VPN -- why do I see the remote IP address (not vpn pool addr) in my log?
Bookmark this page:
 Yahoo!
 Google
 Windows Live
 del.icio.us
 digg
 Netscape
|
|
||||||||||||||||
|
Posted by Hank Zoeller on February 10, 2006, 1:35 pm
Please log in for more thread options I can connect and authenticate fine. When I try to map a drive, I see the following in the PIX log: No translation group found for tcp src outside:192.168.200.2/1075 dst inside:192.168.0.250/139 I'm surprised to see the 192.168.200.2 address. That is the private internal address of the outside machine on it's remote LAN. But I thought I'd see the ip address assigned to it from the PIX VPN pool which is 192.168.4.1. My current config: ... access-list inside_outbound_nat0_acl permit ip 192.168.0.0 255.255.255.0 192.168.4.0 255.255.255.0 ... nat (inside) 0 access-list inside_outbound_nat0_acl nat (inside) 1 0.0.0.0 0.0.0.0 0 0 ... ip local pool vpn_users 192.168.4.1-192.168.4.254 ... sysopt connection permit-pptp ... vpdn group PPTP-VPDN-GROUP accept dialin pptp vpdn group PPTP-VPDN-GROUP ppp authentication pap vpdn group PPTP-VPDN-GROUP ppp authentication chap vpdn group PPTP-VPDN-GROUP ppp authentication mschap vpdn group PPTP-VPDN-GROUP ppp encryption mppe auto vpdn group PPTP-VPDN-GROUP client configuration address local vpn_users vpdn group PPTP-VPDN-GROUP pptp echo 60 vpdn group PPTP-VPDN-GROUP client authentication local vpdn enable outside ... Thanks for any help offered. -- HZ | ||||||||||||||||
|
Posted by Julian Dragut on February 12, 2006, 11:54 pm
Please log in for more thread options http://www.cisco.com/en/US/products/sw/secursw/ps2308/products_configuration_example09186a00801e71c0.shtml HTH | ||||||||||||||||
|
Posted by Walter Roberson on February 13, 2006, 12:54 am
Please log in for more thread options :sysopt connection permit-ipsec
Unfortunately, no. Hank is not using ipsec, he is using pptp, and his quoted configuration already includes sysopt connection permit-pptp | ||||||||||||||||
>
> I can connect and authenticate fine. When I try to map a drive, I see the
> following in the PIX log:
> No translation group found for tcp src outside:192.168.200.2/1075 dst
> inside:192.168.0.250/139
>
> I'm surprised to see the 192.168.200.2 address. That is the private
> internal address of the outside machine on it's remote LAN. But I thought
> I'd see the ip address assigned to it from the PIX VPN pool which is
> 192.168.4.1.
>
> My current config:
> ...
> access-list inside_outbound_nat0_acl permit ip 192.168.0.0 255.255.255.0
> 192.168.4.0 255.255.255.0
> ...
> nat (inside) 0 access-list inside_outbound_nat0_acl
> nat (inside) 1 0.0.0.0 0.0.0.0 0 0
> ...
> ip local pool vpn_users 192.168.4.1-192.168.4.254
> ...
> sysopt connection permit-pptp
> ...
> vpdn group PPTP-VPDN-GROUP accept dialin pptp
> vpdn group PPTP-VPDN-GROUP ppp authentication pap
> vpdn group PPTP-VPDN-GROUP ppp authentication chap
> vpdn group PPTP-VPDN-GROUP ppp authentication mschap
> vpdn group PPTP-VPDN-GROUP ppp encryption mppe auto
> vpdn group PPTP-VPDN-GROUP client configuration address local vpn_users
> vpdn group PPTP-VPDN-GROUP pptp echo 60
> vpdn group PPTP-VPDN-GROUP client authentication local
> vpdn enable outside
> ...
>
> Thanks for any help offered.
> --
> HZ