Security and Cryptography
 
Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
User Name:
Password:
Remember me
Go Back   Dev Shed Forums > System Administration > Security and Cryptography
Reload this Page

Cisco Pix 501 - Client VPN

Discuss Cisco Pix 501 - Client VPN in the Security and Cryptography forum on Dev Shed.
Cisco Pix 501 - Client VPN Security and Cryptography forum discussing issues related to coding, server applications, network protection, data protection, firewalls, ciphers and the like.

Reply
Add This Thread To:
  Del.icio.us   Digg   Google   Spurl   Blink   Furl   Simpy   Y! MyWeb 
« Previous Thread | Next Thread »  
Thread Tools Search this Thread Rate Thread Display Modes
 
Unread Dev Shed Forums Sponsor:
  #1  
Old May 20th, 2005, 10:57 AM
micke@lmpnet.se micke@lmpnet.se is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: May 2005
Posts: 5 micke@lmpnet.se User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 1 h 55 m 19 sec
Reputation Power: 0
Unhappy Cisco Pix 501 - Client VPN
Why don't I get any Defualt Gateway with the Cisco Client VPN,

#################
Ethernet adapter Wireless Network Connection:

Connection-specific DNS Suffix . :
IP Address. . . . . . . . . . . . : 192.168.49.102
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.49.1

Ethernet adapter Local Area Connection 4:

Connection-specific DNS Suffix . : xxxxx.se
IP Address. . . . . . . . . . . . : 192.168.1.201
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . :
#################


PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100

hostname pixfirewall
domain-name xxxxx.se
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol pptp 1723
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list split permit ip 192.168.1.0 255.255.255.0 any
access-list 101 permit ip any 192.168.1.0 255.255.255.0
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside xx.xx.xx.xx 255.255.255.224
ip address inside 192.168.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool vpn-ip-pool 192.168.1.201-192.168.1.235
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list 101
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
aaa authentication http console LOCAL
aaa authentication telnet console LOCAL
aaa authentication ssh console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set myset esp-des esp-md5-hmac
crypto dynamic-map dynmap 10 set transform-set myset
crypto map mymap 10 ipsec-isakmp dynamic dynmap
crypto map mymap client configuration address initiate
crypto map mymap client configuration address respond
crypto map mymap interface outside
isakmp enable outside
isakmp key ******** address 0.0.0.0 netmask 0.0.0.0
isakmp identity address
isakmp client configuration address-pool local vpn-ip-pool outside
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 1
isakmp policy 10 lifetime 86400
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup vpn address-pool vpn-ip-pool
vpngroup vpn dns-server 192.168.1.10
vpngroup vpn wins-server 192.168.1.10
vpngroup vpn default-domain xxxxxx.se
vpngroup vpn split-tunnel split
vpngroup vpn idle-time 1800
vpngroup vpn password ********
telnet 0.0.0.0 0.0.0.0 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 15
console timeout 0
dhcpd address 192.168.1.2-192.168.1.129 inside
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
dhcpd enable inside
Reply With Quote
  #2  
Old May 20th, 2005, 12:08 PM
juniperr juniperr is offline
network dude
Dev Shed Intermediate (1500 - 1999 posts)
  
Join Date: Dec 2003
Posts: 1,679 juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level)juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level)juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level)juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level)juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level)juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level)juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level) 
Time spent in forums: 1 Week 6 Days 21 h 55 m 2 sec
Reputation Power: 85
Because you cant use a default gateway on two interfaces.

the split-tunneling gives the client a route in your case 192.168.1.0 to go through the tunnel and all other traffic use the default gateway of your connected network. Now if you remove the split-tunneling your default gateway would become the tunnel.
Reply With Quote
  #3  
Old May 20th, 2005, 01:02 PM
micke@lmpnet.se micke@lmpnet.se is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: May 2005
Posts: 5 micke@lmpnet.se User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 1 h 55 m 19 sec
Reputation Power: 0
Ok, now I get a Default Gatevay.
But it still not working, when I connect the vpn client all ip trafic is stop working, I have no access till the local lan and no access to the remote vpn point.
Reply With Quote
  #4  
Old May 20th, 2005, 01:25 PM
juniperr juniperr is offline
network dude
Dev Shed Intermediate (1500 - 1999 posts)
  
Join Date: Dec 2003
Posts: 1,679 juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level)juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level)juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level)juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level)juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level)juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level)juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level) 
Time spent in forums: 1 Week 6 Days 21 h 55 m 2 sec
Reputation Power: 85
LOL! you didnt say you had a problem you just asked why you didnt have a default gateway the problem you are having I would bet money on is that you are behind a NAT/PAT router trying to connect and you didnt put the command

isakmp nat-traversal

on the PIX.
Reply With Quote
  #5  
Old May 20th, 2005, 01:54 PM
micke@lmpnet.se micke@lmpnet.se is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: May 2005
Posts: 5 micke@lmpnet.se User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 1 h 55 m 19 sec
Reputation Power: 0
No, still not working after that I enable the isakmp nat-traversal on the PIX.....
Reply With Quote
  #6  
Old May 20th, 2005, 02:55 PM
juniperr juniperr is offline
network dude
Dev Shed Intermediate (1500 - 1999 posts)
  
Join Date: Dec 2003
Posts: 1,679 juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level)juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level)juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level)juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level)juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level)juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level)juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level) 
Time spent in forums: 1 Week 6 Days 21 h 55 m 2 sec
Reputation Power: 85
DANG! LOL! you are gonna make me actualy read your config ok here are your issues...

Wrong---
access-list split permit ip 192.168.1.0 255.255.255.0 any

That access list says all 192.168.1.0 traffic go to any?

The split tunneling ACL you need to think of as a route that you are pushing to the client. You will see these in the conection statistics under routes.

access-list split permit ip 192.168.1.0 255.255.255.0 192.168.x.0 255.255.255.0

now that says to the client all traffic for 192.168.1.x send through my VPN network of 192.168.x.0 .

which brings us to the BIG issue of your VPN having the same network address of the inside network (cant route that brother)
ip address inside 192.168.1.1 255.255.255.0

ip local pool vpn-ip-pool 192.168.1.201-192.168.1.235

This ACL is a problem also NAT 0 meens do not NAT this traffic so think of it like this no not nat my inside network going to the VPN network..

WRONG-
access-list 101 permit ip any 192.168.1.0 255.255.255.0

should be
access-list NONATACL permit ip 192.168.1.0 255.255.255.0 192.168.x.0 255.255.255.0

meaning dont NAT any inside 192.168.1.x traffic that is destined for the VPN network 192.168.x.0
Reply With Quote
  #7  
Old May 20th, 2005, 05:14 PM
juniperr juniperr is offline
network dude
Dev Shed Intermediate (1500 - 1999 posts)
  
Join Date: Dec 2003
Posts: 1,679 juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level)juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level)juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level)juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level)juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level)juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level)juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level) 
Time spent in forums: 1 Week 6 Days 21 h 55 m 2 sec
Reputation Power: 85
Also Im assuming in sweden you dont get the 3DES license (could be wrong?) , but you should atleast change from md5 to sha1 hashing.
Reply With Quote
  #8  
Old May 21st, 2005, 06:38 AM
micke@lmpnet.se micke@lmpnet.se is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: May 2005
Posts: 5 micke@lmpnet.se User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 1 h 55 m 19 sec
Reputation Power: 0
And whats wrong NOW, I can connect but no trafic is permited to the local lan or the remote vpn lan.

PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100

hostname pixfirewall
domain-name xxxxxx.se
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol pptp 1723
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list 101 permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside xx.xx.xx.xx 255.255.255.224
ip address inside 192.168.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool vpn-ip-pool 192.168.2.1-192.168.2.254
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list 101
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxxx 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
aaa authentication http console LOCAL
aaa authentication telnet console LOCAL
aaa authentication ssh console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
sysopt connection permit-pptp
crypto ipsec transform-set myset esp-3des esp-sha-hmac
crypto dynamic-map dynmap 10 set transform-set myset
crypto map mymap 10 ipsec-isakmp dynamic dynmap
crypto map mymap client configuration address initiate
crypto map mymap client configuration address respond
crypto map mymap interface outside
isakmp enable outside
isakmp key ******** address 0.0.0.0 netmask 0.0.0.0
isakmp identity address
isakmp keepalive 20
isakmp client configuration address-pool local vpn-ip-pool outside
isakmp nat-traversal 20
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash sha
isakmp policy 10 group 1
isakmp policy 10 lifetime 86400
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash sha
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup vpn address-pool vpn-ip-pool
vpngroup vpn dns-server 192.168.1.10
vpngroup vpn wins-server 192.168.1.10
vpngroup vpn default-domain xxxxxx.se
vpngroup vpn idle-time 1800
vpngroup vpn password ********
telnet 0.0.0.0 0.0.0.0 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 15
console timeout 0
dhcpd address 192.168.1.2-192.168.1.129 inside
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
dhcpd enable inside
Reply With Quote
  #9  
Old May 21st, 2005, 08:59 AM
juniperr juniperr is offline
network dude
Dev Shed Intermediate (1500 - 1999 posts)
  
Join Date: Dec 2003
Posts: 1,679 juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level)juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level)juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level)juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level)juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level)juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level)juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level) 
Time spent in forums: 1 Week 6 Days 21 h 55 m 2 sec
Reputation Power: 85
Lets do some clean up here you should be using the cisco VPN client version 4 or higher if you are not then let me know what you are using...

remove the following lines..

sysopt connection permit-pptp
crypto map mymap client configuration address respond
isakmp key ******** address 0.0.0.0 netmask 0.0.0.0
isakmp client configuration address-pool local vpn-ip-pool outside
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash sha
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400


and change isakmp policy 10 group 1 to iakmp policy 10 group 2.

also hiding the domain is useless since you provided your outside address as well you gave your login name and the MD5 hash of your password which can be cracked like I did in another post. change your passwords!

who ever the moderator is could you please remove his outside ipaddress and password hashes?
Reply With Quote
  #10  
Old May 21st, 2005, 03:07 PM
micke@lmpnet.se micke@lmpnet.se is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: May 2005
Posts: 5 micke@lmpnet.se User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 1 h 55 m 19 sec
Reputation Power: 0
ok, still not work.....

PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
hostname pixfirewall
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol pptp 1723
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list 101 permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside xx.xx.xx.xx 255.255.255.224
ip address inside 192.168.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool vpn-ip-pool 192.168.2.1-192.168.2.254
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list 101
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
route outside 0.0.0.0 0.0.0.0 195.67.53.65 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
aaa authentication http console LOCAL
aaa authentication telnet console LOCAL
aaa authentication ssh console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set myset esp-3des esp-sha-hmac
crypto dynamic-map dynmap 10 set transform-set myset
crypto map mymap 10 ipsec-isakmp dynamic dynmap
crypto map mymap client configuration address initiate
crypto map mymap interface outside
isakmp enable outside
isakmp identity address
isakmp keepalive 20
isakmp nat-traversal 20
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash sha
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
vpngroup vpn address-pool vpn-ip-pool
vpngroup vpn idle-time 1800
vpngroup vpn password ********
telnet 0.0.0.0 0.0.0.0 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 15
console timeout 0
dhcpd address 192.168.1.2-192.168.1.129 inside
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
dhcpd enable inside
Reply With Quote
  #11  
Old May 23rd, 2005, 09:38 AM
juniperr juniperr is offline
network dude
Dev Shed Intermediate (1500 - 1999 posts)
  
Join Date: Dec 2003
Posts: 1,679 juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level)juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level)juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level)juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level)juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level)juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level)juniperr User rank is Second Lieutenant (5000 - 10000 Reputation Level) 
Time spent in forums: 1 Week 6 Days 21 h 55 m 2 sec
Reputation Power: 85
what version client are you using and what OS? and what are you doing to test it? mapping drive to server or pinging a server or what?
Reply With Quote
Reply

Viewing: Dev Shed Forums > System Administration > Security and Cryptography > Cisco Pix 501 - Client VPN

« Previous Thread | Next Thread »

Thread Tools  Search this Thread 
Search this Thread:

Advanced Search
Display Modes  Rate This Thread 
Linear Mode Linear Mode
Rate This Thread:


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
View Your Warnings | New Posts | Latest News | Latest Threads | Shoutbox
Forum Jump


Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support |