Re: PPTP VPN & Network Issue

mcsfirewall · ‎12-10-2004

Hey everyone,

I have setup a VPN using PPTP on a Cisco PIX 515e. We have two internal networks, 192.168.1.0 and 192.168.2.0.

VPN clients connect to the 192.168.1.0 network and are assigned an IP address.When they connect, they can ping any address in the 192.168.1.0 network without difficulty. Mapping to servers is no problem, either. However, I can't reach any address in the 192.168.2.0 network. No ping, no mapping.

The 192.168.2.0 network is connected via a direct T1 line to our office. They have internet, email, and can see the network down here without difficult, and they go through the firewall to get here. It's just that VPN clients can't get to them.

I am thinking I need to add the following line to point them up there:

route inside 192.168.1.0 255.255.255.0 192.168.2.0 1

I have added this line as well:

access-list Access permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0

Access is the list of IP's the VPN clients are given.

My question is, will that first line allow the VPN clients to find the 192.168.2.0 network? If anyone needs me to post more information please let me know.

Thanks in advance

pkapoor · ‎12-10-2004

Post your PIX configuration please.

pkapoor · ‎12-10-2004

Post your PIX configuration please. This is a routing issue.

mcsfirewall · ‎12-10-2004

PIX Version 6.3(3)

fixup protocol dns maximum-length 512

fixup protocol pptp 1723

access-list inside_access_in permit ip any any

access-list inside_access_in permit tcp 192.168.0.0 255.255.0.0 any object-group MCS-default

access-list inside_access_in permit icmp any any

access-list inside_access_in permit tcp 192.168.1.0 255.255.255.0 any eq domain

access-list inside_access_in permit tcp 192.168.2.0 255.255.255.0 any eq domain

access-list inside_access_in permit gre any any

access-list inside_outbound_nat0_acl permit ip any 192.168.1.192 255.255.255.192

access-list Access permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0

ip address outside 208.46.42.114 255.255.255.248

ip address inside 192.168.1.23 255.255.255.0

ip address dmz 65.122.67.241 255.255.255.248

ip local pool Access 192.168.1.213-192.168.1.253

pdm location 192.168.1.1 255.255.255.255 inside

pdm location 192.168.0.0 255.255.0.0 inside

pdm location 192.168.1.3 255.255.255.255 inside

pdm location 192.168.1.5 255.255.255.255 inside

pdm location 192.168.0.0 255.255.255.255 inside

pdm location 192.168.2.0 255.255.255.0 inside

pdm location 171.68.225.212 255.255.255.255 outside

pdm location 171.69.89.38 255.255.255.255 outside

pdm location 192.168.1.8 255.255.255.255 inside

pdm location 192.168.2.0 255.255.255.255 inside

global (outside) 1 interface

nat (inside) 0 access-list inside_outbound_nat0_acl

nat (inside) 0 192.168.1.8 255.255.255.255 0 0

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

static (inside,outside) tcp 65.122.67.246 5000 192.168.1.3 ssh netmask 255.255.255.255 0 0

static (inside,dmz) 192.168.0.0 192.168.0.0 netmask 255.255.0.0 0 0

static (dmz,outside) 65.122.67.243 65.122.67.243 netmask 255.255.255.255 0 0

access-group outside_access_in in interface outside

access-group inside_access_in in interface inside

access-group test2 in interface dmz

route outside 0.0.0.0 0.0.0.0 208.46.42.113 1

route inside 192.168.1.1 255.255.255.255 192.168.1.23 1

route inside 192.168.2.0 255.255.255.0 192.168.1.23 1

http server enable

http 200.9.49.0 255.255.255.0 outside

http 66.207.136.130 255.255.255.255 outside

http 0.0.0.0 0.0.0.0 outside

http 192.168.1.0 255.255.255.0 inside

sysopt connection permit-ipsec

sysopt connection permit-pptp

vpdn group PPTP-VPDN-GROUP accept dialin pptp

vpdn group PPTP-VPDN-GROUP ppp authentication mschap

vpdn group PPTP-VPDN-GROUP ppp encryption mppe 40

vpdn group PPTP-VPDN-GROUP client configuration address local Access

vpdn group PPTP-VPDN-GROUP client configuration dns 192.168.1.5

vpdn group PPTP-VPDN-GROUP client configuration wins 192.168.1.12

vpdn group PPTP-VPDN-GROUP pptp echo 60

vpdn group PPTP-VPDN-GROUP client authentication local

vpdn enable outside

pkapoor · ‎12-10-2004

Couple of things I noticed in your configuration (not directly related to your issue).

1.You do not need:

route inside 192.168.1.1 255.255.255.255 192.168.1.23 1

2.This ACL is useless:

access-list inside_access_in permit ip any any

access-list inside_access_in permit tcp 192.168.0.0 255.255.0.0 any object-group MCS-default

access-list inside_access_in permit icmp any any

access-list inside_access_in permit tcp 192.168.1.0 255.255.255.0 any eq domain

access-list inside_access_in permit tcp 192.168.2.0 255.255.255.0 any eq domain

access-list inside_access_in permit gre any any

Because it permits all IP first.

Now for your issue do this:

1. Take out:

route inside 192.168.2.0 255.255.255.0 192.168.1.23 1

2. Add:

route inside 192.168.2.0 255.255.255.0

Where is the IP address of the router on which your T1 to the remote subnet comes in. It will be a 192.168.1.x type IP.

The ping an IP on the 192.168.2.0 network (and ping by IP, not hostname) from the PPTP client and see if you get a response. Make sure that the PC running the PPTP client does not have any kind of personal firewall enabled (including Win XP firewall).

Let me know how it goes.

mcsfirewall · ‎12-10-2004

Thanks for the help!

A couple questions to clarify, if you don't mind . .

1. The 192.168.1.23 is the address of the inside interface. That address (192.168.1.23) is the default gateway for the inside network. The router sits outside of this and has an entirely different ip address (starts with 208.x.x.x). Do I put the address of the router in?

2. When I add the line, is there a 0 or 1 at the end of the line?

3. What is the command to remove a line of code? I can't seem to remember.

Thanks again for your help!

pkapoor · ‎12-10-2004

OK. Now you've added a bit more of clarity to the network topology with your comments. This is what I understand of your topology now.

You have a remote subnet (192.168.2.0) that comes in over a T1 to a router that sits actually on the outside of your PIX (outside interface). Earlier I was under the impression that the 192.168.2.0 subnet was inside relative to the PIX.

If my understanding now is correct, then your PPTP clients cannot connect to the 192.168.2.0 subnet over this VPN tunnel. This is because the PIX will not redirect traffic that arrived on an interface, out the same interface i.e. the PPTP traffic from the clients is arriving at the PIX's outside interface. To send this traffic to the 192.168.2.0 subnet, the PIX needs to send it out the outside interface. This is something that the PIX does not do. The reason the PIX does not do this is because it has been designed not to do it due to security.

If you have doubts or questions, feel free to ask.

BTW, you could do this with a router or a concentrator.

mcsfirewall · ‎12-10-2004

Yep, you got it pretty much right.

But here's a bit of a twist for you. On the client-side, if I check the box to use the Default Gateway of the local network, I can both ping and map to the 192.168.2.0 network. I lose internet connectivity, though.

So I can either get to the 192.168.2.0 network OR I can get to the internet.

Would it perhaps be easier to devise a way to get to the internet than to the 192.168.2.0 network?

Thanks again for your help!

mcsfirewall · ‎12-10-2004

I'm sorry . . . I told you wrong. Upon actual inspection of the firewall and route setup in the computer lab . . . the router which sends traffic up to the 192.168.2.0 network is actually INSIDE the firewall.

Sorry about that.

pkapoor · ‎12-10-2004

Well, then my first instructions stand.

mcsfirewall · ‎12-10-2004

Ok, then my previous questions are re-ask 🙂

1. The 192.168.1.23 is the address of the inside interface. That address (192.168.1.23) is the default gateway for the inside network. What do I change this too, since I already have 192.168.1.23 in that line you wanted me to remove

2. When I add the line, is there a 0 or 1 at the end of the line?

3. What is the command to remove a line of code? I can't seem to remember.

Thanks

pkapoor · ‎12-13-2004

1. Your internal LAN hosts will still use the PIX's inside IP as their default gateway. By removing "route inside 192.168.1.1 255.255.255.255 192.168.1.23 1", you are not going to affect them. This route is not required because the destination IP is in the same subnet as the inisde interface. (So, do not worry - just take that route out).

2. Use 1. If you do not put in a value there, the PIX automatically inserts "1".

3. To remove a command, use "no" in front of that command.

mcsfirewall · ‎12-13-2004

Thanks for your help! 🙂

Just one more clarification, because I think I understand what I need to do.

The two routers that connect the 192.168.1.0 and 192.168.2.0 network are 192.168.3.1 (here) and 192.168.3.2 (other office).

So I need to add the line where the router address is 192.168.3.1? or 192.168.3.2?

Thanks again!

pkapoor · ‎12-13-2004

The router that you have here will have 192.168.3.1 IP configured on the interface that connects to the other router. It will also have a 192.168.1.x IP configured on the interface that connects to your LAN. I think that this IP is actually 192.168.1.1 (from the information you have provided me). It is the 192.168.1.x IP that you need to configure on the route and NOT the 192.168.3.x IP.

mcsfirewall · ‎12-14-2004

I entered in the new configuration, and it will still not work.

If you check USE DEFAULT GATEWAY OF LOCAL NETWORK at the client side, you can ping 192.168.2.0 network but lose internet access. If you uncheck that box you can get to the internet but can't reach the 192.168.2.0 network.

Any ideas?