Pix PPTP - access to LAN and DMZ

Hello,

I'm configuring a pix 515e with 3 interfaces. I've setup the PPTP configuration and i can connect to the LAN but not to the DMZ zone. This is the configuration that i have so far, can maybe someone help me out here. I don't know what i'm doing wrong.

ip address outside x.x.x.x x.x.x.x ip address inside 10.37.41.254 255.255.255.0 ip address dmz 172.16.41.254 255.255.255.0

access-list nonat permit ip 172.16.41.0 255.255.255.0 10.37.42.0

255.255.255.0 access-list nonat permit ip 10.37.41.0 255.255.255.0 10.37.42.0 255.255.255.0

global (outside) 1 interface nat (inside) 0 access-list nonat nat (inside) 1 10.37.41.0 255.255.255.0 0 0 nat (dmz) 0 access-list nonat nat (dmz) 1 172.16.41.0 255.255.255.0

access-list dmz permit ip host 172.16.41.11 10.37.42.0 255.255.255.0 access-list dmz permit ip 10.37.42.0 255.255.255.0 host 172.16.41.11

access-group dmz in interface dmz

ip local pool pptp-pool 10.37.42.1-10.37.42.254

sysopt connection permit-pptp

vpdn group 1 accept dialin pptp vpdn group 1 ppp authentication mschap vpdn group 1 ppp encryption mppe 128 vpdn group 1 client configuration address local pptp-pool vpdn group 1 client configuration dns 10.37.41.10 vpdn group 1 client authentication aaa mobis_radius vpdn group 1 pptp echo 60 vpdn enable outside

Thank u alreaudy!!!

Reply to
chackamakka
Loading thread data ...

How are you testing connectivity to the DMZ Zone? Ping? Telnetting to a particular Port, etc?

Have you tried reversing these statements? - I don't recall which direction the nonat acl should be defined when dealing with a local VPN DHCP Pool. Try reversing it. For instance: access-list nonat permit ip 10.37.42.0 255.255.255.0 172.16.41.0

255.255.255.0

The ACL entries should not matter since you have the 'sysopt connection permit-pptp' enabled. This will allow all vpn data to bypass all ACL's.

With this command applied, we can be fairly certain that the ACL is not the problem.

I will take a look at a few other things and get back to you with a few more suggestions to try.

Ryan

Reply to
rdymek

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.