topic Re: Help with Cisco PIX 515E in Network Security

Help with Cisco PIX 515E

tbrinkma — Mon, 11 Mar 2019 11:46:40 GMT

Hi,

I want my Remote Access VPN to work to our new PIX firewall Cisco PIX 515E. With AAA to a radius server.

I want the Cisco VPN client to come with a popup which in I can fill in my details coming from the radius server.

I configured the AAA server by hand a run the VPN wizard in ASDM.

After I done this I can't log in with the client.

I think it has something to do with the vpngroup commando but the wizard didn't create anything for this.

Can somebody help me checking the config and see if anything need to be modified?

pixfirewall# sh run

: Saved

PIX Version 7.2(2)

hostname pixfirewall

domain-name default.domain.invalid

enable password xxxxxxxxxxxx encrypted

names

interface Ethernet0

nameif outside

security-level 0

ip address [External IP]

interface Ethernet1

nameif inside

security-level 100

ip address 10.1.1.7 255.255.0.0

interface Ethernet2

shutdown

no nameif

no security-level

no ip address

interface Ethernet3

shutdown

no nameif

no security-level

no ip address

interface Ethernet4

shutdown

no nameif

no security-level

no ip address

interface Ethernet5

shutdown

no nameif

no security-level

no ip address

passwd xxx

ftp mode passive

dns server-group DefaultDNS

domain-name default.domain.invalid

access-list inside_nat0_outbound extended permit ip any 10.248.2.0 255.255.255.0

pager lines 24

logging enable

logging asdm informational

mtu outside 1500

mtu inside 1500

ip local pool ClientPool 10.248.2.0-10.248.2.255 mask 255.255.0.0

no failover

icmp unreachable rate-limit 1 burst-size 1

asdm image flash:/asdm-522.bin

no asdm history enable

arp timeout 14400

nat (inside) 0 access-list inside_nat0_outbound

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout uauth 0:05:00 absolute

aaa-server vpn protocol radius

aaa-server vpn host [Radius server]

key [Radius secret]

group-policy [Name] internal

group-policy [Name] attributes

dns-server value 10.1.3.100 10.1.3.101

vpn-tunnel-protocol IPSec

default-domain value intranet.[Name].nl

http server enable

http 10.1.0.0 255.255.0.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto dynamic-map outside_dyn_map 20 set pfs

crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA

crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map

crypto map outside_map interface outside

crypto isakmp enable outside

crypto isakmp policy 10

authentication crack

encryption 3des

hash sha

group 2

lifetime 86400

tunnel-group [Name] type ipsec-ra

tunnel-group [Name] general-attributes

address-pool ClientPool

authentication-server-group vpn

default-group-policy [Name]

telnet 10.0.0.0 255.0.0.0 inside

telnet timeout 5

ssh timeout 5

console timeout 0

dhcpd address 10.1.1.8-10.1.2.7 inside

dhcpd enable inside

class-map inspection_default

match default-inspection-traffic

policy-map type inspect dns preset_dns_map

parameters

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

service-policy global_policy global

prompt hostname context

Cryptochecksum:xxx

: end

Re: Help with Cisco PIX 515E

pjhenriqs — Fri, 11 Jan 2008 14:07:16 GMT

Hi,

Do you get a prompt to put in your login details or you don't even get that?

If you do get a prompt and you put in your login details, do you see anything on the log of the RADIUS server?

What are you using? PAP, CHAP, MS-CHAP?

Paulo

Re: Help with Cisco PIX 515E

tbrinkma — Fri, 11 Jan 2008 14:10:26 GMT

No I do not get a prompt to put in my login details. Suppose to use CHAP

Re: Help with Cisco PIX 515E

pjhenriqs — Fri, 11 Jan 2008 14:41:13 GMT

And what do the logs say?

They are usually your best and quickest help.

Re: Help with Cisco PIX 515E

tbrinkma — Fri, 11 Jan 2008 14:53:13 GMT

client:

Cisco Systems VPN Client Version 4.6.02.0011

Client Type(s): Windows, WinNT

Running on: 5.1.2600 Service Pack 2

69 15:52:27.853 01/11/08 Sev=Warning/2 IKE/0xE3000099

Invalid SPI size (PayloadNotify:116)

70 15:52:27.853 01/11/08 Sev=Warning/3 IKE/0xA3000058

Received malformed message or negotiation no longer active (message id: 0x00000000)

Pix

4 Jan 11 2008 14:51:59 713903 Group = DefaultRAGroup, IP = 213.126.129.250, Error: Unable to remove PeerTblEntry

3 Jan 11 2008 14:51:59 713902 Group = DefaultRAGroup, IP = 213.126.129.250, Removing peer from peer table failed, no match!

Re: Help with Cisco PIX 515E

pjhenriqs — Fri, 11 Jan 2008 16:10:47 GMT

Hey where is your pre-shared key?

tunnel-group remote ipsec-attributes

pre-shared-key *

And what is this?

crypto isakmp policy 10

authentication crack (crack?)

Hope it helps,

Paulo

Re: Help with Cisco PIX 515E

pjhenriqs — Fri, 11 Jan 2008 16:12:57 GMT

Also I think you are missing NAT-T

crypto isakmp nat-traversal 20

Re: Help with Cisco PIX 515E

Alan Huseyin Kayahan — Fri, 11 Jan 2008 16:37:34 GMT

Hi Tristan

Your VPN IP pol and exempt nat rule do not match on netmask

access-list inside_nat0_outbound extended permit ip any 10.248.2.0 255.255.255.0

ip local pool ClientPool 10.248.2.0-10.248.2.255 mask 255.255.0.0

Make the following change

no access-list inside_nat0_outbound extended permit ip any 10.248.2.0 255.255.255.0

access-list inside_nat0_outbound extended permit ip any 10.248.2.0 255.255.0.0

tunnel-group [Name] general-attributes

split-tunnel-policy tunnelall

Regards

Re: Help with Cisco PIX 515E

tbrinkma — Thu, 17 Jan 2008 11:36:38 GMT

I use the crack because I dont think I can use preshared key as I cannot configure that in the cisco VPN client.

The split-tunnel-policy tunnelall commando doesnt work.

Did configure the nat-t commando.

Still same errors

Re: Help with Cisco PIX 515E

pjhenriqs — Thu, 17 Jan 2008 14:22:20 GMT

You configure a pre-shared key on the profile you create on the Cisco VPN Client. Are you not able to do this?

And this would be enough reason for it not to work, if you have not configured the pre-shared key on your PIX/ASA.

Re: Help with Cisco PIX 515E

tbrinkma — Thu, 17 Jan 2008 15:46:04 GMT

Still nothing.

My current config: (removed not needed lines)

access-list inside_nat0_outbound extended permit ip any 10.248.2.0 255.255.255.0

ip local pool Clientpool 10.248.2.0-10.248.2.255 mask 255.255.255.0

no failover

monitor-interface outside

monitor-interface inside

icmp unreachable rate-limit 1 burst-size 1

asdm image flash:/asdm-522.bin

no asdm history enable

arp timeout 14400

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout uauth 0:05:00 absolute

aaa-server vpn protocol radius

aaa-server vpn host [Radius server]

key [Radius secret]

group-policy [Name] internal

group-policy [Name] attributes

dns-server value 10.1.3.100 10.1.3.101

vpn-tunnel-protocol IPSec

default-domain value intranet.[Name].nl

http server enable

http 10.1.0.0 255.255.0.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto dynamic-map outside_dyn_map 20 set pfs

crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA

crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map

crypto map outside_map interface outside

crypto isakmp enable outside

crypto isakmp policy 10

authentication crack

encryption 3des

hash sha

group 2

lifetime 86400

crypto isakmp nat-traversal 20

tunnel-group [Name] type ipsec-ra

tunnel-group [Name] general-attributes

address-pool Clientpool

authentication-server-group vpn

default-group-policy [Name]

tunnel-group [Name] ipsec-attributes

pre-shared-key *

telnet 10.0.0.0 255.0.0.0 inside

telnet timeout 5

ssh timeout 5

console timeout 0

class-map inspection_default

match default-inspection-traffic

policy-map type inspect dns preset_dns_map

parameters

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

service-policy global_policy global

prompt hostname context

Cryptochecksum:xxx

: end

asdm image flash:/asdm-522.bin

no asdm history enable

Logs

3 Jan 17 2008 15:44:45 713902 Group = DefaultRAGroup, IP = x.x.x.x, Removing peer from peer table failed, no match!

4 Jan 17 2008 15:44:45 713903 Group = DefaultRAGroup, IP = x.x.x.x, Error: Unable to remove PeerTblEntry

110 16:45:37.619 01/17/08 Sev=Warning/2 IKE/0xE3000099

Fragmented msg rcvd with no associated SA (PacketReceiver:133)

Re: Help with Cisco PIX 515E

pjhenriqs — Thu, 17 Jan 2008 15:55:38 GMT

You need to add the "interesting traffic". Create your crypto map access-list and assign it to the dynamic crypto map.

Like so...

access-list outside_cryptomap_dyn_20 permit ip any 192.168.2.0 255.255.255.0

crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20

Also add:

sysopt connection permit-ipsec

So that the IPSEC traffic bypasses the access-lists.

Hope it helps,

Paulo

Re: Help with Cisco PIX 515E

tbrinkma — Fri, 18 Jan 2008 12:09:55 GMT

Is the interesting traffic not only for when I use a site-to-site VPN connection. When I use the Cisco client I wouldnt need to use it?

Re: Help with Cisco PIX 515E

pjhenriqs — Fri, 18 Jan 2008 12:16:12 GMT

The interesting traffic is the traffic that will get encrypted in the VPN. Whether that VPN is a site-to-site, remote, DMVPN or whatever, the same principle is applied.

When you use the Cisco client you are using a remote access VPN. How does the firewall know what traffic to encrypt to send the user, if the interesting traffic is not defined?

Re: Help with Cisco PIX 515E

tbrinkma — Fri, 18 Jan 2008 12:29:15 GMT

192.168.2.0 255.255.255.0 is the range of my VPN Clients?

Re: Help with Cisco PIX 515E

pjhenriqs — Fri, 18 Jan 2008 14:24:30 GMT

Yes.

According to your configuration:

ip local pool Clientpool 10.248.2.0-10.248.2.255 mask 255.255.255.0

HTH,

Paulo

Re: Help with Cisco PIX 515E

tbrinkma — Fri, 18 Jan 2008 14:26:20 GMT

Did put the following lines in it:

access-list outside_cryptomap_dyn_20 permit ip any 10.248.2.0 255.255.255.0

crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20

Still nothing...