Cisco VPN Client 4.04 Rel to a PIX 506E connects, but no traffic

Cisco VPN Client 4.04 Rel to a PIX 506E connects, but no traffic

Post by GlenMorga » Tue, 15 Feb 2005 22:31:35



I configured a PIX 506E w/ v6.3 PixOS. I can connect just fine however,
I cannot see anything at all on the inside network. Here's my relavant
config:


access-list nonatinside permit ip 192.168.20.0 255.255.255.0
192.168.21.0 255.255.255.0
!
ip local pool clientpool 192.168.21.10-192.168.21.25
!
sysopt connection permit-ipsec
crypto ipsec transform-set a-transform esp-3des esp-md5-hmac
crypto dynamic-map mydynmap 10 set transform-set a-transform
crypto map mymap 10 ipsec-isakmp dynamic mydynmap
!
isakmp policy 10 lifetime 86400
vpngroup testlogin address-pool clientpool
vpngroup testlogin dns-server 192.168.20.3 192.168.20.4
vpngroup testlogin default-domain mydomain.com
vpngroup testlogin split-tunnel nonatinside
vpngroup testlogin idle-time 32400
vpngroup testlogin password ********
!
 
 
 

Cisco VPN Client 4.04 Rel to a PIX 506E connects, but no traffic

Post by roberso » Thu, 17 Feb 2005 05:55:32

In article < XXXX@XXXXX.COM >,

:I configured a PIX 506E w/ v6.3 PixOS. I can connect just fine however,
:I cannot see anything at all on the inside network. Here's my relavant
:config:
:access-list nonatinside permit ip 192.168.20.0 255.255.255.0 192.168.21.0 255.255.255.0
:ip local pool clientpool 192.168.21.10-192.168.21.25

Just to cross-check: you have a specific or default route on the
PIX that would send packets for 192.168.21 towards the outside interface?
The PIX needs the packets to be routed towards the interface the VPN
is active on, and then it sort of redirects the packets at the last moment.
--
How does Usenet function without a fixed point?

 
 
 

Cisco VPN Client 4.04 Rel to a PIX 506E connects, but no traffic

Post by GlenMorga » Fri, 18 Feb 2005 02:52:03


Hmm, how would that look?

route inside 192.168.21.0 255.255.255.0 192.168.20.1 1?

192.168.20.1 being the PIX inside

Glenn
 
 
 

Cisco VPN Client 4.04 Rel to a PIX 506E connects, but no traffic

Post by roberso » Fri, 18 Feb 2005 06:13:54

In article < XXXX@XXXXX.COM >,



|> Just to cross-check: you have a specific or default route on the
|> PIX that would send packets for 192.168.21 towards the outside interface?
|> The PIX needs the packets to be routed towards the interface the VPN
|> is active on, and then it sort of redirects the packets at the last moment.

|Hmm, how would that look?
|route inside 192.168.21.0 255.255.255.0 192.168.20.1 1?
|192.168.20.1 being the PIX inside

If you are using specific routes,

route outside 192.168.21.0 255.255.255.0 PIXOUTSIDEIP 1

That's a little unusual, though, in that a lot of the time you will have
a default route,

route outside 0.0.0.0 0.0.0.0 PIXOUTSIDEIP 1

because you normally want all traffic destined for outside IPs to
head out the PIX outside interface. 192.168.21/24 falls within
0.0.0.0 0.0.0.0 so automatically 192.168.21/24 would be sent towards
the outside interface, which is all that is needed in this instance:
the PIX will grab the 192.168.21/24 destined packets and stuff them
into the IPSec tunnel like you want. So most of the time you
don't even need to think about it -- you just use an IP pool that
isn't part of your inside subnet and the rest happens without you
thinking about it.

Other ways of getting a default route include:

ip address outside dhcp setroute

and

rip outside passive version 1 (or version 2)

--
Strange but true: there are entire WWW pages devoted to listing
programs designed to obfuscate HTML.
 
 
 

Cisco VPN Client 4.04 Rel to a PIX 506E connects, but no traffic

Post by GlenMorga » Sat, 19 Feb 2005 01:06:34


Ok, It's wierd because I've had this working before a couple years ago
and didn't (to my knowledge) had to do this. I was thinking it was
something "funky" in the new VPN client software or PIX OS.

Since there's no router inside, I just point the PIX's default route to
the router connected to the outside interface.

You stated I could of just used some IP's on the internal interface
network for the vpnclient IP Pool? I thought I did this and it still fails.

Glenn