|
|
Question : Problem: VPN Tunnel is connected, but traffic ignores it...
|
|
I have 2 cisco PIX 501's, one wiht static IP the other dynamic.
VPN Server is on the static end, but it is at the remote site... called Red. I can get to the internet, but it I try to ping
10.10.10.1 ---- Cisco PIX 501 --- Dynamic IP <------------->50.50.50.50 (Static IP) ---- Cisco PIX 501 ------ 10.10.20.1
The VPN Tunnle light is lit... but I cannot ping or reach any of the 10.10.10.0 addresses (behind blue) where the W2K3 Server (10.10.10.10) is and it is the Domain Controller / DNS. I think there is probably an issue with the Split tunnel.. but do not really know. I do see one error in the "vpngroup unityclient dns-server 10.10.10.10 192.168.1.1". The 192.168 address is left over from testing and should be 151.198.0.39, but I do not think that will fix it.
Here is the setup for Red PIX
: Written by enable_15 at 21:33:04.327 UTC Wed Jan 25 2006 PIX Version 6.3(5) interface ethernet0 auto interface ethernet1 100full nameif ethernet0 outside security0 nameif ethernet1 inside security100 enable password encrypted passwd encrypted hostname Red domain-name domain.local fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 names access-list 100 permit ip 10.10.20.0 255.255.255.0 10.10.10.0 255.255.255.0 access-list 100 permit ip 10.10.20.0 255.255.255.0 10.10.30.0 255.255.255.0 access-list 200 permit ip 10.10.20.0 255.255.255.0 10.10.10.0 255.255.255.0 pager lines 24 logging on icmp permit any echo outside icmp permit any echo inside mtu outside 1500 mtu inside 1500 ip address outside 50.50.50.50 255.255.255.0 ip address inside 10.10.20.1 255.255.255.0 ip audit info action alarm ip audit attack action alarm ip local pool clientpool 10.10.30.1-10.10.30.10 pdm location 10.10.10.0 255.255.255.0 outside pdm logging informational 100 pdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 0 access-list 200 nat (inside) 1 0.0.0.0 0.0.0.0 0 0 conduit permit icmp any any route outside 0.0.0.0 0.0.0.0 50.50.50.50 1 timeout xlate 0:05:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout sip-disconnect 0:02:00 sip-invite 0:03:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server TACACS+ max-failed-attempts 3 aaa-server TACACS+ deadtime 10 aaa-server RADIUS protocol radius aaa-server RADIUS max-failed-attempts 3 aaa-server RADIUS deadtime 10 aaa-server LOCAL protocol local ntp server 128.59.59.177 source outside ntp server 66.250.131.180 source outside http server enable http 10.10.20.0 255.255.255.0 inside no snmp-server location no snmp-server contact snmp-server community public no snmp-server enable traps floodguard enable sysopt connection permit-ipsec crypto ipsec transform-set myset esp-des esp-md5-hmac crypto dynamic-map cisco 1 set transform-set myset crypto map dyn-map 20 ipsec-isakmp dynamic cisco crypto map dyn-map interface outside isakmp enable outside isakmp policy 10 authentication pre-share isakmp policy 10 encryption aes isakmp policy 10 hash md5 isakmp policy 10 group 2 isakmp policy 10 lifetime 86400 isakmp policy 20 authentication pre-share isakmp policy 20 encryption des isakmp policy 20 hash md5 isakmp policy 20 group 2 isakmp policy 20 lifetime 86400 vpngroup unityclient address-pool clientpool vpngroup unityclient dns-server 10.10.10.10 192.168.1.1 vpngroup unityclient default-domain domain.local vpngroup unityclient split-tunnel 200 vpngroup unityclient idle-time 1800 vpngroup unityclient password ******** telnet timeout 5 ssh timeout 5 console timeout 0 dhcpd address 10.10.20.101-10.10.20.130 inside dhcpd dns 10.10.10.10 151.198.0.39 dhcpd lease 1048575 dhcpd ping_timeout 750 dhcpd enable inside terminal width 80
Setup for Blue is:
PIX Version 6.3(5) interface ethernet0 auto interface ethernet1 100full nameif ethernet0 outside security0 nameif ethernet1 inside security100 enable password encrypted passwd encrypted hostname blue domain-name domain.local fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 names access-list outside_in permit tcp any interface outside eq 3389 pager lines 24 icmp permit any echo outside icmp permit any echo inside mtu outside 1500 mtu inside 1500 ip address outside dhcp setroute ip address inside 10.10.10.1 255.255.255.0 ip audit info action alarm ip audit attack action alarm pdm location 10.10.10.10 255.255.255.255 inside pdm logging informational 100 pdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 1 0.0.0.0 0.0.0.0 0 0 static (inside,outside) tcp interface 3389 10.10.10.10 3389 netmask 255.255.255. 255 0 0 access-group outside_in in interface outside timeout xlate 0:05:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout sip-disconnect 0:02:00 sip-invite 0:03:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server TACACS+ max-failed-attempts 3 aaa-server TACACS+ deadtime 10 aaa-server RADIUS protocol radius aaa-server RADIUS max-failed-attempts 3 aaa-server RADIUS deadtime 10 aaa-server LOCAL protocol local ntp server 128.59.59.177 source outside ntp server 66.250.131.180 source outside http server enable http 10.10.10.0 255.255.255.0 inside no snmp-server location no snmp-server contact snmp-server community public no snmp-server enable traps floodguard enable sysopt connection permit-ipsec sysopt noproxyarp inside crypto ipsec transform-set myset esp-des esp-md5-hmac telnet timeout 5 ssh timeout 5 console timeout 0 dhcpd dns 10.10.10.10 vpnclient server 50.50.50.50 vpnclient mode network-extension-mode vpnclient vpngroup unityclient password ******** vpnclient enable terminal width 80
|
Answer : Problem: VPN Tunnel is connected, but traffic ignores it...
|
|
Yes, having the spllittunnel refer to a non existing access-list is no good. While 100 is a bit unspecific for my likings (and I don't like reusing the same acl for several purposes), I believe it would work to use that.
|
|
|
|