1. Home
  2. Cisco Systems
  3. Pix 501 - VPN problem

Pix 501 - VPN problem

My goal is to allow vpn dialup pptp connections into my internal network. I have put together the configuration below. But, I am not able to even connect. Would anyone know what is wrong with the configuration below.

Thanks in advance,

PIX Version 6.3(5) interface ethernet0 10baset interface ethernet1 100full nameif ethernet0 outside security0 nameif ethernet1 inside security100 enable password 8Ry2YjIyt7RRXU24 encrypted passwd 2KFQnbNIdI.2KYOU encrypted hostname pix501 domain-name cisco.com fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 names access-list inside_access_in permit tcp any any access-list inside_access_in permit udp any any pager lines 24 mtu outside 1500 mtu inside 1500 ip address outside dhcp setroute ip address inside 172.16.0.1 255.255.255.0 ip audit info action alarm ip audit attack action alarm ip local pool pptp-pool 172.16.0.10-172.16.0.50 pdm location 172.16.0.0 255.255.255.0 inside pdm logging informational 100 pdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 1 172.16.0.0 255.255.255.0 0 0 access-group inside_access_in in interface inside timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225

1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout sip-disconnect 0:02:00 sip-invite 0:03:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server TACACS+ max-failed-attempts 3 aaa-server TACACS+ deadtime 10 aaa-server RADIUS protocol radius aaa-server RADIUS max-failed-attempts 3 aaa-server RADIUS deadtime 10 aaa-server LOCAL protocol local http server enable http 172.16.0.0 255.255.255.0 inside no snmp-server location no snmp-server contact snmp-server community public no snmp-server enable traps floodguard enable sysopt connection permit-pptp telnet 172.16.0.0 255.255.255.0 inside telnet timeout 5 ssh 172.16.0.0 255.255.255.0 inside ssh timeout 5 console timeout 0 vpdn group 1 accept dialin pptp vpdn group 1 ppp authentication pap vpdn group 1 ppp authentication chap vpdn group 1 ppp authentication mschap vpdn group 1 ppp encryption mppe auto vpdn group 1 client configuration address local pptp-pool vpdn group 1 client configuration dns 192.168.1.100 vpdn group 1 client configuration wins 192.168.1.100 vpdn group 1 pptp echo 60 vpdn group 1 client authentication local vpdn username rg1 password ********* vpdn enable outside vpdn enable inside dhcpd address 172.16.0.2-172.16.0.129 inside dhcpd lease 3600 dhcpd ping_timeout 750 dhcpd auto_config outside terminal width 80
Reply to
Roman
Loading thread data ...

You need to create access-list rules to allow PPTP and GRE to the firewall.

access-list outside_in permit ip any host x.x.x.x eq 47 access-list outside_in permit tcp any host x.x.x.x eq 1723

access-group outside_in in interface outside

Where x.x.x.x is the outside interface IP address.

Reply to
Chad Mahoney

Thanks for your help.

I have applied this change. Instead of using the "host x.x.x.x", I used "any". When type telnet

formatting link
1723, no connection..

Reply to
Roman

No. You never need to have access-group entries for any activity that talks to a PIX firewall -itself-. access-group entries only control traffic passing -through- the firewall. Traffic -to- the firewall is controlled via commands such as "icmp".

Furthermore, as this is a PIX 501 in question, it only supports PIX versions in which the way to refer to the outside interface in an access-group is not by the IP itself but rather by the keyword 'interface' (PIX 6.0 only) or 'interface outside' (all later PIX 6.x), so those commands would be wrong even if they were applicable. If you wanted to pass PPTP -through- the 501, you would use

access-list outside_in permit tcp any interface outside eq 1723

The syntax given for GRE is also incorrect. GRE cannot be passed through a PIX 501 interface IP because PIX 6.x does not support forwarding by IP protocol number. If you had an alternate IP for the

501 and you needed to forward GRE through the 501, you would use

access-list outside_in permit gre any host x.x.x.y

where x.x.x.y is a public IP other than the interface IP.

But neither of those is necessary for PPTP -to- the PIX 501. (I haven't looked through Roman's configuration to see what the problem might be.)

Reply to
Walter Roberson

Would you mind looking at my configuration to see what the problem is?

Thanks in advance

Reply to
Roman

Have a look at :

formatting link
from
formatting link
The only thing that stands out (to me) from your config is the lack of a no-NAT ACL & corresponding nat0 entry - which would be made easier if your address pool was either a different subnet to the inside subnet, or at least falls on an easily expressible subnet boundary.

Apart from that, I'm afraid I can't see any issue with the vpdn part of the config - but I have never used PPTP to a PIX, only IPSec.

Reply to
Al

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.