Re: PIX: Ping VPN host from inside network

On Mar 22, 12:46 pm, "Jeff" <jeffrey_coll...@xxxxxxxxxxx> wrote:
I'm trying to enable the inside network to talk to VPN clients and
vice-versa on PIX 7.2 code. I'm using PAT and have verified that
outbound translation is working. I can ping from my inside
192.168.6.0/24 subnet to external hosts. I also have setup remote VPN
and have verified that the clients can authenticate and establish a
VPN session. However, I can't get the inside network (192.168.6.0/24)
to ping hosts in the vpn subnet pool (192.168.24.0/24) or vice-versa.
When I initiate a ping from 192.168.24.1 to 192.168.6.100, I get a
Destination Net Unreachable response from some router along the
path.

I then did an ICMP capture to see what was going on. This capture
shows a successful ping to 4.2.2.2 and then a shows an echo request
but no response from 192.168.24.1 (vpn client):
7: 19:31:58.288376 192.168.6.100 > 4.2.2.2: icmp: echo request
8: 19:31:58.316054 4.2.2.2 > 192.168.6.100: icmp: echo reply
11: 19:32:05.340283 192.168.6.100 > 192.168.24.1: icmp: echo request
12: 19:32:10.410653 192.168.6.100 > 192.168.24.1: icmp: echo request
13: 19:32:15.910261 192.168.6.100 > 192.168.24.1: icmp: echo request

The same capture applied to the outside interface shows pings heading
out but not coming back:
1: 19:32:59.907225 192.168.6.100 > 192.168.24.1: icmp: echo request
2: 19:33:05.406915 192.168.6.100 > 192.168.24.1: icmp: echo request

Logs shows:
%PIX-6-302020: Built ICMP connection for faddr 192.168.24.1/0 gaddr
192.168.6.10
0/512 laddr 192.168.6.100/512
%PIX-6-302021: Teardown ICMP connection for faddr 192.168.24.1/0 gaddr
192.168.6
.100/512 laddr 192.168.6.100/512

Here's a sample of my config:

PIX Version 7.2(1) (note I will be upgrading later from 7.2(1))
!
interface Ethernet0
nameif outside
security-level 0
ip address 10.10.10.1 255.255.255.240 (IP made up of course)
!
interface Ethernet1
nameif inside
security-level 100
ip address 192.168.6.1 255.255.255.0
!
access-list TEST_splitTunnelAcl standard permit any
access-list inside_nat0_outbound extended permit ip any 192.168.24.0
255.255.255.0
access-list outside_cryptomap extended permit ip any 192.168.24.0
255.255.255.0
access-list inside_nat_outbound extended permit ip any any
access-list outside_access_in extended permit icmp any any echo-reply
access-list test extended permit icmp any any
ip local pool MFPOOL 192.168.24.1-192.168.24.254 mask 255.255.255.0
icmp permit any inside
icmp permit any echo-reply outside
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 access-list inside_nat_outbound
access-group outside_access_in in interface outside
group-policy TEST internal
group-policy TEST attributes
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value TEST_splitTunnelAcl
default-domain value TEST.com
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map 20 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption aes-192
hash sha
group 5
lifetime 86400
crypto isakmp policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
tunnel-group TEST type ipsec-ra
tunnel-group TEST general-attributes
address-pool MFPOOL
default-group-policy TEST
tunnel-group TEST ipsec-attributes
pre-shared-key *

Jsut realized something. In the capture I ran against the outside
interface it shows the private IP. Shouldn't this be the external
interface of the PIX? It appears that maybe it isn't actually getting
translated, leaves the pix wiht 192.168.6.100, and then the
destination doesn't know where to respond to (hence the dest net
unreachable message).

1: 19:32:59.907225 192.168.6.100 > 192.168.24.1: icmp: echo request
2: 19:33:05.406915 192.168.6.100 > 192.168.24.1: icmp: echo request

.

Relevant Pages

  • Re: E-Mail Woes to Mailsweeper on PIX DMZ
    ... description Interface to Outside ... access-list outside extended permit tcp any host X.X.X.30 eq smtp ... access-group dmz_access in interface DMZ ...
    (comp.dcom.sys.cisco)
  • Re: Help! DMZ on Pix515
    ... I can't reach anything on the DMZ from the outside. ... interface Ethernet0 ... access-list inside_access_out extended permit tcp 0.0.0.0 255.255.255.0 ... access-group outside_access_in in interface outside ...
    (comp.dcom.sys.cisco)
  • Re: Help! DMZ on Pix515
    ... I was of course missing static routes to the DMZ. ... interface Ethernet0 ... access-list inside_access_out extended permit tcp 0.0.0.0 255.255.255.0 ... access-group outside_access_in in interface outside ...
    (comp.dcom.sys.cisco)
  • ICMP pinging.
    ... My problem is my LAN can not ping outside world. ... "access-group inbound in interface outside"(cannot ping outside, ... fixup protocol dns maximum-length 512 ...
    (comp.dcom.sys.cisco)
  • Re: [fw-wiz] ASA routing over VPN
    ... interface Ethernet0/0 ... access-list inside_nat0_inbound extended permit ip ... access-group outside_in in interface internet ... crypto map frame_map 40 set peer 10.0.166.2 ...
    (Firewall-Wizards)
Loading