Cisco PIX Firewall Version 6.1(4)
pix 501e
The PPTP terminates ok on the PIX but vpn clients can’t access any resources on the LAN (no icmp ping reply either).
its a big config sorry but i wanted to post it all just incase something i have enterd is stoping it from working
: Saved
:
PIX Version 6.1(4)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password Z1.IJdfA9lYvHRfx encrypted
passwd 4EwkPrz5w1G.iV8. encrypted
hostname R**-PIX
domain-name R****.com
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
access-list 100 permit tcp any host 216.**.**.38 eq ftp
access-list 100 permit tcp any host 216.**.**.38 eq ftp-data
access-list 100 permit tcp any host 216.**.**.44 eq www
access-list 100 permit tcp any host 216.**.**.40 eq 3389
access-list 100 permit tcp any host 216.**.**.40 eq 1494
access-list 100 permit tcp any host 216.**.**.34 eq smtp
access-list 100 permit tcp any host 216.**.**.34 eq pop2
access-list 100 permit tcp any host 216.**.**.34 eq pop3
access-list 100 permit tcp any host 216.**.**.34 eq www
access-list 100 permit tcp any host 216.**.**.34 eq 443
access-list 100 permit tcp any host 216.**.**.34 eq 135
access-list 100 permit udp any host 216.**.**.34 eq netbios-ns
access-list 100 permit udp any host 216.**.**.34 eq netbios-dgm
access-list 100 permit tcp any host 216.**.**.34 eq 139
access-list 100 permit tcp any host 216.**.**.34 eq 4999
access-list 100 permit tcp any host 216.**.**.34 eq 5001
access-list 100 permit tcp any host 216.**.**.34 eq 5002
access-list 100 permit tcp any host 216.**.**.34 eq 5003
access-list 100 permit tcp any host 216.**.**.34 eq 5004
access-list 100 permit icmp any host 216.**.**.45
access-list 100 permit icmp any host 216.**.**.46
access-list 100 permit tcp any any eq 3389
access-list 100 permit tcp any host 216.**.**.43 eq 443
access-list 100 permit tcp any host 216.**.**.43 eq www
access-list 100 permit tcp any any eq domain
access-list 100 permit udp any any eq domain
access-list 100 permit icmp any host 216.**.**.34
access-list 100 permit tcp any any eq 1723
access-list 100 permit tcp any host 216.**.**.41 eq 3101
access-list 100 permit tcp any any eq 47
access-list 100 permit tcp any host 216.**.**.52 eq ftp
access-list 100 permit tcp any host 216.**.**.52 eq ftp-data
access-list 100 permit tcp any host 216.**.**.52 eq www
access-list 100 permit gre any host 216.**.**.55
access-list 100 permit tcp any host 216.**.**.55 eq 1723
access-list 100 permit gre any any
access-list 100 permit tcp any host 216.**.**.132 eq smtp
access-list 100 permit tcp any host 216.**.**.132 eq pop2
access-list 100 permit tcp any host 216.**.**.132 eq pop3
access-list 100 permit tcp any host 216.**.**.132 eq www
access-list 100 permit tcp any host 216.**.**.132 eq 443
access-list 100 permit tcp any host 216.**.**.132 eq 135
access-list 100 permit udp any host 216.**.**.132 eq netbios-ns
access-list 100 permit udp any host 216.**.**.132 eq netbios-dgm
access-list 100 permit tcp any host 216.**.**.132 eq 139
access-list 100 permit tcp any host 216.**.**.132 eq 4999
access-list 100 permit tcp any host 216.**.**.132 eq 5001
access-list 100 permit tcp any host 216.**.**.132 eq 5002
access-list 100 permit tcp any host 216.**.**.132 eq 5003
access-list 100 permit tcp any host 216.**.**.132 eq 5004
access-list 100 permit tcp any host 216.**.**.132 eq nntp
access-list 100 permit tcp any host 216.**.**.132 eq 389
access-list 100 permit tcp any host 216.**.**.132 eq 379
access-list 100 permit tcp any host 216.**.**.132 eq 3268
access-list 100 permit tcp any host 216.**.**.132 eq 143
access-list 100 permit tcp any host 216.**.**.132 eq 691
access-list 100 permit tcp any host 216.**.**.132 eq domain
access-list 100 permit tcp any host 216.**.**.132
access-list 100 permit tcp any any eq 3030
access-list 100 permit tcp any any eq 8080
access-list 100 permit udp any any eq 8080
access-list 100 permit ip 192.168.0.0 255.255.255.0 any
access-list 101 deny tcp host 216.**.**.40 eq 1433 any
access-list 101 permit tcp any any
access-list 101 permit udp any any
access-list 101 permit icmp host 192.168.0.75 any
access-list 101 permit icmp host 192.168.0.21 any
access-list 101 permit tcp any any eq 1723
access-list 101 permit icmp host 192.168.0.52 any
access-list 101 permit tcp any any eq 47
access-list 101 permit gre any any
access-list 101 permit ip 192.168.0.0 255.255.255.0 any
access-list 200 permit tcp any any eq 1723
access-list 200 permit tcp any any eq 47
pager lines 24
interface ethernet0 auto
interface ethernet1 auto
mtu outside 1500
mtu inside 1500
ip address outside 216.**.**.51 255.255.255.0
ip address inside 192.168.0.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool vpnpool 192.168.0.200-192.168.0.254
pdm history enable
arp timeout 14400
global (outside) 1 216.**.**.62
nat (inside) 1 192.168.0.0 255.255.255.0 0 0
static (inside,outside) tcp 216.**.**.134 3030 192.168.0.138 3030 netmask 255.255.255.255 0 0
static (inside,outside) tcp 216.**.**.134 8080 192.168.0.138 8080 netmask 255.255.255.255 0 0
static (inside,outside) udp 216.**.**.134 8080 192.168.0.138 8080 netmask 255.255.255.255 0 0
static (inside,outside) 216.**.**.40 192.168.0.25 netmask 255.255.255.255 0 0
static (inside,outside) 216.**.**.44 192.168.0.24 netmask 255.255.255.255 0 0
static (inside,outside) 216.**.**.35 192.168.0.89 netmask 255.255.255.255 0 0
static (inside,outside) 216.**.**.43 192.168.0.23 netmask 255.255.255.255 0 0
static (inside,outside) 216.**.**.34 192.168.0.21 netmask 255.255.255.255 0 0
static (inside,outside) 216.**.**.48 192.168.0.94 netmask 255.255.255.255 0 0
static (inside,outside) 216.**.**.42 192.168.0.54 netmask 255.255.255.255 0 0
static (inside,outside) 216.**.**.49 192.168.0.114 netmask 255.255.255.255 0 0
static (inside,outside) 216.**.**.52 192.168.0.29 netmask 255.255.255.255 0 0
static (inside,outside) 216.**.**.41 192.168.0.5 netmask 255.255.255.255 0 0
static (inside,outside) 216.**.**.58 192.168.0.100 netmask 255.255.255.255 0 0
static (inside,outside) 216.**.**.38 192.168.0.51 netmask 255.255.255.255 0 0
static (inside,outside) 216.**.**.57 192.168.0.107 netmask 255.255.255.255 0 0
static (inside,outside) 216.**.**.59 192.168.0.55 netmask 255.255.255.255 0 0
static (inside,outside) 216.**.**.39 192.168.0.79 netmask 255.255.255.255 0 0
static (inside,outside) 216.**.**.55 192.168.0.22 netmask 255.255.255.255 0 0
static (inside,outside) 216.**.**.46 192.168.0.68 netmask 255.255.255.255 0 0
static (inside,outside) 216.**.**.53 192.168.0.57 netmask 255.255.255.255 0 0
static (inside,outside) 216.**.**.45 192.168.0.72 netmask 255.255.255.255 0 0
static (inside,outside) 216.**.**.60 192.168.0.63 netmask 255.255.255.255 0 0
static (inside,outside) 216.**.**.36 192.168.0.62 netmask 255.255.255.255 0 0
static (inside,outside) 216.**.**.47 192.168.0.121 netmask 255.255.255.255 0 0
static (inside,outside) 216.**.**.56 192.168.0.85 netmask 255.255.255.255 0 0
static (inside,outside) 216.**.**.61 192.168.0.118 netmask 255.255.255.255 0 0
static (inside,outside) 216.**.**.130 192.168.0.69 netmask 255.255.255.255 0 0
static (inside,outside) 216.**.**.131 192.168.0.65 netmask 255.255.255.255 0 0
static (inside,outside) 216.**.**.132 192.168.0.34 netmask 255.255.255.255 0 0
static (inside,outside) 216.**.**.133 192.168.0.81 netmask 255.255.255.255 0 0
access-group 100 in interface outside
access-group 101 in interface inside
established tcp 135 0 permitto tcp 4999-5004 permitfrom tcp 0
route outside 0.0.0.0 0.0.0.0 216.**.**.50 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
sysopt connection permit-pptp
sysopt connection permit-l2tp
no sysopt route dnat
telnet 192.168.0.0 255.255.255.0 inside
telnet timeout 10
ssh timeout 5
vpdn group 1 accept dialin pptp
vpdn group 1 ppp authentication mschap
vpdn group 1 ppp encryption mppe 40
vpdn group 1 client configuration address local vpnpool
vpdn group 1 client configuration dns 192.168.0.23
vpdn group 1 client configuration wins 192.168.0.23
vpdn group 1 pptp echo 60
vpdn group 1 client authentication local
vpdn username jcenta password 1$woman
vpdn username user password vpn123
vpdn enable outside
terminal width 80