08-09-2007 06:19 AM - edited 03-11-2019 03:55 AM
Okay so I've looked over the config many times and I can't figure out what the problem is. I have 2 servers running behind the PIX (s1 - out 78.xxx.xxx.15 in 10.xxx.xxx.83 s2 - out 78.xxx.xxx.14 in 10.xxx.xxx.85). From server 1 I can VPN/RDP in, but I can not access the internet. From server 2 it is just the opposite, I can access the internet but I can not VPN in. Here is the config...
PIX Version 6.3(4)
interface ethernet0 100full
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
object-group network pptp_servers
network-object host 78.xxx.xxx.15
network-object host 78.xxx.xxx.14
access-list inbound permit icmp any any
access-list inbound permit tcp any host 78.xxx.xxx.14 eq www
access-list inbound permit tcp any host 78.xxx.xxx.15 eq www
access-list inbound permit tcp any host 78.xxx.xxx.15 eq domain
access-list inbound permit udp any host 78.xxx.xxx.15 eq domain
access-list inbound permit tcp any host 78.xxx.xxx.15 eq pptp
access-list inbound permit tcp any host 78.xxx.xxx.14 eq pptp
access-list inbound deny ip any any log
access-list outbound permit icmp any any
access-list outbound permit ip 10.0.0.0 255.0.0.0 any
access-list outbound deny ip any any log
access-list acl_inbound permit tcp any object-group pptp_servers eq pptp
access-list acl_inbound permit gre any object-group pptp_servers
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 78.xxx.xxx.16 255.255.255.248
ip address inside 10.xxx.xxx.81 255.0.0.0
ip audit info action alarm
ip audit attack action alarm
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 10.0.0.0 255.0.0.0 0 0
static (inside,outside) 78.xxx.xxx.15 10.xxx.xxx.83 netmask 255.255.255.255 0 0
static (inside,outside) 78.xxx.xxx.14 10.xxx.xxx.85 netmask 255.255.255.255 0 0
access-group acl_inbound in interface outside
access-group outbound in interface inside
route outside 0.0.0.0 0.0.0.0 78.xxx.xxx.18 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet timeout 5
ssh timeout 5
console timeout 0
terminal width 80
: end
I need to fix this ASAP, so any help will be appriciated!
08-09-2007 07:42 AM
Just an update, I have fixed the VPN/RDP connection but server 1 still has no in internet access... Also I'm sure this isnt a hard fix but while I'm in RDP through the VPN I have no internet access on my local and remote machines. Any ideas?
Thanks!
08-09-2007 07:45 AM
Verify your dns settings on server 1. It's not a routing problem as you can hit it from the vpn.
For your vpn client to have internet access while connected you must set up split tunneling.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide