Cisco PIX 501 + VPN-Client

[sebmichel 10]

Hallo nochmal. Ich habe nun doch noch eine Frage zu dem PIX 501 + dem Cisco VPN-Client. Ich kann mich mit dem Cisco Client einwählen und die Verbindung wird hergestellt, IP wird vergeben. Jedoch kann ich das Netzwerk hinter der PIX nicht erreichen. Ich finde jedoch keinen Fehler in der config. Muss ich am Server oder Client noch statische Routen eintragen? Hier noch einmal meine Config:

 

PIX Version 6.3(5)

interface ethernet0 auto

interface ethernet1 100full

nameif ethernet0 outside security0

nameif ethernet1 inside security100

hostname gw-inet

domain-name pos.de

fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69

names

access-list pos_splitTunnelAcl permit ip 192.168.0.0 255.255.255.0 any

access-list inside_outbound_nat0_acl permit ip 192.168.0.0 255.255.255.0 192.168.5.0 255.255.255.0

access-list outside_cryptomap_dyn_40 permit ip any 192.168.5.0 255.255.255.0

access-list 102 permit tcp any interface outside eq 3389

pager lines 24

mtu outside 1500

mtu inside 1500

ip address outside pppoe setroute

ip address inside 192.168.0.1 255.255.255.0

ip audit info action alarm

ip audit attack action alarm

ip local pool pos-pool 192.168.5.10-192.168.5.99

pdm location 192.168.5.0 255.255.255.0 outside

pdm location 192.168.0.100 255.255.255.255 inside

pdm logging informational 100

pdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

static (inside,outside) tcp interface 3389 192.168.0.100 3389 netmask 255.255.255.255 0 0

access-group 102 in interface outside

outbound 10 permit 0.0.0.0 0.0.0.0 53 udp

outbound 10 permit 0.0.0.0 0.0.0.0 53 tcp

route outside 192.168.5.0 255.255.255.0 192.168.0.1 1

timeout xlate 0:05:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout sip-disconnect 0:02:00 sip-invite 0:03:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server TACACS+ max-failed-attempts 3

aaa-server TACACS+ deadtime 10

aaa-server RADIUS protocol radius

aaa-server RADIUS max-failed-attempts 3

aaa-server RADIUS deadtime 10

aaa-server LOCAL protocol local

http server enable

http 192.168.0.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

sysopt connection permit-ipsec

crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

crypto dynamic-map outside_dyn_map 40 set transform-set ESP-AES-256-SHA

crypto map outside_map 10 ipsec-isakmp dynamic outside_dyn_map

crypto map outside_map interface outside

isakmp enable outside

isakmp policy 20 authentication pre-share

isakmp policy 20 encryption aes-256

isakmp policy 20 hash md5

isakmp policy 20 group 2

isakmp policy 20 lifetime 86400

vpngroup remote-pronet address-pool pos-pool

vpngroup remote-pronet split-tunnel pos_splitTunnelAcl

vpngroup remote-pronet idle-time 1800

vpngroup remote-pronet password ********

telnet timeout 5

ssh 192.168.0.0 255.255.255.0 inside

ssh timeout 5

console timeout 0

vpdn group t-com request dialout pppoe

vpdn group t-com localname feste-ip4/********@t-online-com.de

vpdn group t-com ppp authentication pap

vpdn username feste-ip4/********@t-online-com.de password ********* store-local

dhcpd address 192.168.0.10-192.168.0.99 inside

dhcpd dns 192.168.0.100

dhcpd wins 192.168.0.100

dhcpd lease 3600

dhcpd ping_timeout 750

dhcpd domain pointofsales.local

dhcpd auto_config outside

terminal width 80

[blackbox 10]

Hi,

 

ersten das Routing ist überflüssig "route outside 192.168.5.0 255.255.255.0 192.168.0.1 1" da das Netz ja an der Firewall anliegt. Desweiteren hast du zwar eine "inside_outbound_nat0_acl " NAT 0 Access Liste - die ist aber nicht dem NAT zugeordnet.

 

So in der "Art" : nat (inside) 0 access-list inside_outbound_nat0_acl