Hi. I am a bit of a vpn newbie. I have set up a pix 506e to do remote access clients. When using the cisco vpn client I can connect fine to the pix and authenticate, and am given the appropriate ip from my ip pool. I can ping other hosts in the network that i am dropped into. However, i can do nothing but ping these hosts. i try to ssh to the linux hosts, running tcpdump on the hosts i see the ssh traffic to the host from the ip pool address. Tcpdump on the linux host show the host responding and traffic being sent back to the pix (pool ip). I even see the ssh traffic hitting the pix if i run debug packet. However, the packets get dropped somewhere after hitting the pix and no subsequent traffic is sent back to the linux host to complete the ssh connection.
in the example below, i authenticate as user john, and am given the ip
10.0.1.43 i can ping other hosts in the net 10.0.1.0/24 (behind the pix), but no ssh or anything other than ping.here is my config: Thanks very much for any insight.
interface ethernet0 auto interface ethernet1 auto nameif ethernet0 outside security0 nameif ethernet1 inside security100 hostname test-pix domain-name domain.com fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 names access-list NONATREMOTE permit ip 10.0.1.0 255.255.255.0 10.0.1.0
255.255.255.0 access-list splittunnelACL permit ip 10.0.1.0 255.255.255.0 10.0.1.0 255.255.255.0 pager lines 24 mtu outside 1500 mtu inside 1500 ip address outside 24.10.125.40 255.255.255.0 ip address inside 10.0.1.40 255.255.255.0 ip audit info action alarm ip audit attack action alarm ip local pool remotepool 10.0.1.43 pdm logging informational 100 pdm history enable arp timeout 14400 nat (inside) 0 access-list NONATREMOTE timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server RADIUS protocol radius aaa-server LOCAL protocol local floodguard enable sysopt connection permit-ipsec crypto ipsec transform-set mytrans esp-aes esp-sha-hmac crypto dynamic-map dynmap 10 set transform-set mytrans crypto map statmap 999 ipsec-isakmp dynamic dynmap crypto map statmap client configuration address respond crypto map statmap client authentication LOCAL crypto map statmap interface outside isakmp enable outside isakmp policy 10 authentication pre-share isakmp policy 10 encryption aes isakmp policy 10 hash sha isakmp policy 10 group 2 isakmp policy 10 lifetime 86400 vpngroup smallgroup address-pool remotepool vpngroup smallgroup dns-server X.X.X.X vpngroup smallgroup default-domain domain.com vpngroup smallgroup split-tunnel splittunnelACL vpngroup smallgroup split-dns domain.com vpngroup smallgroup idle-time 600 vpngroup smallgroup password ******** vpngroup idle-time idle-time 1800 telnet timeout 5 ssh timeout 30 management-access outside console timeout 0 username john password XXXXXXXXXXXXXXXX encrypted privilege 2 terminal width 80