Re: VPN Client connects but no LAN connection

john.graves · ‎11-09-2005

I have implimented a VPN client & it successfully connects to the PIX. With ipconfig I see the pool address on the VPN adapter but I am unable to connect to anything on the inside LAN.

Partial config below:

crypto dynamic-map CVPN 8 set transform-set cisco

crypto map local 1 ipsec-isakmp

crypto map local 1 match address vpn

crypto map local 1 set peer 64.222.230.223

crypto map local 1 set transform-set cisco

crypto map local 2 ipsec-isakmp

crypto map local 2 match address vpn1

crypto map local 2 set peer 141.158.133.125

crypto map local 2 set transform-set cisco

crypto map local 3 ipsec-isakmp

crypto map local 3 match address vpn2

crypto map local 3 set peer 64.222.187.90

crypto map local 3 set transform-set cisco

crypto map local 4 ipsec-isakmp

crypto map local 4 match address outside_cryptomap_4

crypto map local 4 set peer 68.239.82.45

crypto map local 4 set transform-set cisco

crypto map local 5 ipsec-isakmp

crypto map local 5 match address vpn3

crypto map local 5 set peer 64.222.189.48

crypto map local 5 set transform-set cisco

crypto map local 6 ipsec-isakmp

crypto map local 6 match address vpn4

crypto map local 6 set peer 71.243.112.145

crypto map local 6 set transform-set cisco

crypto map local 7 ipsec-isakmp

crypto map local 7 match address vpn6

crypto map local 7 set peer 69.183.66.14

crypto map local 7 set transform-set cisco

crypto map local 8 ipsec-isakmp dynamic CVPN

crypto map local interface outside

isakmp enable outside

isakmp key ******** address 141.158.133.125 netmask 255.255.255.255 no-xauth no-config-mode

isakmp key ******** address 64.222.187.90 netmask 255.255.255.255 no-xauth no-config-mode

isakmp key ******** address 64.222.230.223 netmask 255.255.255.255 no-xauth no-config-mode

isakmp key ******** address 68.239.82.45 netmask 255.255.255.255 no-xauth no-config-mode

isakmp key ******** address 64.222.189.48 netmask 255.255.255.255 no-xauth no-config-mode

isakmp key ******** address 71.243.112.145 netmask 255.255.255.255 no-xauth no-config-mode

isakmp key ******** address 69.183.66.14 netmask 255.255.255.255 no-xauth no-config-mode

isakmp identity address

isakmp policy 10 authentication pre-share

isakmp policy 10 encryption des

isakmp policy 10 hash md5

isakmp policy 10 group 2

isakmp policy 10 lifetime 86400

vpngroup Lynn address-pool LynnVPN

vpngroup Lynn idle-time 1800

vpngroup Lynn password ********

telnet 192.15.100.0 255.255.255.0 inside

telnet timeout 5

ssh 171.68.225.213 255.255.255.255 outside

ssh 63.209.230.50 255.255.255.255 outside

ssh 151.203.51.233 255.255.255.255 outside

ssh 0.0.0.0 0.0.0.0 outside

ssh 200.9.49.66 255.255.255.255 inside

ssh timeout 60

console timeout 0

terminal width 80

Cryptochecksum:xxxx

: end

m.sir · ‎11-10-2005

On VPN client select modify you connection entry , select tab TRANSPORT and check Allow Local LAN access.

It could be also sometime problem when your local LAN and VPN LAN has overlaping IP addressing

HTH

jackko · ‎11-10-2005

try applying the command "isakmp nat-traversal 20" on the pix

john.graves · ‎11-10-2005

We were connecting directly attached to an ISP, so I was not being Natted.

I supplied addresses in my vpnpool from the LAN on the inside interface of the PIX. Am I shooting myself in the foot? Am I better off using addresses from a separate subnet, and adding that subnet to my primary access list allowing traffic onto the inside interface?

JG

cpaadministrator · ‎11-10-2005

What´s your access-list like ?

I had the same problem, that I could connect me to the pix but I was not able to ping inside the remote lan.

this was a fault of a wrong access-list

john.graves · ‎11-10-2005

I do not have an access-list entry for the mobile client. Here is my access-list. The #4 entry is correct, and it is on my list to clean up the naming soon.

access-list vpn permit ip 192.15.100.0 255.255.255.0 192.15.111.0 255.255.255.0

access-list nonat permit ip 192.15.100.0 255.255.255.0 192.15.111.0 255.255.255.0

access-list nonat permit ip 192.15.100.0 255.255.255.0 192.15.104.0 255.255.255.0

access-list nonat permit ip 192.15.100.0 255.255.255.0 192.15.107.0 255.255.255.0

access-list nonat permit ip 192.15.100.0 255.255.255.0 192.15.105.0 255.255.255.0

access-list nonat permit ip 192.15.100.0 255.255.255.0 192.15.101.0 255.255.255.0

access-list nonat permit ip 192.15.100.0 255.255.255.0 192.15.108.0 255.255.255.0

access-list nonat permit ip 192.15.100.0 255.255.255.0 192.15.103.0 255.255.255.0

access-list vpn1 permit ip 192.15.100.0 255.255.255.0 192.15.104.0 255.255.255.0

access-list vpn2 permit ip 192.15.100.0 255.255.255.0 192.15.107.0 255.255.255.0

access-list outside_cryptomap_4 permit ip 192.15.100.0 255.255.255.0 192.15.105.0 255.255.255.0

access-list vpn3 permit ip 192.15.100.0 255.255.255.0 192.15.101.0 255.255.255.0

access-list vpn4 permit ip 192.15.100.0 255.255.255.0 192.15.108.0 255.255.255.0

access-list vpn6 permit ip 192.15.100.0 255.255.255.0 192.15.103.0 255.255.255.0

JG

jackko · ‎11-10-2005

just a quick comment.

you mentioned you don't have an acl for remote vpn access. in fact, even without configuring split tunneling, no nat acl is still required.

john.graves · ‎11-11-2005

The subnet behind the inside address is 192.168.1.0 /24. I am using a range from this subnet in my vpnpool statement for the mobile vpn clients.

This seems to raise 2 questions. Should I be using a completely different subnet in my vpnpool range (ie 192.168.254.x) Then I should I add this subnet to both my nonat and vpn acl's?

JG

jackko · ‎11-12-2005

it's an interesting question, and according to cisco and my own opinion, the answer is yes. the vpn client pool should be different to the pix inside net ip scheme.

however, occasionally i do see ppl setup the remote vpn client pool overlapping the pix inside net, and it works.

now, i believe you should modify the vpn client pool simply to eliminate the possibility of overlapping issue.

harriedekort · ‎11-15-2005

I have the same problem for over 2 months. I have a pix 506E. Client connecetion no problem. But the inside hosts are not visible. I use the cisco pdm to configure the pix. I think I need another access-group command to map the access-list.

Please help.

access-list inside_outbound_nat0_acl permit ip any 192.168.10.0 255.255.255.224

access-list inside_outbound_nat0_acl permit ip any 192.168.100.0 255.255.255.224

access-list inside_outbound_nat0_acl permit ip any 192.168.200.0 255.255.255.0

access-list outside_cryptomap_dyn_20 permit ip any 192.168.10.0 255.255.255.224

access-list outside_cryptomap_dyn_40 permit ip any 192.168.100.0 255.255.255.224

access-list outside_access_in permit tcp any interface outside eq smtp

access-list outside_access_in permit tcp any interface outside object-group rdp

access-list test2_splitTunnelAcl permit ip any any

access-list outside_cryptomap_dyn_60 permit ip any 192.168.200.0 255.255.255.224

pager lines 24

mtu outside 1500

mtu inside 1500

ip address outside 10.0.0.150 255.255.255.0

ip address inside 192.168.1.254 255.255.255.0

ip audit info action alarm

ip audit attack action alarm

ip local pool vpndhcp 192.168.10.10-192.168.10.20

ip local pool testpool 192.168.100.10-192.168.100.20

ip local pool test2pool 192.168.200.10-192.168.200.20

pdm location vanhoekdc01 255.255.255.255 inside

pdm location vanhoekts01 255.255.255.255 inside

pdm location 192.168.200.0 255.255.255.0 outside

pdm logging informational 100

pdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list inside_outbound_nat0_acl

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

static (inside,outside) tcp interface smtp vanhoekdc01 smtp netmask 255.255.255.255 0 0

static (inside,outside) tcp interface 3389 vanhoekts01 3389 netmask 255.255.255.255 0 0

access-group outside_access_in in interface outside

route outside 0.0.0.0 0.0.0.0 10.0.0.138 1

jackko · ‎11-15-2005

hi harrie,

the posted config is missing the vpn part. would you please post the full version with public ip masked.

john.graves · ‎11-16-2005

I did change the subnet in the vpnpool to a completely different subnet, and added that subnet to my nat and nonat ACL's. It works and I have access to the LAN on the the inside interface. Problem solved!! Life is good.

I believe that the client limitation is the number of addresses defined in my pool statement. Is this correct?

jackko · ‎11-16-2005

it's good to learn that your issue has been resolved. as i mentioned, vpn client pool should not be overlapped with the pix inside net (or pix dmz net).

according to cisco:

Why should I rate posts?

If you see a post that you think deserves recognition, please take a moment to rate it.

You'll be helping yourself and others to quickly identify useful content -- as determined by members. And you'll be ensuring that people who generously share their expertise are properly acknowledged. As posts are rated, the value of those ratings are accumulated as "points" and summarized on the Member Profile page and on each member's Preferences page.

harriedekort · ‎11-22-2005

My problem is not with the pix. It's the dsl modem that is creating the problems. The modem is configured as router (ppoa). I have forwarded 500 and 4500 to forward my vpn tunnel. I think I must configure the modem in bridging mode, so that the modem will be transparent and my pix will get a public IP. Any suggestions? If you use a Cisco SOHO modem, is it configured in routing or briding mode?