[TriLUG] Re: PIX 501 questions

[Glen Ford]

Shawn thanks for your response. I will ask  end point cisco person to 
check logs for things from my IP.
My current theroy is that the payload is somehow being modified by the 
pix 501 as the packets are being forwarded through it.  I base this on:
    1. I can sucessfully connect with my Linux laptop running cisco 
client when I use the Linksys. The Linksys is just doing PAT.  The Cisco 
PIX 501 is also doing PAT.

/glen


STaylor at srspos.com wrote:

>
> Very tricky...
>
> Even though your packets are appearing to be leaving from your pix box 
> with the outside IP It (the packet) still has to have some info about 
> the true originator in it! That is my best guess anyways, assuming 
> that the VPN client has a 192 address being masked by the 501.
>
> Since you are using a cisco vpn client I would go ahead and establish 
> the VPN Tunnel directly with that. It should tunnel up nicely with the 
> host Cisco you are connecting too.
>
> What you may want to do is take this question to the person who 
> administrates the VPN server and ask him what he allows and doesn't 
> allow.
>
> I am pretty sure that by default it drops any IP masquerading.
>
> Good Luck,
>
> Shawn
>
> Shawn Taylor
> Systech Retail Systems
> 2600 Sumner Boulevard
> Raleigh, NC 27616
> 1-800-232-0820 ext 127
> staylor at srspos.com <mailto:staylor at srspos.com>
>
>  
>
>
>
> Glen Ford <gford at idiom.com>
> Sent by: trilug-admin at trilug.org
>
> 01/30/2003 11:19 PM
> Please respond to trilug
>
>        
>         To:        TriLUG <trilug at trilug.org>
>         cc:        
>         Subject:        [TriLUG] PIX 501 questions
>
>
>
>
> Not a directly Linux related question, but I hope the good folks on this
> list might be able to help.
> In an effort to learn a little about Cisco Pix products I has swapped
> out my Linksys DSL route with a PIX 501.  I use the Linksys and now the
> pix as firewall between my home boxes and my RoadRunner cable modem.
> Pretty standard stuff.
>
>
> I am having two problems with my PIX 501.
>
>
> 1.  The outside interface of my PIX gets assigned by the ISP via dhcp.
> This works for the most part, except periodically loose connectivity to
> my RoadRunner router.  I know this because my wife complains that she
> can not use the browser. I check the connection by pinging the router
> from the command line inside the PIX. The pings fail and I have to issue
> the following command to regain my connectivity."ip address outside dhcp
> setroute retry 5"  . This is proving to be irritating. Why does the
> outside PI loose connectivity to the route?
>
>
> 2. With the Linksys I am able to use  Cisco VPN client for Linux without
> any problems.  I.E. from server behind Linksys I am able to establish a
> vpn connection to my corporate network.  This is a ipsec tunnel over UDP
> port 500 (esp).  The Linksys passes this traffic without any problems.  
> linux (vpn client) ---> linksys ----> vpn end-point
> However when I use the PIX it does not work.  I know I am passing the
> udp port 500 traffic because I see it leaving the outside interface of
> the PIX.  I use debug command to see it.  I do not see any reply traffic
> coming pack from the vpn request.  The packets leaving the PIX are
> addressed with source of the outside interface and destination of my
> corporate vpn end point.  This all seem correct except I do not see any
> traffic coming back from the corporate end-point.  After some time the
> vpn client croaks and says that it timed out trying to make the 
> connection.
>
> Any help with either/both of these two questions would be much 
> appreciated.
>
> Thanks,
> /Glen
>
>
>
>
>
>
>
>
> _______________________________________________
> TriLUG mailing list
>    http://www.trilug.org/mailman/listinfo/trilug
> TriLUG Organizational FAQ:
>    http://www.trilug.org/~lovelace/faq/TriLUG-faq.html
>
>

-- 
Glen Ford
gford at idiom.com