RE: Cisco PIX 501 and Cisco remote VPN client

> > Could I post the PIX config here to get some help? 

OK, here it is. This was generated using the PDM.
I've found that to do some things, like port
forwarding, I have to go to the CLI instead of
using PDM.

1) I'm not sure if I put the "static" statements
in the correct spot, but they are not currenly in
the running/active configuration. I just manually
added them to this e-mail because I will need to 
add those.

2) I don't know if I even need the VPN pool. If
not, and the Cisco client can get an address from
the internal DHCP server, I would prefer that.

3) All these statements, except the "static" lines
that I manually added for this e-mail, were
generated by the PDM. Since we don't have any
kind of RADIUS service, we need to use the LOCAL
setup. From the PDM, I am not sure how to do that
correctly.

4) I understand the basics of the commands, except
the VPN-related. I am lost there and I was hoping
the PDM would make it easier. The client seems to
think the group password is incorrect.

5) Because this PIX will replace a SonicWall, the
static statements are needed to emulate the port
forwarding that was set up on the existing firewall.
Changing the MX record is not currently an option.
(The mail server was set up by someone else and 
they used NAT and port redirection, so there
is only a single public IP in use for everything.)
I have an extra public IP I can use, if necessary,
unfortunately it's not contiguous with the existing
IP on the WAN interface. If there is a way to make
that work for the purpose of getting the VPN working,
that would be fine.

6) The address "192.168.1.224" in one of the access
lists was generated by the PDM software - I didn't 
select that.


Thanks VERY much for any help!!! I'm running out of time.

------------------------------------------------

Building configuration...
: Saved
:
PIX Version 6.3(1)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password 9.SQ8hSA5eS02gbf encrypted
passwd 9.SQ8hSA5eS02gbf encrypted
hostname pixfirewall
domain-name mydomain.com
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
no fixup protocol sqlnet 1521
names
object-group service ms-ad tcp
  description Microsoft Active Directory
  port-object range 445 445
object-group service ms-rpc tcp-udp
  description Microsoft RPC service
  port-object range 135 135
object-group service ms-name-services tcp-udp
  description Microsoft name services and RPC
  port-object range 137 139
  port-object range 445 445
  port-object range 135 135
access-list outside_cryptomap_dyn_20 permit ip any 192.168.1.224 255.255.255.224 
access-list inside_access_in remark Block Microsoft name services and RPC and AD services from going outside.
access-list inside_access_in deny udp any object-group ms-name-services any 
access-list inside_access_in remark Block Microsoft name services and RPC and AD services from going outside.
access-list inside_access_in deny tcp any object-group ms-name-services any 
access-list outside_access_in remark Block Microsoft name services and RPC and AD services from getting inside.
access-list outside_access_in deny tcp any object-group ms-name-services any 
access-list outside_access_in remark Block Microsoft name services and RPC and AD services from getting inside.
access-list outside_access_in deny udp any object-group ms-name-services any 
access-list outside_access_in remark Allow ping responses
access-list outside_access_in permit icmp any any echo-reply 
access-list outside_access_in remark Allow ping responses
access-list outside_access_in permit icmp any any source-quench 
access-list outside_access_in remark Allow ping responses
access-list outside_access_in permit icmp any any unreachable 
access-list outside_access_in remark Allow ping responses
access-list outside_access_in permit icmp any any time-exceeded 
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside xxx.yyy.182.137 255.255.255.248
ip address inside 192.168.1.251 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool VPNpool 192.168.1.230-192.168.1.240
pdm location 192.168.1.0 255.255.255.255 inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
static (inside,outside) tcp interface smtp 192.168.1.2 smtp netmask 255.255.255.255 0 0
static (inside,outside) tcp interface www 192.168.1.2 www netmask 255.255.255.255 0 0
route outside 0.0.0.0 0.0.0.0 24.221.182.114 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+ 
aaa-server RADIUS protocol radius 
aaa-server LOCAL protocol local 
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac 
crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map client authentication LOCAL
crypto map outside_map interface outside
isakmp enable outside
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup PIXvpn01 address-pool VPNpool
vpngroup PIXvpn01 dns-server xxx.yyy.161.5 xxx.yyy.162.5
vpngroup PIXvpn01 wins-server 192.168.1.2 192.168.1.2
vpngroup PIXvpn01 default-domain mydomain.com
vpngroup PIXvpn01 idle-time 1800
vpngroup PIXvpn01 password ********
telnet 192.168.1.0 255.255.255.255 inside
telnet timeout 15
ssh timeout 5
management-access inside
console timeout 45
dhcpd address 192.168.1.2-192.168.1.33 inside
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
username user1 password aPq/fJMbixTr.xww encrypted privilege 15
username user2 password rMAneYc5Z2/JM.JO encrypted privilege 15
terminal width 80
banner login Firewall Login Successful for $(hostname) on $(domain)
Cryptochecksum:9c793b5033e0dea4291363ec2ba4b9e5
: end
[OK]

-----------------------------------

-- Rob --