VPN Client 3.6x work and 4.x does not work

wcordov · ‎11-12-2004

With the following configuration:

PIX Version 6.3(3)

interface ethernet0 100full

interface ethernet1 100full

nameif ethernet0 outside security0

nameif ethernet1 inside security100

enable password xxxxx

passwd xxxx

hostname Pix-Sacyr

domain-name sacyr.cl

fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69

names

access-list 100 permit ip 192.168.206.0 255.255.255.0 10.10.10.0 255.255.255.0

access-list split-tunel permit ip 192.168.206.0 255.255.255.0 10.10.10.0 255.255

.255.0

pager lines 24

mtu outside 1500

mtu inside 1500

ip address outside 200.x.x.x.x.255.248

ip address inside 192.168.206.2 255.255.255.0

ip audit info action alarm

ip audit attack action alarm

ip local pool soporte 10.10.10.1-10.10.10.20

pdm location 10.10.10.2 255.255.255.255 inside

pdm location 192.168.206.1 255.255.255.255 inside

pdm location 10.10.10.2 255.255.255.255 outside

pdm location 10.10.10.0 255.255.255.0 outside

pdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list 100

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

static (inside,outside) 200.x.x.x.168.206.1

netmask 255.255.255.255 0 0

conduit permit icmp any any

conduit permit tcp host 200.68.22.108 eq smtp any

conduit permit tcp host 200.68.22.108 eq pop3 any

conduit permit tcp host 200.68.22.108 eq www any

route outside 0.0.0.0 0.0.0.0 200.68.22.105 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

aaa-server LOCAL protocol local

http server enable

http 10.10.x.x.x.255.255 outside

http 10.10.10.2 255.255.255.255 inside

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

sysopt connection permit-ipsec

crypto ipsec transform-set myset esp-3des esp-md5-hmac

crypto dynamic-map dynmap 10 set transform-set myset

crypto map mymap 10 ipsec-isakmp dynamic dynmap

crypto map mymap client configuration address initiate

crypto map mymap client configuration address respond

crypto map mymap interface outside

isakmp enable outside

isakmp identity address

isakmp nat-traversal 20

isakmp policy 20 authentication pre-share

isakmp policy 20 encryption 3des

isakmp policy 20 hash md5

isakmp policy 20 group 2

isakmp policy 20 lifetime 86400

vpngroup soporte address-pool soporte

vpngroup soporte split-tunnel split-tunel

vpngroup soporte idle-time 1800

vpngroup soporte password ********

telnet 10.10.x.x.x.255.0 outside

telnet 192.168.206.0 255.255.255.0 inside

telnet timeout 5

ssh timeout 5

console timeout 0

terminal width 80

I can telnet into the pix with vpn client 3.6x, but with the vpn client version 4.x just the ping is working, and I can not telnet to the PIX.

Both client are intalled in windows 2k, the differences that I can see is with version 4.x in the windows 2k assign

Ethernet adaptador Conexión de área local:

Sufijo DNS específico de la conexión. :

Dirección IP. . . . . . . . . . . . . : 10.10.10.3

Máscara de subred . . . . . . . . . . : 255.0.0.0

Puerta de enlace predeterminada . . . :

With version 3.6 didn´t appear ip assigned with the ipconfig command.

Does anyone have the same problem?

Thanks

jay_colby · ‎11-12-2004

The 4.0 creates a SA differnt then the 3.x clients. Use the management command and set it up for the inside interface and you will be able to telnet to the inside ip address ofthe pix.

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/cmdref/mr.htm#wp1137951

wcordov · ‎11-15-2004

Thanks

Two question, it regarding the PIX should be management remotely.

1) Can be management by outside interface, with "management-access command", I did a test and it didn´t work

2) Can be management using the two client version

jay_colby · ‎11-15-2004

again, you need to set it up to the inside interface. and, from your client you need to telnet to the inside interface.

Yes you can manage the pix using both clients. Once you do the "management-access inside". You will be able to telnet into the inside interface with both clients. Or, you can telnet to the ouside interface with the 3.x client and telnet to the inside interface with the 4.x client.

dherman · ‎12-06-2004

Also.... you can add the external interface to the access list allowing traffic from the VPN client network into the protected LAN and you will be able to access the external interface...