Why does my 506 keeps deny vpn-connections.

That line would allow the VPN clients to send icmp.

That line won't work. When the ip address named in an ACL is the IP address of an interface, instead of using 'host' followed by the IP, you need to use 'interface' followed by the interface name.

access-list adgang permit tcp any interface outside eq smtp

That line says that the interface ACL should be ignored for all IPSec packets, so that adgang ACL should not even be touched -- not unless the packets aren't going throug the VPN for some reason.

That won't work either. When an interface address appears in a static statement, you need to use the keyword 'interface' instead of the address:

static (inside,outside) interface 192.168.3.5 netmask 255.255.255.255 0 0

But then there is the additional problem that you cannot static the entire outside interface IP to an inside IP: you can static a public IP *other* than the interface IP:

static (inside,outside) 62.60.14.71 192.168.3.5 netmask 255.255.255.255 0 0

or you can static by port:

static (inside,outside) tcp interface smtp 192.168.3.5 smtp netmask

Your ip pool must not be in the same subnet as your inside addresses, or else the PIX will not be able to route the packets back to the VPN properly. Fixing this will require changes to several other statements.

Those two ACLs have the same content, so the policy 40 entry is redundant.

And notice you overlapped the dhcp pool with the vpn address pool. That's not going to matter once you fix the vpn address pool.

But also notice that you overlapped your dhcp pool with the IP of your server 192.168.3.5 . That's going to require fixing the dhcpd pool.

Hi Walter

I am getting there. Thanks for your quick help.

There only one remaining problem. Port 25 is not open for inbound mail, and I can=B4t figurer out why.

Could you give me some advise. The new config is as follows:

: PIX Version 6.3(5) interface ethernet0 auto interface ethernet1 auto nameif ethernet0 outside security0 nameif ethernet1 inside security100 enable password 8Ry2YjIyt7RRXU24 encrypted passwd 2KFQnbNIdI.2KYOU encrypted hostname pixfirewall domain-name ciscopix.com fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 names access-list inside_outbound_nat0_acl permit ip any 192.168.30.0

You still have the overlap in the dhcp pool -- notice that it includes 192.168.3.5 [your server] in the IP range. That could result in two hosts ending up with the same IP address.

Once you fix that, I suggest you turn on logging and see what message is produced when you try the connection.

logging on logging timestamp logging buffered debugging

Once that is configured, "show log" to see the last 10 or so messages.

Once you have resolved the issue, you will probably want to change "logging buffered" from "debugging" to "notifications" so that only more important messages are recorded into the in-memory log. It would be a good idea, though, to

logging trap debugging logging host inside 192.168.3.SOMETHING

and set up a syslog server on 192.168.3.SOMETHING . If you don't have a handy Unix host, then the Windows "Kiwi" syslog server is okay in the free version and supposedly fairly good in the paid version.

Hi again

Walter, the syslog server gives the following line:

And the PDM complains about not being able to understand the following line:

access-list adgang permit tcp any interface outside eq smtp

So, it seems that the problem is the access-list.

A inside telnet on port 25 gives a normal reply from the mail-server.

???

connection denied from 62.60.14.78/61510 to 62.60.14.70/25 flags SYN on interface outside

Ah, somewhere along the way a line got dropped:

access-group adgang in interface outside

yeps, that=B4s it.

Thank you so much for your help, walter