VPN access with VPN client problem. Please help

[touvue]

I have a PIX 520 as device terminating VPN tunnels. I able to establish a IPsec connection. I verified that I was given an address in the IP pool that I configure but I cannot get to any resource on the internal network. I could only ping myself. When I run "ipconfig /all" I see my address on the vpn interface with correct DNS, but my gateway is set to my own address. I think that is the problem. Please help me fix this issue. Let me know if you need more info.

[Patrick Iseli]

Its is normal that you see your own address as gateway.

I think you have a Transparent NAT issue try to add that command on the PIX and try again to connect with your VPN client.

isakmp nat-traversal 20

After that reset the SA of IKE and IPSEC, but take care this will reset all IPSEC communication. If you have tunnels op en then they will loose their connections.

Do this in the non business hours !

conf t

clear ipsec sa

clear isakmp sa

Details fot NAT-T:

isakmp nat-traversal

Network Address Translation (NAT), including Port Address Translation (PAT), is used in many networks where IPSec is also used, but there are a number of incompatibilities that prevent IPSec packets from successfully traversing NAT devices. NAT traversal enables ESP packets to pass through one or more NAT devices.

The firewall supports NAT traversal as described by Version 2 and Version 3 of the IETF "UDP Encapsulation of IPsec Packets" draft, available at http://www.ietf.org/html.charters/ipsec-charter.html, and NAT traversal is supported for both dynamic and static crypto maps. NAT traversal is disabled by default on the firewall.

To enable NAT traversal, check that ISAKMP is enabled (you can enable it with the isakmp enable if_name command) and then use the isakmp nat-traversal [natkeepalive] command. (This command appears in the configuration if both ISAKMP is enabled and NAT traversal is enabled.) If you have enabled NAT traversal, you can disable it with the no isakmp nat-traversal command. Valid values for natkeepalive are from 10 to 3600 seconds. The default is 20 seconds.

If needed, the show isakmp sa detail command assists in debugging NAT traversal.

isakmp peer fqdn no-xauth | no-config-mode

The isakmp peer fqdn fqdn no-xauth | no-config-mode command is to be used only if the following criteria are met:

•You are using the RSA signatures authentication method within your IKE policy.

•The security gateway and VPN client peers terminate on the same interface.

•The Xauth or IKE Mode Configuration feature is enabled for VPN client peers.

http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_command_reference_chapter09186a00801727a9.html#wp1027312

sincerely

Patrick

[touvue]

Patrick,

Thanks for the tip. The "isakmp nat-traversal 20" command does not exist on the PIX. I did run the two clear commands: ipsec sa and isakmp sa. Can I please send you my config for some assistant and pointer.

Thanks,

Tou

[Patrick Iseli]

What version of PIX OS are you using ?

Example config:

access-list NONAT permit ip Internalnet ISubnet VPN-Pool 255.255.255.0

access-list DYN-VPN-ACL permit ip Internalnet ISubnet VPN-Pool 255.255.255.0

aaa-server LOCAL protocol local

aaa authentication secure-http-client

sysopt connection permit-ipsec

crypto ipsec transform-set TRANS esp-3des esp-md5-hmac

crypto dynamic-map outside_dyn_map 20 match address DYN-VPN-ACL

crypto dynamic-map outside_dyn_map 20 set transform-set TRANS

crypto map REMOTE 65535 ipsec-isakmp dynamic outside_dyn_map

crypto map REMOTE client authentication LOCAL

crypto map REMOTE interface outside

isakmp enable outside

isakmp identity address

isakmp nat-traversal 20

isakmp policy 10 authentication pre-share

isakmp policy 10 encryption 3des

isakmp policy 10 hash md5

isakmp policy 10 group 2

isakmp policy 10 lifetime 86400

ip local pool VPNPool x.y.z.1-x.y.z.254

vpngroup VPNGroup address-pool VPNPool

vpngroup VPNGroup dns-server dns2 dns1

vpngroup VPNGroup default-domain localdomain

vpngroup VPNGroup idle-time 1800

vpngroup VPNGroup password grouppassword

username vpnclient password vpnclient-password

Yes you can send me your config if you want on:

mailto:piseli@victrix.ca

sincerely

Patrick

[mhoda]

Hello,

If your tunnel is up but unable to access resource even with the IP address, then most likely you are missing the following command -

sysopt connection permit-ipsec

Please, add this and this should take care of your problem. If NAT-T were needed, your tunnel wouldn't even come up.

Thanks,

Mynul

[touvue]

I do have that command in the config but it is still not working. Is it okay if I send my current config? My email is tvue@lsd.k12.mi.us if I can send it to you so that I can reply back with the config.

Tou

[touvue]

We are running ver. 6.2(2).

[Patrick Iseli]

I got your mail! But I was to busy today to check your config in details. On the first view everything looks ok.

Could you please test your VPN Client with a dialup connection. Why? If everything works fine with a static public IP from the Internet then you have troubles with Transparent NAT.

I promise that I will check tomorrow the config.

sincerely

Patrick

[Patrick Iseli]

Have you checked if the VPN Client is working with a fixed Public IP ?

Your Email server refuses to get my emails my message got back. So please provide your feedback in this forum.

sincerely

Patrick

[touvue]

For my testing, I am connecting from a public address. I have two attachment of my debug isakmp sa and ipsec sa. Please check it out to see if there is anything that is stopping my vpn connection from working.

[Patrick Iseli · Accepted solution]

Here are some suggestions what you could try to get that working:

1.) Change your "conduits" to access-list. Conduits are no longer supported by Cisco even if they are still working. This will help you to debugg your access-list as there will be hitcounts.

There is a cisco tool to concert conduits to access-lists:

http://www.cisco.com/cgi-bin/tablebuild.pl/pix?sort=release

Download the: occ-121.zip

PIX Firewall Outbound Conduit Converter Binary version 1.2.1, for Windows

2.) Change your VPN Pool.

ip local pool techvpn 10.x.x.100-10.x.x.120

Problem with that is that you allready have a 10.x.x.x subnet in your internal network. The ip pool assigns automaticaly a 255.0.0.0 Subnet mask to the VPN Clients. This can cause routing problems. You could use a 172.16.100.x Subnet that is nowhere used.

example:

no vpngroup lsdvpn address-pool techvpn

no ip local pool techvpn

ip local pool techvpn 172.16.100.1-172.16.100.254

vpngroup lsdvpn address-pool techvpn

no access-list inside_outbound_nat0_acl

no access-list outside_cryptomap_dyn_20

access-list inside_outbound_nat0_acl permit ip any 172.16.100.0 255.255.255.0

access-list outside_cryptomap_dyn_20 permit ip any 172.16.100.0 255.255.255.0

clear ipsec sa

clear isakmp sa

sincerely

Patrick

[Patrick Iseli]

See this post for another axplanation about given subnet masks and gateways for the VPN client.

http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.1dd6841a

Have you tryed to to a traceroute (tracert) when the VPN client is connected.

sincerely

Patrick

[touvue]

Hey Patrick.

I tried with your new configuration for the different VPN pool addresses and it works great. I am able to connect to PIX and establish a IPsec VPN tunnel. From there I can ping any device on our network. I can connect to our servers via Remote Desktop. However I am unable to get to shared drives on my Win 2k servers. Does that mean I have to log off then log back on to the domain to get to the resoucess. If I log off would I lose my VPN session?

You have been soooo helpful. I think I am almost there just a little more tweaking. Just want to "Thank You" for all your help so far.

[Patrick Iseli]

I glad that this worked.

;-)

Windows net shares are a little bit tricky. Don't forget that all browsing will not work and without a DNS for Active Directory or WINS foe Windows 2000 Domains, name resolution will not work.

A net use command with the right syntax should work !

example:

net use s: \\server2k\share /user:domainname\username

net use s: \\IP-Adress\share /user:domainname\username

syntax:

NET USE

[devicename | *] [\\computername\sharename[\volume] [password | *]]

[/USER:[domainname\]username]

[/USER:[dotted domain name\]username]

[/USER:[username@dotted domain name]

[/SMARTCARD]

[/SAVECRED]

[[/DELETE] | [/PERSISTENT:{YES | NO}]]

NET USE {devicename | *} [password | *] /HOME

NET USE [/PERSISTENT:{YES | NO}]

See also:

Configuring PIX to Allow Remote Access to Shared Folders on an NT Domain

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00801ab781.shtml

Please mark that as solved issues so others will easyer find a solution to a similar problem.

sincerely

Patrick

[Patrick Iseli]

Access to DMZ for the VPN Client !

access-list inside_outbound_nat0_acl permit ip any 10.189.250.96 255.255.255.224

access-list outside_cryptomap_dyn_20 permit ip any 10.189.250.96 255.255.255.224

is wide open the only way that this would be blocked id somewhere in your CONDUITS. Check that you permit access to 10.189.250.96 255.255.255.224.

sincerely

Patrick