Sent a keepalive on the IPSec SA
    135    09:59:24.421  09/03/12  Sev=Info/6    IKE/0x63000055
    Sent a keepalive on the IPSec SA
    136    09:59:34.435  09/03/12  Sev=Info/6    IKE/0x63000055
    Sent a keepalive on the IPSec SA
    137    09:59:41.946  09/03/12  Sev=Info/4    IKE/0x63000013
    SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to a.b.c.d
    138    09:59:41.946  09/03/12  Sev=Info/6    IKE/0x6300003D
    Sending DPD request to a.b.c.d, our seq# = 3951445676
    139    09:59:41.976  09/03/12  Sev=Info/5    IKE/0x6300002F
    Received ISAKMP packet: peer = a.b.c.d
    140    09:59:41.976  09/03/12  Sev=Info/4    IKE/0x63000014
    RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:DPD_ACK) from a.b.c.d
    141    09:59:41.976  09/03/12  Sev=Info/5    IKE/0x63000040
    Received DPD ACK from a.b.c.d, seq# received = 3951445676, seq# expected = 3951445676
    142    09:59:54.464  09/03/12  Sev=Info/6    IKE/0x63000055
    Sent a keepalive on the IPSec SA

  • Amazon S3 Backup with Cisco PIX 501 Router - slowww

    We are in the process of setting up an Amazon S3 network backup of the NAS server we have in our office.  We are using a Synology NAS to backup to Amazon s3, and we use a Cisco PIX 501 to secure our network.  The backup from the NAS to Amazon is going painfully slow, so I contacted Synology to resolve the issue.  After they examined everything, they think the router is filtering outbound traffic, and this is causing the upload to slow down.  I was told the upload should happen over HTTP and HTTPS, and I made sure these ports where open through the Access Rules.  There are no rules defined in the Filter Settings.
    I looked at the settings with the PDM, and I can't find where the filtering would be. Does someone have any insight to what could be happening?   I'm not too familiar with the PIX or all the network settings involved.
    Thanks!

    Thank you for your question.  This community is for Cisco Small Business products and your question is in reference to a Cisco Elite/Classic product.  Please post your question in the Cisco NetPro forums located here:
    - Wireless ----> Wireless - Mobility http://forum.cisco.com/eforum/servlet/NetProf;jsessionid=E0EEC3D9CB4E5165ED16933737822748.SJ3A?page=Wireless_-_Mobility_discussion
      This forum has subject matter experts on Cisco Elite/Classic products that may be able to answer your question.
    THANKS

  • Cisco PIX 501 to Cisco Concentrator 3005 via Remote Access

    Hello folks,
    I need your help.
    We got a Cisco PIX 501 in one location and this pix is configured for pppoe dial out. The pix connects itself to the internet via pppoe client. ping to an offical ip is running well.
    So what I want to do is to establish a von tunnel between this pix and a cisco 3005 concentrator.
    But I was not successull to establish it.
    Here is the pix config. the acl?s are only for testing and will be replaced if it works.
    PIX Version 6.3(4)
    interface ethernet0 10baset
    interface ethernet1 100full
    nameif ethernet0 outside security0
    nameif ethernet1 inside security100
    enable password xxx
    passwd xxx
    hostname PIX-AU
    domain-name araukraine.ua
    fixup protocol dns maximum-length 512
    fixup protocol ftp 21
    fixup protocol h323 h225 1720
    fixup protocol h323 ras 1718-1719
    fixup protocol http 80
    fixup protocol ils 389
    fixup protocol rsh 514
    fixup protocol rtsp 554
    fixup protocol sip 5060
    fixup protocol sip udp 5060
    fixup protocol skinny 2000
    fixup protocol smtp 25
    fixup protocol sqlnet 1521
    fixup protocol tftp 69
    names
    access-list outside permit ip any any
    access-list inside_access_in permit ip any any
    pager lines 24
    logging on
    logging monitor warnings
    logging buffered warnings
    mtu outside 1456
    mtu inside 1456
    ip address outside pppoe setroute
    ip address inside 192.168.x.x 255.255.255.0
    ip audit info action alarm
    ip audit attack action alarm
    pdm location 192.168.x.x 255.255.255.224 inside
    pdm logging warnings 500
    pdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 1 0.0.0.0 0.0.0.0 0 0
    access-group outside in interface outside
    access-group inside_access_in in interface inside
    timeout xlate 0:05:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
    timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout uauth 0:05:00 absolute
    aaa-server TACACS+ protocol tacacs+
    aaa-server TACACS+ max-failed-attempts 3
    aaa-server TACACS+ deadtime 10
    aaa-server RADIUS protocol radius
    aaa-server RADIUS max-failed-attempts 3
    aaa-server RADIUS deadtime 10
    aaa-server LOCAL protocol local
    aaa authentication ssh console LOCAL
    http server enable
    http 192.168.x.x 255.255.x.x inside
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    no snmp-server enable traps
    floodguard enable
    telnet 192.168.x.x 255.255.x.x inside
    telnet timeout 5
    ssh 194.39.97.0 255.255.255.0 outside
    ssh timeout 5
    management-access inside
    console timeout 0
    vpdn group pppoe_group request dialout pppoe
    vpdn group pppoe_group localname [email protected]
    vpdn group pppoe_group ppp authentication pap
    vpdn username [email protected] password *********
    encrypted privilege 15
    vpnclient server 212.xx.xx.xx
    vpnclient mode network-extension-mode
    vpnclient vpngroup vpntest password ********
    vpnclient username pixtest password ********
    terminal width 80
    on the concentrator I created a user pixtest, a group vpntest and I?ve created rules for the network e.g. to which server the users behind the pix will be able to access.
    And that?s all.
    I could not send you the output either of the pix or concentrator because I did not get an error or a message that the tunnel will be established.
    What can be wrong ?
    Thanks for the replies

    This sample configuration demonstrates how to form an IPsec tunnel from a PC that runs the Cisco VPN Client (4.x and later) to a Cisco VPN 3000 Concentrator to enable the user to securely access the network inside the VPN Concentrator.
    http://www.cisco.com/en/US/products/hw/vpndevc/ps2284/products_configuration_example09186a008026f96c.shtml

  • Cisco Pix 501 / DNS - DNS resolution stops working over time

    Hello,
    I currently have a Cisco Pix 501 with the configuration listed below. It  connects to the public internet via a cable modem and acts as a DCHP  server for the local LAN.
    When it first turns on, all computers obtain the correct IP settings and  can access the internet. Within 10-15 minutes, computers begin to loose  access to the Internet. What’s strange is that each computer that lost  Internet access can ping the remote address but cannot perform an  nslookup. (it shows as Server UnKnown)
    The DNS server is 167.206.254.2 which is the external dns server  provided by my ISP. I can ping this address but the local computer is  unable to use it for domain to ip resolution.
    Then network used to have an existing Windows Small Business Server that  was a DNS and WINS Server. I ran dcpromo to remove the role of the  server and uninstalled dns via add/remove components.
    Can someone please help me determine why the computers over time loose  the ability to resolve domain names and therefore loose internet access?  Can there be some bad DNS entries created? Is there anything I can run  on the local computers to further troubleshoot dns errors? Is it  possible that the existing Windows SBS server is still running DNS and  therefore causing conficts in some way?
    One thing to note is that when I reset the Pix 501, everything begins to  work again but only for a short time until one by one each computer can  no longer resolve domain names. Also, I noticed that once someone  connects via VPN and disconnects, one of the local computers looses the  ability to resolve DNS.
    Cisco Pix Config
    PIX# show config
    : Saved
    : Written by enable_15 at 08:55:56.390 UTC Fri Mar 15 2013
    PIX Version 6.3(5)
    interface ethernet0 auto
    interface ethernet1 100full
    nameif ethernet0 outside security0
    nameif ethernet1 inside security100
    enable password chiuzjKkSD33lwEw encrypted
    passwd chiuzjKkSD33lwEw encrypted
    hostname PIX
    fixup protocol dns maximum-length 512
    fixup protocol ftp 21
    fixup protocol h323 h225 1720
    fixup protocol h323 ras 1718-1719
    fixup protocol http 80
    fixup protocol rsh 514
    fixup protocol rtsp 554
    fixup protocol sip 5060
    fixup protocol sip udp 5060
    fixup protocol skinny 2000
    fixup protocol smtp 25
    fixup protocol sqlnet 1521
    fixup protocol tftp 69
    names        
    access-list VPNGROUP_splitTunnelAcl permit ip 192.168.2.0 255.255.255.0 any
    access-list inside_outbound_nat0_acl permit ip 192.168.2.0 255.255.255.0 192.168.3.0 255.255.255.128
    access-list outside_cryptomap_dyn_30 permit ip any 192.168.3.0 255.255.255.128
    access-list ping_acl permit icmp any any
    pager lines 24
    logging timestamp
    logging monitor debugging
    logging buffered debugging
    logging history debugging
    logging queue 0
    icmp permit any echo-reply outside
    icmp permit any unreachable outside
    icmp permit any echo outside
    mtu outside 1500
    mtu inside 1500
    ip address outside dhcp setroute
    ip address inside 192.168.2.1 255.255.255.0
    ip audit info action alarm
    ip audit attack action alarm
    ip local pool VPN 192.168.3.2-192.168.3.100 mask 255.255.255.0
    pdm location 192.168.2.0 255.255.255.0 inside
    pdm location 192.168.3.0 255.255.255.0 inside
    pdm logging informational 512
    no pdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_outbound_nat0_acl
    nat (inside) 1 192.168.2.0 255.255.255.0 0 0
    access-group ping_acl in interface outside
    timeout xlate 0:05:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
    timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout sip-disconnect 0:02:00 sip-invite 0:03:00
    timeout uauth 0:05:00 absolute
    aaa-server TACACS+ protocol tacacs+
    aaa-server TACACS+ max-failed-attempts 3
    aaa-server TACACS+ deadtime 10
    aaa-server RADIUS protocol radius
    aaa-server RADIUS max-failed-attempts 3
    aaa-server RADIUS deadtime 10
    aaa-server LOCAL protocol local
    aaa-server ACS protocol tacacs+
    aaa-server ACS max-failed-attempts 3
    aaa-server ACS deadtime 10
    aaa authentication ssh console LOCAL
    aaa authentication telnet console LOCAL
    http server enable
    http 192.168.2.0 255.255.255.0 inside
    http 192.168.3.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    no snmp-server enable traps
    floodguard enable
    sysopt connection permit-ipsec
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto dynamic-map VPNMAP 10 set transform-set ESP-3DES-MD5
    crypto dynamic-map VPNMAP 30 match address outside_cryptomap_dyn_30
    crypto dynamic-map VPNMAP 30 set transform-set ESP-3DES-MD5
    crypto map MYMAP 10 ipsec-isakmp dynamic VPNMAP
    crypto map MYMAP client authentication LOCAL
    crypto map MYMAP interface outside
    isakmp enable outside
    isakmp identity address
    isakmp nat-traversal 20
    isakmp policy 10 authentication pre-share
    isakmp policy 10 encryption des
    isakmp policy 10 hash md5
    isakmp policy 10 group 1
    isakmp policy 10 lifetime 86400
    isakmp policy 30 authentication pre-share
    isakmp policy 30 encryption 3des
    isakmp policy 30 hash md5
    isakmp policy 30 group 2
    isakmp policy 30 lifetime 86400
    vpngroup VPNGRP idle-time 1800
    vpngroup VPNGROUP address-pool VPN
    vpngroup VPNGROUP dns-server 167.206.254.2
    vpngroup VPNGROUP wins-server 192.168.2.50
    vpngroup VPNGROUP default-domain advancedarthritiscarecenter.local
    vpngroup VPNGROUP split-tunnel VPNGROUP_splitTunnelAcl
    vpngroup VPNGROUP idle-time 1800
    vpngroup VPNGROUP password ********
    telnet 192.168.2.0 255.255.255.0 inside
    telnet 192.168.3.0 255.255.255.0 inside
    telnet timeout 30
    ssh 192.168.2.0 255.255.255.0 inside
    ssh 192.168.3.0 255.255.255.0 inside
    ssh timeout 60
    console timeout 0
    dhcpd address 192.168.2.2-192.168.2.33 inside
    dhcpd dns 167.206.254.2 167.206.254.2
    dhcpd lease 7200
    dhcpd ping_timeout 750
    dhcpd enable inside
    username admin password pO9NW1GJpm4IIIFK encrypted privilege 15
    username andrew password A340D92MQ0zV0hGs encrypted privilege 15
    terminal width 80
    Cryptochecksum:aacfb7d8ae07a6075baf8656a724fbec

    Wow...i didn't realize this was possible. I will certainly check the logs tomorrow via the existing thread but just to confirm, is this only true if DHCP is enabled on PIX?
    In other words, I managed to work around this issue by applying static IP's to all computers and the internet works just fine.

  • Pix 501 VPN Passthrough

    I am a novice/new cisco user. I have been struggling trying to configure a Cisco Pix 501 to allow passthrough of VPN traffic. I have reviewed many articles and posts but have not had success in putting the proper configuration together. I am running a Symantec VPN client to a Symantec Security Gateway. The VPN works fine when the PIX is out of the configuration.
    The Pix is version 6.3 and I also have PDM 3.0 working. I am new to the routing world. I understand most concepts but I seem to be missing a vital piece of information. The error on the symantec VPN client is as follows. Error connecting tunnel to xxx.xxx.xxx.xxx. The server rejected the ISAKMP Security association. Make sure the Phase1 ID's, shared key and IKE policy are correct.
    Thank you for your assistance.

    Hello Tom,
    I dont know if it works in 6x IOS but here is another inspection
    fixup protocol ipsec-pass-thru
    Also make sure that you did a one-to-one static mapping (conduits used in legacy IOS) for an unused public IP of yours because you can not PAT gre or esp to an internal host. And you may also need an outside acl
    access-list outside_access_in permit gre xxx
    access-list outside_access_in permit ipsec xx
    access-list outside_access_in permit esp xxx
    access-list outside_access_in permit ah xxx
    Regards

  • IPSEC Tunnel between JUNIPER (SSG 20) and CISCO PIX 501

    I have successfully established the IPSEC tunnel with juniper firewall by using cisco Pix 501 (6.3 version). The problem I am facing, I have network layer connectivity but after time interval I am not able to send the traffic on destination IP address on specific port, but can successfully PING the destination IP. On both firewalls the IPs are permitted for all ports.

    Dear Mr.
    The same problem has occured with me.

  • PIX 501 VPN HELP NO NETWORK ACCESS!

    I need some help please..
    I am trying to connect Windows 7 VPN to L2TP access on the PIX 501. I know that PIX 501 doesn't allow MSCHAP v2. The VPN connects fine but when trying to access the local network and shared drives remote desktop I am not able to connect. I already I have the IPV4 / IPV6 IP Settings on the VPN for use default gateway on remote network unchecked.  Can you please help me configure this correctly if I am configuring incorrectly.
    PIX Version 6.3(4)
    interface ethernet0 auto
    interface ethernet1 100full
    nameif ethernet0 outside security0
    nameif ethernet1 inside security100
    enable password 8Ry2YjIyt7RRXU24 encrypted
    passwd ANRIhDDsTteQmCkO encrypted
    hostname pixfirewall
    domain-name controller.hopto.org
    fixup protocol dns maximum-length 512
    fixup protocol ftp 21
    fixup protocol h323 h225 1720
    fixup protocol h323 ras 1718-1719
    fixup protocol http 80
    fixup protocol rsh 514
    fixup protocol rtsp 554
    fixup protocol sip 5060
    fixup protocol sip udp 5060
    fixup protocol skinny 2000
    fixup protocol smtp 25
    fixup protocol sqlnet 1521
    fixup protocol tftp 69
    names
    access-list out2in permit tcp any interface outside eq www
    access-list out2in permit tcp any interface outside eq https
    access-list out2in permit tcp any interface outside eq 3074
    access-list out2in permit udp any interface outside eq 88
    access-list out2in permit udp any interface outside eq 3074
    access-list out2in permit udp any interface outside eq domain
    access-list out2in permit tcp any interface outside eq domain
    access-list out2in permit udp any interface outside eq 1701
    access-list nonat permit ip 192.168.1.0 255.255.255.0 172.17.130.0 255.255.255.192
    access-list vpn-cryptomap permit ip any 172.17.130.0 255.255.255.0
    pager lines 24
    logging on
    logging timestamp
    logging standby
    logging buffered informational
    logging trap informational
    mtu outside 1500
    mtu inside 1500
    ip address outside dhcp setroute
    ip address inside 192.168.1.1 255.255.255.0
    ip audit info action alarm
    ip audit attack action alarm
    ip local pool l2tp-pool 172.17.130.1-172.17.130.254
    pdm logging informational 100
    pdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list nonat
    nat (inside) 1 192.168.1.0 255.255.255.0 0 0
    nat (inside) 1 0.0.0.0 0.0.0.0 0 0
    static (inside,outside) tcp interface www 192.168.1.33 www netmask 255.255.255.255 0 0
    static (inside,outside) tcp interface https 192.168.1.2 https netmask 255.255.255.255 0 0
    static (inside,outside) tcp interface domain 192.168.1.30 domain netmask 255.255.255.255 0 0
    static (inside,outside) udp interface domain 192.168.1.30 domain netmask 255.255.255.255 0 0
    static (inside,outside) tcp interface 3074 192.168.1.30 3074 netmask 255.255.255.255 0 0
    static (inside,outside) udp interface 3074 192.168.1.30 3074 netmask 255.255.255.255 0 0
    static (inside,outside) udp interface 88 192.168.1.30 88 netmask 255.255.255.255 0 0
    access-group out2in in interface outside
    timeout xlate 0:05:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
    timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout uauth 0:05:00 absolute
    aaa-server TACACS+ protocol tacacs+
    aaa-server TACACS+ max-failed-attempts 3
    aaa-server TACACS+ deadtime 10
    aaa-server RADIUS protocol radius
    aaa-server RADIUS max-failed-attempts 3
    aaa-server RADIUS deadtime 10
    aaa-server LOCAL protocol local
    aaa authentication ssh console LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    no snmp-server enable traps
    floodguard enable
    sysopt connection permit-ipsec
    sysopt connection permit-l2tp
    crypto ipsec transform-set cisco-l2tp esp-3des esp-sha-hmac
    crypto ipsec transform-set cisco-l2tp mode transport
    crypto dynamic-map l2tp 30 set transform-set cisco-l2tp
    crypto map dmu 30 ipsec-isakmp dynamic l2tp
    crypto map dmu interface outside
    isakmp enable outside
    isakmp key ******** address 0.0.0.0 netmask 0.0.0.0
    isakmp identity address
    isakmp nat-traversal 20
    isakmp policy 5 authentication pre-share
    isakmp policy 5 encryption 3des
    isakmp policy 5 hash sha
    isakmp policy 5 group 2
    isakmp policy 5 lifetime 28800
    telnet timeout 5
    ssh 192.168.1.0 255.255.255.0 inside
    ssh timeout 15
    console timeout 0
    vpdn group 2 accept dialin l2tp
    vpdn group 2 ppp authentication pap
    vpdn group 2 client configuration address local l2tp-pool
    vpdn group 2 client authentication local
    vpdn group 2 l2tp tunnel hello 60
    vpdn username Brandon password *********
    vpdn enable outside
    dhcpd address 192.168.1.2-192.168.1.33 inside
    dhcpd dns 4.2.2.1 4.2.2.2
    dhcpd lease 3600
    dhcpd ping_timeout 750
    dhcpd auto_config outside
    dhcpd enable inside
    username Brandon password PX78ZeD.LCbQntqy encrypted privilege 15
    terminal width 80
    Cryptochecksum:6e43dff6ef4837997276c092f9204707
    : end
    Thanks,
    Brandon

    Yes, you can modify it.
    By the way, here is a good link about MS:
    Troubleshooting Microsoft Network Neighborhood After Establishing a VPN Tunnel With the Cisco VPN Client
    HTH.
    Portu.

  • PIX 501 VPN setup

    Can any one please advise me I am trying to set up a VPN on my PIX 501 and for some reason it is not working. I have posted the scrips below. If someone can advise me what I need to change that would be great.
    interface ethernet0 auto
    interface ethernet1 100full
    nameif ethernet0 outside security0
    nameif ethernet1 inside security100
    enable password P@55w0rd! encrypted
    passwd P@55w0rd! encrypted
    hostname CFSLXAKALAZ
    domain-name akademic.com
    fixup protocol dns maximum-length 512
    fixup protocol ftp 21
    fixup protocol h323 h225 1720
    fixup protocol h323 ras 1718-1719
    fixup protocol http 80
    fixup protocol rsh 514
    fixup protocol rtsp 554
    fixup protocol sip 5060
    fixup protocol sip udp 5060
    fixup protocol skinny 2000
    no fixup protocol smtp 25
    fixup protocol sqlnet 1521
    fixup protocol tftp 69
    names
    name 192.168.2.0 VPN
    object-group service RemoteDesktop tcp
    port-object range 3389 3389
    access-list inside_access_in remark Allow all outbound UDP port 53 for DNS
    access-list inside_access_in permit udp any any eq domain
    access-list inside_access_in remark Allow ping to any external IP
    access-list inside_access_in permit icmp any any
    access-list inside_access_in remark Allow all outbound TCP connections
    access-list inside_access_in permit tcp any any
    access-list outside_access_in remark Allow external DNS via UDP
    access-list outside_access_in permit udp any eq domain any
    access-list outside_access_in remark Allow ping from outside to inside
    access-list outside_access_in permit icmp any any
    access-list outside_access_in remark Remote Desktop to any internal IP
    access-list outside_access_in permit tcp any any object-group RemoteDesktop
    pager lines 24
    mtu outside 1500
    mtu inside 1500
    ip address outside 10.20.58.30 255.255.255.0
    ip address inside 192.168.2.1 255.255.255.0
    ip audit info action alarm
    ip audit attack action alarm
    ip local pool donkpool 192.168.2.50-192.168.2.60
    pdm location 10.20.58.0 255.255.255.0 outside
    pdm location 192.168.2.0 255.255.255.0 inside
    pdm logging informational 100
    pdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 1 0.0.0.0 0.0.0.0 0 0
    route outside 0.0.0.0 0.0.0.0 10.20.58.1 1
    access-group outside_access_in in interface outside
    access-group inside_access_in in interface inside
    timeout xlate 0:05:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
    timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout uauth 0:05:00 absolute
    aaa-server TACACS+ protocol tacacs+
    aaa-server TACACS+ max-failed-attempts 3
    aaa-server TACACS+ deadtime 10
    aaa-server RADIUS protocol radius
    aaa-server RADIUS max-failed-attempts 3
    aaa-server RADIUS deadtime 10
    aaa-server LOCAL protocol local
    http server enable
    http 10.20.58.0 255.255.255.0 outside
    http 192.168.2.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    no snmp-server enable traps
    floodguard enable
    vpngroup donk address-pool donkpool
    vpngroup donk idle-time 1800
    vpngroup donk password P@55w0rd!
    telnet 10.20.58.30 255.255.255.0 outside
    telnet 192.168.2.0 255.255.255.0 inside
    telnet timeout 5
    ssh 10.20.58.0 255.255.255.0 outside
    ssh 192.168.2.0 255.255.255.0 inside
    ssh timeout 5
    console timeout 0
    dhcpd address 192.168.2.128-192.168.2.252 inside
    dhcpd dns 158.152.1.58
    dhcpd lease 3600
    dhcpd ping_timeout 750
    dhcpd auto_config outside
    dhcpd enable inside
    terminal width 80
    terminal width 80

    You are missing a lot of config, depending on what type of vpn you are trying to setup please follow the links below to complete it:
    http://www.cisco.com/en/US/docs/security/pix/pix63/configuration/guide/ipsecint.html
    http://www.cisco.com/en/US/docs/security/pix/pix63/configuration/guide/sit2site.html
    http://www.cisco.com/en/US/docs/security/pix/pix63/configuration/guide/basclnt.html

  • Cisco pix 501 open port problem

    Hi,
    I'm running a Pix 501 for Home office and I want to open first ports for my mail client for an outside located server.
    But i get following error in the log:
    106023: Deny tcp src outside:<ipmailserver>/993 dst inside:<ipoutsideinterface>/1729 by access-group "outside-mail"
    here's my basic config:
    PIX Version 6.3(3)
    interface ethernet0 auto
    interface ethernet1 100full
    nameif ethernet0 outside security0
    nameif ethernet1 inside security100
    enable password YYYYYY encrypted
    passwd YYYYYY encrypted
    hostname sunny
    domain-name ciscopix.com
    fixup protocol dns maximum-length 512
    fixup protocol ftp 21
    fixup protocol h323 h225 1720
    fixup protocol h323 ras 1718-1719
    fixup protocol http 80
    fixup protocol ils 389
    fixup protocol pptp 1723
    fixup protocol rsh 514
    fixup protocol rtsp 554
    fixup protocol sip 5060
    fixup protocol sip udp 5060
    fixup protocol skinny 2000
    no fixup protocol smtp 25
    fixup protocol sqlnet 1521
    fixup protocol tftp 69
    names
    access-list outside-mail permit tcp any any eq 465
    access-list outside-mail permit tcp any any eq 993
    pager lines 24
    logging on
    logging monitor emergencies
    logging buffered informational
    mtu outside 1500
    mtu inside 1500
    ip address outside dhcp setroute
    ip address inside 192.168.10.254 255.255.255.0
    ip audit info action alarm
    ip audit attack action alarm
    pdm logging informational 100
    pdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 1 192.168.10.0 255.255.255.0 0 0
    access-group outside-mail in interface outside
    timeout xlate 0:05:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
    timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout uauth 0:05:00 absolute
    aaa-server TACACS+ protocol tacacs+
    aaa-server RADIUS protocol radius
    aaa-server LOCAL protocol local
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    no snmp-server enable traps
    floodguard enable
    telnet 192.168.10.0 255.255.255.0 inside
    telnet timeout 5
    ssh 192.168.10.0 255.255.255.0 inside
    ssh timeout 60
    console timeout 0
    dhcpd address 192.168.10.10-192.168.10.39 inside
    dhcpd lease 3600
    dhcpd ping_timeout 750
    dhcpd auto_config outside
    dhcpd enable inside
    username stefan password YYYYY encrypted privilege 2
    terminal width 80
    Cryptochecksum:
    : end
    [OK]
    What's the problem?
    Any recommondations for the config anyway?
    Thanks

    Thanks Gerhard for the answer, but i don't want to redirect the port to an inside mail server.
    I try to connect to an outside mail server with a mail client from an inside pc (who is in the dhcp ip pool, i.e. 192.168.10.22).
    to open the ports i added:
    access-list outside-mail permit tcp any any eq 465
    access-list outside-mail permit tcp any any eq 993
    access-group outside-mail in interface outside
    but why is there a deny because of the access-group in the log?
    106023: Deny tcp src outside:/993 dst inside:/1729 by access-group "outside-mail"
    Regards S.

  • Pix 501 VPN Wizard, no internet

                       Using the straight forward VPN
                        Remote Access to VPN
                        Cisco Client 3.x or higher
                        Group Name & Preshared key (no cert)
                        EECA, Local
                         VPN pool configured
              .....all standard stuff.
    I can connect but I cannot access the internet.
    Questions:
    Why can't I see my network server? I can sort of map a drive by typing in \\myserve\shared folder
    Why can't I get on the internet when connected to the VPN?
    VPN client 5.0..07.0410
    PDM 3.0.4
    Pix 6.3.5
    Thanks

    Yes, you can modify it.
    By the way, here is a good link about MS:
    Troubleshooting Microsoft Network Neighborhood After Establishing a VPN Tunnel With the Cisco VPN Client
    HTH.
    Portu.

  • Cisco PIX 501 Firewall Config

    Hi,
    I know this is an old firewall but its just a simple firewall I need, my question is this.
    I am not getting any internet with my current config, see below:
    show conf
    : Saved
    : Written by enable_15 at 00:52:17.182 UTC Fri Jul 20 2012
    PIX Version 6.3(5)
    interface ethernet0 auto shutdown
    interface ethernet1 100full
    nameif ethernet0 outside security0
    nameif ethernet1 inside security100
    enable password PVSASRJovmamnVkD encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    hostname bmi-501-fw-1
    domain-name buildmeit.internal
    fixup protocol dns maximum-length 512
    fixup protocol ftp 21
    fixup protocol h323 h225 1720
    fixup protocol h323 ras 1718-1719
    fixup protocol http 80
    fixup protocol rsh 514
    fixup protocol rtsp 554
    fixup protocol sip 5060
    fixup protocol sip udp 5060
    fixup protocol skinny 2000
    fixup protocol smtp 25
    fixup protocol sqlnet 1521
    fixup protocol tftp 69
    names
    access-list allow_ping permit icmp any any echo-reply
    access-list allow_ping permit icmp any any source-quench
    access-list allow_ping permit icmp any any unreachable
    access-list allow_ping permit icmp any any time-exceeded
    pager lines 24
    mtu outside 1500
    mtu inside 1500
    ip address outside 78.XX.XXX.XXX 255.255.240.0
    ip address inside 10.52.100.123 255.255.255.0
    ip audit info action alarm
    ip audit attack action alarm
    pdm history enable
    arp timeout 14400
    nat (inside) 101 0.0.0.0 0.0.0.0 0 0
    access-group allow_ping in interface outside
    access-group allow_ping in interface inside
    route inside 10.52.0.0 255.255.0.0 10.52.100.123 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
    timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout sip-disconnect 0:02:00 sip-invite 0:03:00
    timeout uauth 0:05:00 absolute
    aaa-server TACACS+ protocol tacacs+
    aaa-server TACACS+ max-failed-attempts 3
    aaa-server TACACS+ deadtime 10
    aaa-server RADIUS protocol radius
    aaa-server RADIUS max-failed-attempts 3
    aaa-server RADIUS deadtime 10
    aaa-server LOCAL protocol local
    http server enable
    http 10.52.10.0 255.255.255.0 inside
    http 10.52.66.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    no snmp-server enable traps
    floodguard enable
    telnet timeout 5
    ssh timeout 5
    management-access inside
    console timeout 0
    terminal width 80
    Cryptochecksum:f8f18bf2b944dddfaf3d83e6c1e1c57c
    bmi-501-fw-1#
    What am I missing, if I try and ping 8.8.8.8 it times out, any suggestions?

    Hi, Thanks for the reply, I've managed to sort it now with the following config below:
    interface ethernet0 auto
    interface ethernet1 100full
    nameif ethernet0 outside security0
    nameif ethernet1 inside security100
    hostname bmi-501-fw-1
    domain-name buildmeit.internal
    fixup protocol dns maximum-length 512
    fixup protocol ftp 21
    fixup protocol h323 h225 1720
    fixup protocol h323 ras 1718-1719
    fixup protocol http 80
    fixup protocol rsh 514
    fixup protocol rtsp 554
    fixup protocol sip 5060
    fixup protocol sip udp 5060
    fixup protocol skinny 2000
    fixup protocol smtp 25
    fixup protocol sqlnet 1521
    fixup protocol tftp 69
    access-list PERMIT_IN deny tcp any any
    access-list PERMIT_IN deny ip any any
    access-list PERMIT_IN deny udp any any
    access-list PERMIT_OUT permit tcp any any
    access-list PERMIT_OUT permit ip any any
    access-list PERMIT_OUT permit udp any any
    access-list PERMIT_OUT permit icmp any any
    pager lines 24
    mtu outside 1500
    mtu inside 1500
    ip address outside XXX.XX.XXX.XXX 255.255.240.0
    ip address inside 10.52.100.123 255.255.255.0
    global (outside) 1 interface
    outside interface address added to PAT pool
    nat (inside) 1 0.0.0.0 0.0.0.0 0 0
    access-group PERMIT_IN in interface outside
    access-group PERMIT_OUT in interface inside
    route outside 0.0.0.0 0.0.0.0 XX.XX.XXX.1 1
    route inside 10.52.0.0 255.255.0.0 10.52.100.123 1
    wr mem
    Regards to point 5 where you say devices like this shouldnt be used, I know its an unsupported device but what other reasons should I not be using it, its a good\simple firewall - i'd rather use this than say...........a horrible netgear!

  • Pix 501 vpn problem

    I can connect but don't see any network resources.
    The Vpn Client, ver:5.0.01, is running on an xp machine.
    The network it is connecting to is behind a pix501- Ver. 6.3(5).
    When the connection is made the remote client gets an assigned address from the vpn pool 192.168.2.10- 192.168.2.25:
    The vpn client log shows:
    Line:45 18:07:27.898 08/12/09 Sev=Info/4 CM/0x63100034
    The Virtual Adapter was enabled:
    IP=192.168.2.10/255.255.255.0
    DNS=0.0.0.0,0.0.0.0
    WINS=0.0.0.0,0.0.0.0
    Domain=
    Split DNS Names=
    This is followed by these lines:
    46 18:07:27.968 08/12/09 Sev=Warning/2 CVPND/0xE3400013
    AddRoute failed to add a route: code 87
    Destination 192.168.1.255
    Netmask 255.255.255.255
    Gateway 192.168.2.1
    Interface 192.168.2.10
    47 18:07:27.968 08/12/09 Sev=Warning/2 CM/0xA3100024
    Unable to add route. Network: c0a801ff, Netmask: ffffffff, Interface: c0a8020a, Gateway: c0a80201.
    48 18:07:28.178 08/12/09 Sev=Info/4 CM/0x63100038
    Successfully saved route changes to file.
    49 18:07:28.198 08/12/09 Sev=Info/6 CM/0x63100036
    The routing table was updated for the Virtual Adapter
    50 18:07:29.760 08/12/09 Sev=Info/4 CM/0x6310001A
    One secure connection established
    I can ping, from the remote client, to an inside ip behind the pix even
    when I get the "add route failure" shown above, but i can't ping the computer name.
    I enabled NAT traversal using the PDM, But when I connect with this option I get the error that the "Remote end is NOT behind a NAT device This end IS behind a NAT device" and ping fails.
    Behind the pix are a few computers with no central server so I'm not passing a WINS server to the remote client.
    I set up the vpn with the wizard.
    Attached is the config file.
    Any suggestions would be appreciated.
    Regards,
    Hugh

    Hugh, sure you can rate based on the overall of the conversation but you are not obligated to do so but certainly would be nice to provide ratings.
    To summarized the overall narrowing down possible issues, the main goal was to ensure RA VPN configuration on the PIX501 was corrected.
    1- We enabled NAT-T on the firewall - even though this was not the issue but it is required to have it there should you RA VPN from other locations - NAT travseral makes the firewall aware of NAT devices from other ends - here is some good information on NAT-T for reference in future
    http://www.microsoft.com/technet/community/columns/cableguy/cg0802.mspx
    2-We corrected the VPN POOL network /28 as well as the nonat access list and crypto acl to be consistant.
    Here is a link for future reference with numerous PIX configuration scenarios
    http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/prod_configuration_examples_list.html
    lastly - your only remaining issue we can say is purely isolated with MAC machine and vpn client software.
    You could perhaps try different version of the client in the MAC, or also look into release notes open caveats to rule out cisco cleint versioning and MAC versioning if there is any issues.
    http://www.cisco.com/en/US/products/sw/secursw/ps2308/prod_release_notes_list.html
    Regards

  • Cisco Pix 525 VPN - iPhone/iPad won't connect

    hi,
    i have one of the most basic configurations on a PIX 525 with remote access enabled. i am able to connect from a desktop machine running the cisco vpn client but for some reason i cant get my iphone or ipad to connect to my vpn. i get the error message stating 'the server did not respond'.
    i am running ios 8.0.4 and i have a 3DES license which is required from what i understand.
    im starting to think that this really is in the configuration. could it be the transform set specification?
    can some one shed some light on this subject?
    below is close to the current configuration, but its not exact, some things in it were corrected, so ignore them. it is the best i have, since i am away for the holiday. it should give insight into any areas that might be part of the problem.
    thcvpn01(config)# show config
    : Saved
    : Written by enable_15 at 07:33:33.113 UTC Fri Nov 8 2013
    PIX Version 8.0(4)
    hostname thcvpn01
    domain-name somewhere.net
    enable password* encrypted
    passwd * encrypted
    names
    interface Ethernet0
    nameif outside
    security-level 0
    ip address dhcp setroute
    interface Ethernet1
    nameif inside
    security-level 100
    ip address 10.1.1.1 255.255.255.0
    interface Ethernet2
    shutdown
    no nameif
    no security-level
    no ip address
    interface Ethernet3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Ethernet4
    shutdown
    no nameif
    no security-level
    no ip address
    interface Ethernet5
    shutdown
    no nameif
    no security-level
    no ip address
    ftp mode passive
    dns domain-lookup outside
    dns domain-lookup inside
    dns server-group DefaultDNS
    name-server 208.67.222.222
    name-server 208.67.222.220
    domain-name somewhere.net
    same-security-traffic permit intra-interface
    object-group icmp-type ICMPObject
    icmp-object echo-reply
    icmp-object source-quench
    icmp-object time-exceeded
    icmp-object unreachable
    access-list outside_access_in extended permit icmp any any object-group ICMPObje
    ct
    access-list inside-nat0 extended permit ip 10.1.1.0 255.255.255.0 10.1.2.0 255.2
    55.255.0
    access-list SPLIT-TUNNEL standard permit 10.1.1.0 255.255.255.0
    pager lines 24
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    ip local pool ThcIPPool 10.1.2.1-10.1.2.50 mask 255.255.255.0
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    nat-control
    global (outside) 101 interface
    nat (outside) 101 10.1.2.0 255.255.255.0 outside
    nat (inside) 0 access-list inside-nat0
    nat (inside) 101 10.0.0.0 255.0.0.0
    access-group outside_access_in in interface outside
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 10.1.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set THCTransformSet esp-3des esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map THCDynamicMap 1 set transform-set THCTransformSet
    crypto dynamic-map THCDynamicMap 1 set security-association lifetime seconds 288
    00
    crypto dynamic-map THCDynamicMap 1 set security-association lifetime kilobytes 4
    608000
    crypto dynamic-map THCDynamicMap 1 set reverse-route
    crypto map THCCryptoMap 1 ipsec-isakmp dynamic THCDynamicMap
    crypto map THCCryptoMap interface outside
    crypto isakmp enable outside
    crypto isakmp policy 1
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 43200
    crypto isakmp policy 65535
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp nat-traversal 30
    telnet timeout 5
    ssh 0.0.0.0 0.0.0.0 outside
    ssh timeout 5
    ssh version 2
    console timeout 0
    dhcpd address 10.1.1.50-10.1.1.254 inside
    dhcpd dns 208.67.222.222 208.67.222.220 interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    group-policy THCVpnGroup internal
    group-policy THCVpnGroup attributes
    dns-server value 208.67.222.222 208.67.222.220
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelall
    username [username] password [password] encrypted
    tunnel-group THCVpnGroup type remote-access
    tunnel-group THCVpnGroup general-attributes
    address-pool ThcIPPool
    default-group-policy THCVpnGroup
    tunnel-group THCVpnGroup ipsec-attributes
    pre-shared-key *
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
    message-length maximum 512
    policy-map global_policy
    class inspection_default
    inspect dns preset_dns_map
    inspect ftp
    inspect h323 h225
    inspect h323 ras
    inspect netbios
    inspect rsh
    inspect rtsp
    inspect skinny
    inspect esmtp
    inspect sqlnet
    inspect sunrpc
    inspect tftp
    inspect sip
    inspect xdmcp
    inspect icmp
    inspect icmp error
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:d57ad5e7f32936cf000c4be69d4385cb
    thcvpn01(config)#
    thcvpn01(config)#
    thcvpn01(config)#
    jeff

    hi,
    as a primary note, the people at apple's genius bar are not genious. they do not know that the following, so if you found your way here. awesome.
    the correct answer is that the iphone and ipad only supports aes. you have to modify the crypto map to use aes as well as modify the isakmp service to use aes. i believe it supports all aes options, aes, aes 192 and aes 256.
    in all of the frustration, do not, as i did, forget that your username is case sensitive.
    jeff

Maybe you are looking for

  • Excise Base value and BED is wrong in MIGO and J1IG

    Hi, we are creating the PO for Depot, Tax code is NO ED setoff means The BED  is going to Inventory. material is FERT material and Plant is DEPOT. we are using the conditions here are PB00some Z conditions and the BED is calculted on the PB00Z coniti

  • Applet compiles but doesn't work as intended

    My program intends to add, subtract, multiply or divide two numbers, whereby, if the user enters 'A' the program adds the two numbers, and 'S' to subtract them etc. The program compiles fine but as I am pretty new to Java I'm finding it hard to find

  • Stereo preset for 3D Objects

    The stereo preset for 3d objects does not really work very well with the glasses I have. I am using the shrek glasses which I thought were blue and red, but they may be cyan and red. Is there a way to change the preset colors for this property or any

  • Moving to an external Ethernet Drive - Libraries and Photos are a mess - Cant Find Images

    I am in the process of wanrting to consolidate my LR3 files to an 2TB external ethernet drive (connected via airport extreme).  First, are there any issue with using the networked drive.  I've heard that there may be. Second, my libraries and photos

  • Need HELP passing raw SOAP to JAX-RPC Web Service

    Ive recently downloaded the web services development kit from the SUN site and have got all the examples to work fine. What I am now trying to do is pass RAW SOAP to the HelloWorld JAX-RPC example, Ive managed to get the service to call the sayHello