We’re having trouble configuring user vpn access on Pix we inherited. Sanitized configuration below. The office has a site-to-site VPN to two other offices already in place. We simply want to add a user vpn on the Pix to enable remote desktop access to the server. User is running WinXP and keeps getting an 800 error.
Any suggestions would be greatly appreciated.
Thanks.
PIX Version 6.3(5)
hostname CUSTPix
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol pptp 1723
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list 102 permit ip 1.0.2.0 [office 2 interal block] 255.255.255.0 1.0.3.0 [office 3 interal block] 255.255.128.0
access-list 101 permit ip 1.0.2.0 [office 2 interal block] 255.255.255.0 1.0.1.0 [office 1 interal block] 255.255.255.0
access-list 110 permit ip 1.0.2.0 [office 2 interal block] 255.255.255.0 1.0.3.0 [office 3 interal block] 255.255.128.0
access-list 110 permit ip 1.0.2.0 [office 2 interal block] 255.255.255.0 1.0.1.0 [office 1 interal block] 255.255.255.0
access-list outside_access_in permit tcp any host 200.201.202.203 [office 2 external IP] eq pptp
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside dhcp setroute
ip address inside 1.0.2.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool pptp-pool 1.0.2.30-1.0.2.35
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list 110
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
conduit permit icmp any any
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
sysopt connection permit-pptp
crypto ipsec transform-set CUSTset esp-3des esp-md5-hmac
crypto map CUSTmap 10 ipsec-isakmp
crypto map CUSTmap 10 match address 101
crypto map CUSTmap 10 set peer 101.102.103.104 [office 1 external IP]
crypto map CUSTmap 10 set transform-set CUSTset
crypto map CUSTmap 20 ipsec-isakmp
crypto map CUSTmap 20 match address 102
crypto map CUSTmap 20 set peer 301.302.303.304 [office 3 external IP]
crypto map CUSTmap 20 set transform-set CUSTset
crypto map CUSTmap interface outside
isakmp enable outside
isakmp key ******** address 101.102.103.104 netmask 255.255.255.255
isakmp key ******** address 301.302.303.304 netmask 255.255.255.255
isakmp identity address
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
telnet 1.0.2.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
vpdn group 1 accept dialin pptp
vpdn group 1 ppp authentication pap
vpdn group 1 ppp authentication chap
vpdn group 1 ppp authentication mschap
vpdn group 1 client configuration address local pptp-pool
vpdn group 1 pptp echo 60
vpdn group 1 client authentication local
vpdn username user1 password *********
vpdn enable outside
dhcpd address 1.0.2.10-1.0.2.20 inside
dhcpd dns 1.0.0.100 1.0.3.40
dhcpd wins 1.0.0.100 1.0.3.40
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd domain cust.com
dhcpd enable inside
terminal width 80