Help with 501 !

homeboarder8 — Mon, 11 Mar 2019 10:55:46 GMT

Okay so I've looked over the config many times and I can't figure out what the problem is. I have 2 servers running behind the PIX (s1 - out 78.xxx.xxx.15 in 10.xxx.xxx.83 s2 - out 78.xxx.xxx.14 in 10.xxx.xxx.85). From server 1 I can VPN/RDP in, but I can not access the internet. From server 2 it is just the opposite, I can access the internet but I can not VPN in. Here is the config...

PIX Version 6.3(4)

interface ethernet0 100full

interface ethernet1 100full

nameif ethernet0 outside security0

nameif ethernet1 inside security100

fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69

names

object-group network pptp_servers

network-object host 78.xxx.xxx.15

network-object host 78.xxx.xxx.14

access-list inbound permit icmp any any

access-list inbound permit tcp any host 78.xxx.xxx.14 eq www

access-list inbound permit tcp any host 78.xxx.xxx.15 eq www

access-list inbound permit tcp any host 78.xxx.xxx.15 eq domain

access-list inbound permit udp any host 78.xxx.xxx.15 eq domain

access-list inbound permit tcp any host 78.xxx.xxx.15 eq pptp

access-list inbound permit tcp any host 78.xxx.xxx.14 eq pptp

access-list inbound deny ip any any log

access-list outbound permit icmp any any

access-list outbound permit ip 10.0.0.0 255.0.0.0 any

access-list outbound deny ip any any log

access-list acl_inbound permit tcp any object-group pptp_servers eq pptp

access-list acl_inbound permit gre any object-group pptp_servers

pager lines 24

mtu outside 1500

mtu inside 1500

ip address outside 78.xxx.xxx.16 255.255.255.248

ip address inside 10.xxx.xxx.81 255.0.0.0

ip audit info action alarm

ip audit attack action alarm

pdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 1 10.0.0.0 255.0.0.0 0 0

static (inside,outside) 78.xxx.xxx.15 10.xxx.xxx.83 netmask 255.255.255.255 0 0

static (inside,outside) 78.xxx.xxx.14 10.xxx.xxx.85 netmask 255.255.255.255 0 0

access-group acl_inbound in interface outside

access-group outbound in interface inside

route outside 0.0.0.0 0.0.0.0 78.xxx.xxx.18 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server TACACS+ max-failed-attempts 3

aaa-server TACACS+ deadtime 10

aaa-server RADIUS protocol radius

aaa-server RADIUS max-failed-attempts 3

aaa-server RADIUS deadtime 10

aaa-server LOCAL protocol local

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

telnet timeout 5

ssh timeout 5

console timeout 0

terminal width 80

: end

I need to fix this ASAP, so any help will be appriciated!

Re: Help with 501 !

homeboarder8 — Thu, 09 Aug 2007 14:42:16 GMT

Just an update, I have fixed the VPN/RDP connection but server 1 still has no in internet access... Also I'm sure this isnt a hard fix but while I'm in RDP through the VPN I have no internet access on my local and remote machines. Any ideas?

Thanks!

Re: Help with 501 !

acomiskey — Thu, 09 Aug 2007 14:45:42 GMT

Verify your dns settings on server 1. It's not a routing problem as you can hit it from the vpn.

For your vpn client to have internet access while connected you must set up split tunneling.

topic Help with 501 ! in Network Security

Help with 501 !

Re: Help with 501 !

Re: Help with 501 !