topic no, from the firewall i in Network Security

VPN client want to access different IP range

Mohd Khairul Nizam — Tue, 12 Mar 2019 04:18:50 GMT

Hi,

I need the VPN client IP pool to be able to access one of the server in the LAN.

The IP pool is 172.19.100.101~105 but the server is different range 172.59.1.10.

From the below config, is there any configuration that i need to add or delete to be able to access the server.

Actually, i already try to create static route, create new ip pool but still unable to access.

Hope, anybody can help.

====================================================================

I'm using PIX515

PIX Version 6.3(1)

access-list outside_access_in permit ip 172.19.100.96 255.255.255.240 interface inside
access-list outside_access_in permit tcp any host 172.19.100.20 eq https
access-list inside_outbound_nat0_acl permit ip any 172.19.100.96 255.255.255.240
access-list inside_outbound_nat0_acl permit ip any host 172.59.1.1
access-list inside_outbound_nat0_acl permit ip host 172.19.100.64 host 192.168.1.2
access-list outside_cryptomap_dyn_20 permit ip any 172.19.100.96 255.255.255.240
access-list outside_cryptomap_20 permit ip host 172.19.100.64 host 192.168.1.2

ip address outside 203.x.x.27 255.255.255.248
ip address inside 172.19.100.20 255.0.0.0
no ip address intf2

ip local pool klccippool 172.19.100.101-172.19.100.105

global (outside) 10 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 10 0.0.0.0 0.0.0.0 0 0
static (inside,outside) 172.19.100.20 172.19.100.20 netmask 255.255.255.255 0 0
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 203.x.x.25 1

vpngroup KLCCVPN address-pool klccippool
vpngroup KLCCVPN dns-server 203.x.x.25 203.x.x.24
vpngroup KLCCVPN idle-time 1800
vpngroup KLCCVPN password ********

: end

Could you please explain how

nkarthikeyan — Tue, 10 Jun 2014 09:28:02 GMT

Could you please explain how the server zone is connected to the VPN Firewall???

Regards

Karthik

Hi Karthik,Thanks for ur

Mohd Khairul Nizam — Tue, 10 Jun 2014 11:45:38 GMT

Hi Karthik,

Thanks for ur respone,

Attached is the pic.

VPN client can connect with 172.19.100.x Server, but not 172.59.1.10.

I just want existing IP pool to connect to 172.59.1.10

Not sure about PIX cli but

Rahul Kumar Mishra — Wed, 11 Jun 2014 15:13:03 GMT

Not sure about PIX cli but seems you have to add subnet mask (255.255.255.0) for ippool information in vpngroup configuration, because 172.19.100.x range is being treated as 172.19.0.0/16 and therefore your server 172.19.100.x is able to connect with vpn users.

Please make this change and let me know the result.

Hi Rahul,I change the ippool

Mohd Khairul Nizam — Thu, 12 Jun 2014 07:49:01 GMT

Hi Rahul,

I change the ippool to 172.0.0.1 - 172.0.0.5 but still can' access the 172.59.1.10 server

Hi Khairul,If you change IP

Rahul Kumar Mishra — Thu, 12 Jun 2014 08:16:01 GMT

Hi Khairul,

If you change IP pool with 172.0.0.1 to 172.0.0.5, since it's a class B subnet it will be assumed as 172.0.0.0/16. If you can't get subnet mask option when configuring vpn profile then use a class A IP pool range say 10.0.0.1 to 10.0.0.100..I am sure this will work.

But in this scenario all you

Rahul Kumar Mishra — Thu, 12 Jun 2014 08:19:08 GMT

But in this scenario all you servers must be in subnet of 10.0.0.0

Hi Rahul,Thanks for ur reply

Mohd Khairul Nizam — Thu, 12 Jun 2014 10:16:09 GMT

Hi Rahul,

Thanks for ur reply but that doesn't make sense to change the LAN server to different IP range

I'm pretty sure something to do with routing or policies but i just don't know where to change.

your comment is much appreciated

Hi Khazirul, Here you have

nkarthikeyan — Thu, 12 Jun 2014 10:23:36 GMT

Hi Khazirul,

Here you have both the server and LAN connected to the same switch with a different VLAN right???

Do you have the rule permitted for the VPN pool to the server in VPN/Crypto ACL??? Because whatever you have allowed and routed will reflect in VPN connection....

Also if you have the core switch which does the routing towards LAN then you may need to advertise the VPN pool route in to your LAN.

I am not pretty sure whether am correct or not in your scenario. I am expaling with what i understood from the design.

Hope this helps

Regards

Karthik

Also 172.59.x.x seems to be

nkarthikeyan — Thu, 12 Jun 2014 10:27:27 GMT

Also 172.59.x.x seems to be the public IP range.... It cannot be treated as an private zone range...

Regards

Karthik

HiYes, you are correct, each

Mohd Khairul Nizam — Thu, 12 Jun 2014 10:35:31 GMT

Yes, you are correct, each port is access port with different VLAN.

That what Im wondering, what rule should i included for the VPN pool to allowed and routed to 172.59.1.10/24.

By the way 172.59.1.10 is private IP in my local LAN.

The core switch doesn't do routing for the VPN pool

Until you have the subnet

nkarthikeyan — Thu, 12 Jun 2014 11:22:25 GMT

Until you have the subnet reachability of your VPN pool in LAN. You will not be able to reach the server.

r u able to reach the server from the VPN firewall???

Regards

Karthik

can you please tell what is

Rahul Kumar Mishra — Thu, 12 Jun 2014 13:53:04 GMT

Why have you configured /8 network on our firewall interface?

ip address inside 172.19.100.20 255.0.0.0.

also can you share inside static routes of Pix and static routes of core switch?

no, from the firewall i

Mohd Khairul Nizam — Thu, 12 Jun 2014 14:05:31 GMT

no,

from the firewall i couldn't ping to the server 172.59.1.10

the ip inside is there from

Mohd Khairul Nizam — Thu, 12 Jun 2014 14:51:55 GMT

the ip inside is there from the 1st setup. i also just figured it out. maybe i can change it.

by the way pls see below

pix=========================================

global (outside) 10 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 10 0.0.0.0 0.0.0.0 0 0
static (inside,outside) 203.x.x.28 Linux_File_Srv netmask 255.255.255.255 0 0
static (inside,outside) 203.x.x.29 Database_Srv netmask 255.255.255.255 0 0
static (inside,outside) 203.x.x.30 172.19.100.17 netmask 255.255.255.255 0 0
static (inside,outside) 203.x.x.26 172.19.100.64 netmask 255.255.255.255 0 0
static (inside,outside) 172.19.100.20 172.19.100.20 netmask 255.255.255.255 0 0
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 203.x.x.25 1
timeout xlate 3:00:00

core sw===================================

L2_SW_2970#show access-lists

Standard IP access list 1
10 permit 172.9.100.0, wildcard bits 0.0.0.255
20 permit 172.19.100.0, wildcard bits 0.0.0.255 (2 matches)

You have a core switch

Rahul Kumar Mishra — Thu, 12 Jun 2014 14:59:26 GMT

You have a core switch mentioned in diagram. can you please share static route details of that switch?

the 2970 is the core sw, and

Mohd Khairul Nizam — Thu, 12 Jun 2014 15:11:35 GMT

the 2970 is the core sw, and it doesn't have routing

Then you do not have the

nkarthikeyan — Thu, 12 Jun 2014 15:23:51 GMT

Then you do not have the proper configurations in place to reach the server. It needs to be corrected in infra as well as from fw end. For a testing can bring the server in to 172.16.x.x subnet range and check the access

Hope this helps

Regards

Karthik

Oops. First of all any switch

Rahul Kumar Mishra — Thu, 12 Jun 2014 15:27:09 GMT

Oops. First of all any switch which can not do routing is not a core switch at all.

What is happening here, you have connected your Pix firewall with 2970 switch and therefore you are only able to ping 172.19.100.x servers because your firewall too has same range of IP address (As well as same vlan) and not able to connect with 172.59.x.x range because it's in different vlan...Here what you can do is to check if you have interfaces available on router because here your router is doing interevlan routing. Just connect the PIx with Router's spare interface. Create a /32 subnet between pix and router, change inside IP of Pix with this new IP. Add static route on Pix as-

route inside 172.59.0.0 255.255.0.0 <router's IP>.

On router add specific static routes for VPN pool with Pix inside Interface as gateway.

This will solve all your problem.

topic no, from the firewall i in Network Security

VPN client want to access different IP range

Could you please explain how

Hi Karthik,Thanks for ur

Not sure about PIX cli but

Hi Rahul,I change the ippool

Hi Khairul,If you change IP

But in this scenario all you

Hi Rahul,Thanks for ur reply

Hi Khazirul, Here you have

Also 172.59.x.x seems to be

HiYes, you are correct, each

Until you have the subnet

can you please tell what is

no, from the firewall i

the ip inside is there from

You have a core switch

the 2970 is the core sw, and

Then you do not have the

Oops. First of all any switch

other solution is to create