remote access vpn question (second try - sorry about that, question included this time.)
Bookmark this page:
 Yahoo!
 Google
 Windows Live
 del.icio.us
 digg
 Netscape
|
|
||||||||||
|
Posted by trumbo on April 2, 2007, 5:05 pm
Please log in for more thread options I'm sure I'm missing something obvious here. I have a pix 506e running 6.3.(5) I have set it up to do remote access using ike mode config. The inside int of the pix is connected to a dedicated 2960g for this client, on which both their public and private vlans live. Server are connected to same switch as pix, and inside int of pix is in same vlan as private ints of servers. i have set the ip pool to the private network of the client. (10.10.1.0/24) NET-A and the inside int of the pix is numbered into 10.100.1.0/24, which is pretty much an arbitrary network assignment, NET-B I have set up the acl to allow traffic from inside int(NET-B) net to the ip pool (NET-A). I have done this essentially mirroring all the config examples I have found. It isn't working currently, it appears to be assigning the ip correctly to client (from NET-A), but not passing traffic through to servers behind the pix numbered into the same network. Does the net that the inside int is in need to exist somewhere other than on the pix? (given that the traffic from pix is going to have a source- ip of the pool, i don't know why it would.) I'm sure i'm missing something obvious here, and its driving me a little nuts. any help is appreciated. my config is below: Thanks, Dalton interface ethernet0 auto interface ethernet1 auto nameif ethernet0 outside security0 nameif ethernet1 inside security100 hostname remote-access domain-name client.domain.com fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol ils 389 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 names access-list NONAT permit ip 10.100.1.0 255.255.255.0 10.10.1.0 255.255.255.0 access-list Split-tunnel permit ip 10.100.1.0 255.255.255.0 10.10.1.0 255.255.255.0 pager lines 24 mtu outside 1500 mtu inside 1500 ip address outside 207.1.1.10 255.255.255.224 ip address inside 10.100.1.220 255.255.255.0 ip audit info action alarm ip audit attack action alarm ip local pool POOL 10.10.1.240 pdm logging informational 100 pdm history enable arp timeout 14400 nat (inside) 0 access-list NONAT route outside 0.0.0.0 0.0.0.0 207.1.1.1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout sip-disconnect 0:02:00 sip-invite 0:03:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server TACACS+ max-failed-attempts 3 aaa-server TACACS+ deadtime 10 aaa-server RADIUS protocol radius aaa-server RADIUS max-failed-attempts 3 aaa-server RADIUS deadtime 10 aaa-server LOCAL protocol local floodguard enable sysopt connection permit-ipsec crypto ipsec transform-set mytrans esp-aes esp-sha-hmac crypto dynamic-map dynmap 10 set transform-set mytrans crypto map statmap 999 ipsec-isakmp dynamic dynmap crypto map statmap client configuration address initiate crypto map statmap client authentication LOCAL crypto map statmap interface outside isakmp enable outside isakmp nat-traversal 20 isakmp policy 10 authentication pre-share isakmp policy 10 encryption aes isakmp policy 10 hash sha isakmp policy 10 group 2 isakmp policy 10 lifetime 86400 vpngroup users address-pool POOL vpngroup users default-domain client.domain.com vpngroup users split-dns domain.com vpngroup users idle-time 600 vpngroup users password ******** vpngroup users split-tunnel Split-tunnel vpngroup idle-time idle-time 1800 telnet timeout 5 ssh timeout 30 management-access outside console timeout 0 | ||||||||||
| Similar Threads | Posted |
| remote access vpn question (second try - sorry about that, question included this time.) | April 2, 2007, 5:05 pm |
| remote access vpn question | April 2, 2007, 4:53 pm |
| PIX 515 Remote Access Config Question | March 6, 2006, 6:08 pm |
| Question on Remote Access VPN Access Control on IOS | January 24, 2007, 11:39 pm |
| PIX 501 <-> Concentrator remote client question | April 20, 2006, 4:49 pm |
| ASA 5510 Remote VPN user question | April 20, 2007, 4:21 pm |
| Newbie Question regarding VPN, NAT, remote VPN setup | June 15, 2007, 3:09 pm |
| Cisco 837 - Port fowarding question - Remote desktop | April 23, 2007, 3:12 pm |
| Remote access VPNs from remote location to ASA | June 30, 2006, 6:02 am |
| NAT Access Question | December 21, 2006, 9:11 pm |
| PIX 501 access to specific IP question | February 3, 2006, 8:56 am |
| Access-list question | March 13, 2006, 11:31 am |
| Access list question | June 26, 2006, 2:50 pm |
| Pix NAT Access-List question. | October 9, 2006, 1:56 pm |
| Access-List question | September 25, 2007, 2:59 am |