Networks

Ask something
Question Locked

Cisco Pix 501 vpn error 800

0 helpful
22 replies

by system

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

We're having trouble configuring user vpn access on Pix we inherited. Sanitized configuration below. The office has a site-to-site VPN to two other offices already in place. We simply want to add a user vpn on the Pix to enable remote desktop access to the server. User is running WinXP and keeps getting an 800 error.

Any suggestions would be greatly appreciated.

Thanks.

PIX Version 6.3(5)

hostname CUSTPix
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol pptp 1723
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list 102 permit ip 1.0.2.0 [office 2 interal block] 255.255.255.0 1.0.3.0 [office 3 interal block] 255.255.128.0
access-list 101 permit ip 1.0.2.0 [office 2 interal block] 255.255.255.0 1.0.1.0 [office 1 interal block] 255.255.255.0
access-list 110 permit ip 1.0.2.0 [office 2 interal block] 255.255.255.0 1.0.3.0 [office 3 interal block] 255.255.128.0
access-list 110 permit ip 1.0.2.0 [office 2 interal block] 255.255.255.0 1.0.1.0 [office 1 interal block] 255.255.255.0
access-list outside_access_in permit tcp any host 200.201.202.203 [office 2 external IP] eq pptp
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside dhcp setroute
ip address inside 1.0.2.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool pptp-pool 1.0.2.30-1.0.2.35
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list 110
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
conduit permit icmp any any
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
sysopt connection permit-pptp
crypto ipsec transform-set CUSTset esp-3des esp-md5-hmac
crypto map CUSTmap 10 ipsec-isakmp
crypto map CUSTmap 10 match address 101
crypto map CUSTmap 10 set peer 101.102.103.104 [office 1 external IP]
crypto map CUSTmap 10 set transform-set CUSTset
crypto map CUSTmap 20 ipsec-isakmp
crypto map CUSTmap 20 match address 102
crypto map CUSTmap 20 set peer 301.302.303.304 [office 3 external IP]
crypto map CUSTmap 20 set transform-set CUSTset
crypto map CUSTmap interface outside
isakmp enable outside
isakmp key ******** address 101.102.103.104 netmask 255.255.255.255
isakmp key ******** address 301.302.303.304 netmask 255.255.255.255
isakmp identity address
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
telnet 1.0.2.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
vpdn group 1 accept dialin pptp
vpdn group 1 ppp authentication pap
vpdn group 1 ppp authentication chap
vpdn group 1 ppp authentication mschap
vpdn group 1 client configuration address local pptp-pool
vpdn group 1 pptp echo 60
vpdn group 1 client authentication local
vpdn username user1 password *********
vpdn enable outside
dhcpd address 1.0.2.10-1.0.2.20 inside
dhcpd dns 1.0.0.100 1.0.3.40
dhcpd wins 1.0.0.100 1.0.3.40
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd domain cust.com
dhcpd enable inside
terminal width 80

22 replies

by system

Yes, the user attempting to connect is using WinXP PPTP VPN.

by netman1958

I notice you are getting the ip address for the PIX's outside interface via
dhcp. What ip address are you using in the Windows PPTP setup to connect to the PIX?

by system

The address we see assigned from the ISP.

by netman1958

On the WinXP client, what options do you have set on the security tab? You don't have encryption enabled for the vpdn group on the PIX, so on the XP end, select advanced(custom settings)and make sure you have the XP client set for optional or no encryption. Also make sure you have all the CHAP options selected and none of the others. If it still doesn't work, You can troubleshoot PPTP traffic with the debug ppp and debug vpdn commands.

by system

I did try the CHAP settings, no dice. I am getting error 678 now though instead of 800.

by system

I have not written it yet to the non-volatile memory. Perhaps a dumb question but I shouldn't have to do that before this will work right? I'm trying to test the setup before adding it all

by netman1958

No , you don't need to write it to NVRAM for it to take effect. You only need to write the config to mem so that it will survive a reload of the PIX.

by system

I ran a tracert and used everyone's favorite whatismyip. Whatis came back with an IP inside the block used as the entry point on tracert so it sounded logical.

by netman1958

I'm sort of confused about what you are saying however, assuming you ran whatismyip from a computer that is on the inside of the PIX, whatismyip should have returned the IP Address you are using as the destination IP in the WinXP pptp config.
That is if whatismyip returned 210.211.212.214, that is what you should be using as the destination IP on the WinXP pptp.

by system

WinXP is using the IP returned from a whatismyip run from inside the network.

by system

Could we start with a post of a working config and I'll try there? Many thanks

by system

Are you still out there? No luck on any front. Would love to shoot you a copy of the actual config, see if you can see where I'm off.

by netman1958

I can't really tell if some of your config is correct since the IP addresses shown aren't the actual IP's in use. If you would like to PM me with the entire config and only mask the usernames and passwords for security, I can get a better understanding of your config. In lieu of that, I can post a config that I know works for you to compare yours to. Just let me know which way you want to go and I'll oblige.

by netman1958

access-list 101 permit ip 10.99.99.0 255.255.255.0 192.168.1.0 255.255.255.0
/* Note: The 10.99.99.0 subnet is the inside(LAN) subnet, the 192.168.1.0 subnet is the subnet listed in the ip pool bigpool. They must be in this order in the access-list, i.e. LAN first. */

ip local pool bigpool 192.168.1.1-192.168.1.254
/* Note: This subnet should not include any IP's in your LAN subnet */

nat (inside) 0 access-list 101
vpdn group 1 accept dialin pptp
vpdn group 1 ppp authentication pap
vpdn group 1 ppp authentication chap
vpdn group 1 ppp authentication mschap
vpdn group 1 ppp encryption mppe auto
/* Note: The encryption line is optional */

vpdn group 1 client configuration address local bigpool
vpdn group 1 pptp echo 60
vpdn group 1 client authentication local
vpdn username cisco password *********
vpdn enable outside

by system

Can I establish a new access list just for the client vpn without upsetting the site-to-site or do I need to keep them the same?

by netman1958

The access list that is referred to on this line:
"nat (inside) 0 access-list 110"
contains the source->destination subnets that we don't want to perform NAT on(nat inside) 0 means don't NAT and NAT (inside) 1 means DO NAT). Since we don't usually perform NAT on VPN traffic, that access-list, in your case 110, in my case 101, must contain an entry for all VPN source->destination pairs.

I would just add the line for your PPTP traffic to the end. You can create a new one for just the PPTP traffic and change the nat (inside) 0 line to use it temporarily for testing, however while it's applied it will disable any VPN traffic referred to in the other lines of list 110.

by system

trouble is the 101, 102 and 110 access lists are for the site to site between all three offices. I'm attempting a vpn for users not in any of the three. I presume that means a new access list but then I'll override the 110 with the nat(inside) 0. Perhaps that's my problem?

by netman1958

Access-list 101 defines the traffic that is allowed to go across this tunnel:
crypto map CUSTmap 10 match address 101

Access-list 102 defines the traffic allowed to go across this tunnel:
crypto map CUSTmap 20 match address 102

Access-list 110 is just defining the traffic we don't want to NAT.

Assuming that you don't want to NAT any of the VPN traffic(which I usually don't), access-list 110 should should permit all VPN traffic. So, if the existing 2 lines in access-list 110 define the same traffic as as lists 101 and 102, all you need to do is add a 3rd line to access-list 110 permitting your PPTP traffic. So it would look like this:
access-list 110 permit ip 1.0.2.0 255.255.255.0 1.0.3.0 255.255.128.0
access-list 110 permit ip 1.0.2.0 255.255.255.0 1.0.1.0 255.255.255.0
access-list 110 permit ip "inside subnet" "pptp-pool subnet"

by netman1958

I'm still here. Go ahead and send the config, You can either PM me from my TechRepublic profile or send it to netman1958
at
yahoo.com

This discussion is closed to new replies.