PIX & XP

I have a WinXP machine (192.168.0.20) which is connected to a PIX firewall (192.168.0.254) on its inside interface (currently eth1). The default gateway on the machine points to the PIX. When I connect another machine to eth0 (outside - IP 10.10.10.1) with IP 10.10.10.10 and connect via VPN to the PIX, they can ping themselves (for testing, I have added two access lists to permit any ip and icmp from any two machines on any interface) - I can do ping 10.10.10.10 from the internal machine and get echo-reply from outside and ping 192.168.0.20 from outside and get inside machine. VPN pool is

192.168.1.1-192.168.1.2 with netmask 255.255.255.252. I can access the Web server on XP machine from the outside machine.

Practically, everything works, except one thing - I cannot browse the Windows network, e.g. by using Explorer or simply by doing net view \\\\computer\\share. The latter gives me error 53 - The network path was not found. If I try using IP address, i.e. net view \\\\192.168.0.20\\share, it doesn't work, too.

I did not put WINS because XP is not a server OS, thus this is not possible. I have read that this is necessary in order to do the network browsing (since pings work, I presume browsing is the problem). I tried modifying lmhosts and adding the necessary host information to it, without luck. Can this be solved without using WINS/DNS (if these have anything to do with the problem, anyway)? I presume broadcast is limited in VPN connections, so this could also be the problem.

Help is appreciated, thank you!

Reply to
whytwelve13
Loading thread data ...

are you sure the pix isnt blocking the traffic? check your log on the pix.

Flamer.

Reply to
die.spam

Thanks for a reply!

What should I check for? I mean, if I enter:

access-list ain permit ip any any access-list ain permit icmp any any access-group ain in interface inside

access-list aout permit ip any any access-list aout permit icmp any any access-group aout in interface outside

that should mean no traffic could be blocked, right? There are no other ACLs and basically I opened everything until I make VPN work. Anyway, I can ping the machines, so it's probably only the broadcast addresses that are not working (but this is only my presumption). If this is the reason browsing doesn't work, what is the way to tell PIX to forward broadcasts accross VPN.

I will check the logs, but do you have anything particular in mind? What specificaly should I be looking for?

Thanks again.

Reply to
whytwelve13

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.