Remote access VPN not working on PIX version 8.0(4), Hardware: PIX-515E,

[Neeraj Patial]

Hi Friends,

I am new  to PIX firewall and need one help i have configured remote access VPN on PIX firewall but when i am trying to access from VPN client its not working and reflecting error remote peer is no longer responding. Attaching Config for understanding any help would be appreciated as i am going MAD with this.

Note:- Here i am using self certificate.

PIX Hardware:-

# show version

Cisco PIX Security Appliance Software Version 8.0(4)
Device Manager Version 6.1(5)51

Compiled on Thu 07-Aug-08 19:42 by builders
System image file is "flash:/pix804.bin"
Config file at boot was "startup-config"

nc-edu-gw0 up 6 days 18 hours

Hardware: PIX-515E, 256 MB RAM, CPU Pentium II 433 MHz
Flash E28F128J3 @ 0xfff00000, 16MB
BIOS Flash AM29F400B @ 0xfffd8000, 32KB

i have two interfaces Local And WAN

[Marius Gunnerud]

You haven't referenced the trustpoint under the Odessa remote-access tunnel-group. 

tunnel-group Odessa type remote-access

tunnel-group Odessa general-attributes

  address-pool Odessa-NW

  default-group-policy Odessa

Try adding the trustpoint to the Odessa tunnel-group and then test.

--

Please remember to select a correct answer and rate helpful posts

[Neeraj Patial]

Hi Marius,

Trust-Point already added in Odessa Group, any other suggestion as its still not working.

tunnel-group Odessa type remote-access
tunnel-group Odessa general-attributes
 address-pool Odessa-NW
 default-group-policy Odessa
tunnel-group Odessa ipsec-attributes
 trust-point ASDM_TrustPoint0

[Neeraj Patial]

my pix is 515 with version 8.0(4) and having NAT-CONTROL enable.

does below nat give issue to connect VPN ?

global (wan) 1 interface

as VPN users are coming from wan interface.  Thanks.

[Marius Gunnerud]

Do you have the root certificate (in the CA certificate) and an identity certificate installed on the ASA?

Also, an identity certificate issued by the root CA to installed on the PC?

--

Please remember to select a correct answer and rate helpful posts

[Neeraj Patial]

Hi Marius,

I am using self signed certificate in  identity certificate.

Is it necessary that should be installed in PC.

[Marius Gunnerud]

I created a walkthrough on getting this to work using the ASA as a CA (see attached PDF).  My ASA version is 9.4(2) so there might be some differences since you are running 8.0(4).  Hope it helps.

--

Please remember to select a correct answer and rate helpful posts

[Neeraj Patial]

Hi Marius,

Issue has been resolved initially i was doing wrong config in VPN client 

i was creating certificate in Pix firewall and at VPN client end i was using authentication user name And password so it was wrong.

Now I have created Pre-shared key & at VPN client end in authentication i have used group name & PSK as password and its working.

Thanks for your time.