Re: Please help with Pix 501

In article <1130699883.279570.226920@xxxxxxxxxxxxxxxxxxxxxxxxxxxx>,
millsusaf <ebrianmills@xxxxxxxxx> wrote:
:If someone can write me a 100% functional config that does everything I
:want from my original post

Changes from your original configuration are marked with '-->'. On
each of those lines, strip off the '--> ' but if that is followed by
a ':' then leave the ':' -- it is a comment marker.

PIX Version 6.3(1)
--> : this took noticably more than 5 minutes, mostly to write the comments
--> : Adjusting for your DNS issue was the other main complication. Other
--> : than second-guessing what you really wanted to do...
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password XXXXXXXXXXXXXXX encrypted
passwd XXXXXXXXXXXXXXXXX encrypted
hostname MillsVPN
domain-name ciscopix.com
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
names
access-list 101 permit ip 192.168.69.0 255.255.255.0 172.26.69.0 255.255.255.0
--> : Part of your posting implied that VPN traffic should be narrowly
--> : restricted, such as only FTP to the FTP server. We cannot configure
--> : that for you without knowing the inside IP addresses and a complete
--> : list of services you want to each one. Thus this configuration
--> : is not 100% what you asked for, because it allows VPN traffic
--> : to reach everything inside your internal network

--> : you asked for all ICMP request/response to be permitted into your
--> : network. That is not secure so I have only provided for the useful ICMP
--> access-list out2in permit icmp any interface outside echo-reply
--> access-list out2in permit icmp any interface outside unreachable
--> access-list out2in permit icmp any interface outside time-exceeded

--> : you wanted some undefined VPN tunnels for your family but did not
--> : tell us anything about them, and did not tell us whether you
--> : wanted them to terminate on the PIX or on some inside host.
--> : If they are to terminate on an inside host, you would need
--> : to permit in more traffic in out2in, but you would also have
--> : problems in getting the traffic to the correct inside host because
--> : you do not have more than one public IP address and you cannot
--> : forward ESP or GRE from the outside interface to something inside,
--> : at least not gracefully.
--> : Anyhow, this configuration is not 100% what you asked for
--> : because it does not allow for those VPN tunnels that you did
--> : not give us enough information to configure.

--> : your vpngroup sets DNS servers that are outside your local network
--> : but your client cannot normally reach those because normally -all-
--> : traffic goes to the PIX, and PIX 6.x will -never- turn traffic around
--> : and permit it out the same interface it came in on, even if the
--> : traffic came in as VPN traffic and is going out as DNS traffic.
--> : therefor in order for your choice of DNS server to be useful, we
--> : must exclude the DNS servers from going through the tunnel and instead
--> : have the client PC talk directly to those DNS servers and hope that
--> : those DNS servers are willing to answer random DNS queries on our
--> : behalf. If you did not intend that your VPN client should have useful
--> : access to outside DNS, you would not include a vpngroup dns-server
--> : statement. If you do need useful DNS then rather than counting on
--> : your rr.com DNS server and counting on the random local ISP to
--> : pass the packets all the way to rr.com, you would normally install
--> : an internal DNS server and refer to that.
--> : Note: in order to gain the access to the rr.com DNS servers through
--> : the split-tunnel configuration, the VPN client will have to have
--> : the checkbox option ticked to request split tunneling. Both parts
--> : must be in place: the server must be configured for split tunnel
--> : and the client must be configured to ask the server for split tunnel.
--> access-list split_vpn_acl deny ip host 24.31.195.63 any
--> access-list split_vpn_acl deny ip host 24.31.195.64 any
--> : the next statement just means that everything not denied above should
--> : be sent by the VPN client through the VPN tunnel to the PIX. It does
--> : NOT in itself permit any outside traffic to access anything.
--> access-list split_vpn_acl permit ip any any

pager lines 24

--> : you wanted ICMP request/reply into your network. If you want to
--> : be able to ping the PIX itself from outside, uncomment the next statement
--> : icmp permit any echo outside
--> icmp permit any echo-reply outside
--> icmp permit any unreachable outside
--> icmp permit any time-exceeded outside

mtu outside 1500
mtu inside 1500
ip address outside dhcp setroute
ip address inside 192.168.69.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
--> : the default mask for 172.26 would be 255.255.0.0
--> ip local pool ipool 172.26.69.10-172.26.69.25 mask 255.255.255.0
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list 101
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
--> : this activates the outside ACL
--> access-group out2in in interface outside
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http 192.168.69.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
--> : you can run into MTU problems if you do not restrict the TCP MSS
--> : because after the VPN layers, the packet can exceed the 1500
--> : bytes of your MTU
--> sysopt connection tcpmss 1348
crypto ipsec transform-set myset esp-des esp-md5-hmac
--> : you do not NEED to allow AES, but we were talking about it...
--> crypto ipsec transform-set mysetAES esp-aes-256 esp-sha-hmac
--> crypto dynamic-map dynmap 10 set transform-set mysetAES myset
crypto map mymap 10 ipsec-isakmp dynamic dynmap
crypto map mymap interface outside
isakmp enable outside
--> : if you do not use hostname instead of address, then you will have
--> : difficulties when your ISP changes your IP underneath you
--> isakmp identity hostname
isakmp nat-traversal 20
--> : again you do not need AES, but we were talking about it.
--> isakmp policy 7 authentication pre-share
--> isakmp policy 7 encryption aes-256
--> isakmp policy 7 hash sha
--> isakmp policy 7 group 5
--> : a full day, 86400 seconds, seems a bit much idle time for a VPN
--> : client so I dropped it to one hour
--> isakmp policy 7 lifetime 3600
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 2
--> : you probably want a shorter lifetime, as per above
isakmp policy 10 lifetime 86400
vpngroup MillsVPN address-pool ipool
vpngroup MillsVPN dns-server 24.31.195.63 24.31.195.64
vpngroup MillsVPN idle-time 6000
vpngroup MillsVPN password XXXXXXXX
--> : this to allow the PC client to reach the DNS server you defined
--> vpngroup MillsVPN split-tunnel split_vpn_acl
--> : you had vpngroup dns-server idle-time at this point, which would
--> : be for a vpngroup named 'dns-server'.
--> vpngroup MillsVPN idle-time 1800
telnet 192.168.69.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.69.100-192.168.69.120 inside
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
dhcpd enable inside
terminal width 80
--
All is vanity. -- Ecclesiastes
.

Relevant Pages

  • Re: PIX 704 Connat pass traffix
    ... Unless you know PIX OS inside and out you should refrain ... > timeout xlate 3:00:00 ... > dhcpd address 10.5.1.50-10.5.1.60 inside ... > fixup protocol dns maximum-length 512 ...
    (comp.dcom.sys.cisco)
  • Re: Please help with Pix 501
    ... fixup protocol h323 ras 1718-1719 ... timeout xlate 0:05:00 ... --> isakmp policy 7 hash sha ... dhcpd address 192.168.69.100-192.168.69.120 inside ...
    (comp.dcom.sys.cisco)
  • PIX-to-PIX IPSec VPN Tunnel
    ... fixup protocol dns maximum-length 512 ... crypto map 1VPN 10 match address DI ... isakmp policy 5 authentication pre-share ... vpngroup Remote dns-server 192.168.7.246 ...
    (comp.dcom.sys.cisco)
  • Re: Pix Configuration (PPPoe, VPN, between 3 sites)
    ... > interface ethernet0 auto ... > fixup protocol dns maximum-length 512 ... > timeout xlate 0:05:00 ... > isakmp policy 20 authentication pre-share ...
    (comp.dcom.sys.cisco)
  • Pix Configuration (PPPoe, VPN, between 3 sites)
    ... interface ethernet0 auto ... fixup protocol dns maximum-length 512 ... aaa-server RADIUS max-failed-attempts 3 ... isakmp policy 20 authentication pre-share ...
    (comp.dcom.sys.cisco)