Pix PPTP - access to LAN and DMZ

Dec 06, 2006 1 Replies

Hello,



I'm configuring a pix 515e with 3 interfaces. I've setup the PPTP configuration and i can connect to the LAN but not to the DMZ zone. This is the configuration that i have so far, can maybe someone help me out here. I don't know what i'm doing wrong.



ip address outside x.x.x.x x.x.x.x ip address inside 10.37.41.254 255.255.255.0 ip address dmz 172.16.41.254 255.255.255.0


access-list nonat permit ip 172.16.41.0 255.255.255.0 10.37.42.0



255.255.255.0 access-list nonat permit ip 10.37.41.0 255.255.255.0 10.37.42.0
255.255.255.0

global (outside) 1 interface nat (inside) 0 access-list nonat nat (inside) 1 10.37.41.0 255.255.255.0 0 0 nat (dmz) 0 access-list nonat nat (dmz) 1 172.16.41.0 255.255.255.0



access-list dmz permit ip host 172.16.41.11 10.37.42.0 255.255.255.0 access-list dmz permit ip 10.37.42.0 255.255.255.0 host 172.16.41.11



access-group dmz in interface dmz



ip local pool pptp-pool 10.37.42.1-10.37.42.254


sysopt connection permit-pptp



vpdn group 1 accept dialin pptp vpdn group 1 ppp authentication mschap vpdn group 1 ppp encryption mppe 128 vpdn group 1 client configuration address local pptp-pool vpdn group 1 client configuration dns 10.37.41.10 vpdn group 1 client authentication aaa mobis_radius vpdn group 1 pptp echo 60 vpdn enable outside



Thank u alreaudy!!!



How are you testing connectivity to the DMZ Zone? Ping? Telnetting to a particular Port, etc?

Have you tried reversing these statements? - I don't recall which direction the nonat acl should be defined when dealing with a local VPN DHCP Pool. Try reversing it. For instance: access-list nonat permit ip 10.37.42.0 255.255.255.0 172.16.41.0

255.255.255.0

The ACL entries should not matter since you have the 'sysopt connection permit-pptp' enabled. This will allow all vpn data to bypass all ACL's.

With this command applied, we can be fairly certain that the ACL is not the problem.

I will take a look at a few other things and get back to you with a few more suggestions to try.

Ryan

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required