[fw-wiz] Cisco VPN Client Behind a Cisco PIX or Router

From: Al Cooper (alc_at_tlynx.com)
Date: 09/01/04

  • Next message: Devdas Bhagat: "Re: [fw-wiz] Re: ISP firewalling of residential customers - was - About Port Forwarding, Apache and Firewall Rules" 
    To: firewall-wizards@honor.icsalabs.com
Date: Wed, 01 Sep 2004 10:42:22 -0600

    I have configured a Cisco VPN Client (4.6.00) to connect to a Cisco PIX
    515E [6.3(3)]. The VPN works great except when the VPN client is behind
    another PIX or a Cisco router. If the VPN client behind a PIX or a Cisco
    router I can make the initial connect fine but I cannot pass any traffic
    (pings time out and protocols do not connect).

    If I am behind my Linux (IPCop) firewall or at a hotel (unknown firewall,
    probably a cable modem) I do not have a problem. I can connect and pass
    traffic.

    The terminating PIX has 4 PIX to PIX VPN's configured and they all work
    great.

    I have searched Cisco's site and spent more that an hour Googling to no luck.

    Any suggestions on why the VPN client will not work from behind another
    Cisco device?

    Here is the relevant config for the PIX 515E that terminates the client VPN:

    access-list nonat permit ip 192.168.99.0 255.255.255.0 192.168.100.0
    255.255.255.0
    ip address inside 192.168.100.1 255.255.255.0
    ip local pool clientvpn-admin 192.168.99.1-192.168.99.254
    global (outside) 1 interface
    nat (inside) 0 access-list nonat
    nat (inside) 1 0.0.0.0 0.0.0.0 0 0
    access-group 101 in interface outside
    route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx 1
    sysopt connection permit-ipsec
    crypto ipsec transform-set clvpn esp-aes-256 esp-sha-hmac
    crypto dynamic-map vpn-client 10 set transform-set clvpn
    crypto map gate 50 ipsec-isakmp dynamic vpn-client
    crypto map gate interface outside
    isakmp enable outside
    isakmp identity address
    isakmp policy 10 authentication pre-share
    isakmp policy 10 encryption 3des
    isakmp policy 10 hash md5
    isakmp policy 10 group 2
    isakmp policy 10 lifetime 28800
    vpngroup admin address-pool clientvpn-admin
    vpngroup admin dns-server xxx.xxx.xxx.xxx
    vpngroup admin default-domain domain.com
    vpngroup admin split-tunnel vpn-client-admin
    vpngroup admin idle-time 2700
    vpngroup admin password ********

    Thanks for any help you can offer,

    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

  • Next message: Devdas Bhagat: "Re: [fw-wiz] Re: ISP firewalling of residential customers - was - About Port Forwarding, Apache and Firewall Rules"

    Relevant Pages

    • RE: [fw-wiz] Pix 501 & 506 PixOS 7.0 compatability
      ... The info I got from a Cisco Security SE is that the 501 and 506 will support ... >>I am trying to configure a cisco pix as a vpn endpoint for the cisco ... >independent of anything the PIX or VPN client do. ...
      (Firewall-Wizards)
    • Local Lan Access not working
      ... Our head Office is using a Cisco Pix 515e Firewall behind a Cisco 827 ... One of our Directors connects into the company LAN from his home LAN ... using his company laptop and the VPN client. ...
      (comp.dcom.sys.cisco)
    • Re: no internet when connected to pix with vpn client
      ... Take a look at this Configuring Cisco Secure PIX and VPN Client Doc: ...
      (comp.dcom.sys.cisco)
    • Re: Cisco PIX501 and incoming VPN from laptop via client software? Possible?
      ... Get PIX 501 with 3DES License for Firewall, ... get CISCO SECURE VPN CLIENT 3.5 ... > If I buy a Cisco PIX 501 to protect my home network, ... > kind of VPN client software on the laptop? ...
      (comp.security.firewalls)
    • Re: VPN Client compatible crypto
      ... :The samples I used to setup VPN Client connecting to a PIX have me use ... :isakmp on the PIX ... isakmp policy 7 authentication pre-share ... isakmp policy 7 hash sha ...
      (comp.dcom.sys.cisco)