telnet over ipsec vpn

george.titus · ‎09-22-2004

i have an ipsec vpn between 2 pix and i am able to access devices on both sides of the pix from each other.

but i am unable to telnet from my pc on the inside interface of one pix to the inside interface of the other pix.

my log on the pix where it is telnetted to says " inbound telnet built from outside to inside

and then second line says telnet session torn down, duration 0:00,bytes 0.

pls give me a solution

scottmac · ‎09-22-2004

Pix does not allow Telent from the outside, even through a VPN. If you have a telnet-able server on the inside, you can connect to that, then connect to the Pix insde interface

If you want to connect from the outside directly, you can use SSH v1. You must enable SSH (and possibly generate a key), and you may hae to specify a valid source address (for security).

Good Luck

Scott

galioto · ‎10-06-2004

I have a similar problem, but with SSH and HTTPS across the VPN. I can ping and get to devices and servers acfross the VPN between the two PIX devices. However, I can't get into either PIX internally across the VPN, using SSH or PDM. Any ideas? Both PIXs are configured to allow the opposite device to PDM and SSH in via the Inside interface.

george.titus · ‎10-07-2004

use access management command and use conduit to allow access and make that interesting vpn traffic and u should be good to go

galioto · ‎10-07-2004

Thanks, George. I'd be happy to try that, but I'm pretty much a PIX newbie.

Any step-by-step instructions are appreciated.

What's the access management command?

zroth · ‎10-05-2004

Hi George,

you can use the command management-access (interface)

on the target PIX,and than you are able to telnet to

that interface over VPN tunnel.Naturally you must

allow IP address of your PC through the command telnet (IP address).It works since the vers 6.3,if not earlier.

I hope it helps

Zdenek

farancci · ‎10-05-2004

There can be couple of reasons

Check your access-list for intresting traffic and also make sure there is no asymmetric routing.

use sh cry ipsec sa to make sure you have encrypts and decrypts.