Hi All, I've got VPN Concentrator configured with Private, Public, default GW as displayed below. Intf Status IP Address/Subnet Mask MAC Address ------------------------------------------------------------------------ ------- Ether1-Pri| UP | 10.2.2.5/255.255.255.0 | 00.03.A0.8A.D7.A4 Ether2-Pub| UP | 192.168.5.5/255.255.255.0 | 00.03.A0.8A.D7.A5 ------------------------------------------------------------------------ ------- DNS Server(s): DNS Server Not Configured DNS Domain Name: Default Gateway: 192.168.5.10 Problem: PIX logical int Ethernet0.55 (192.168.5.10) can't ping 192.168.5.5. Due to this, management PC (10.1.1.100) isn't reaching VPNC. But VPNC is able to ping R1 & PC from 10.2.2.5 (Private). Tasks executed: R1 static route : ip route 192.168.5.0 255.255.255.0 10.2.2.10 PIX NAT : global (DMZ55) 1 interface VPNC disabled RIP on inbound. PC: route add 192.168.5.0 mask 255.255.255.0 10.1.1.1 What else do I need to add in PIX so that VPNC can ping PIX from its public interface? Relevant PIX config is also attached herewith...just incase. Appreciate any help. -Anshul
pixfirewall# sh run ! interface Ethernet0 nameif outside security-level 0 ip address 192.1.12.10 255.255.255.0 ! interface Ethernet0.55 vlan 55 nameif DMZ55 security-level 50 ip address 192.168.5.10 255.255.255.0 ! interface Ethernet1 nameif inside security-level 100 ip address 10.2.2.10 255.255.255.0 ! access-list outsideacl extended permit tcp host 4.4.4.4 host 192.1.12.100 eq tacacs access-list outsideacl extended permit tcp host 192.1.12.2 host 192.1.12.100 eq tacacs access-list outsideacl extended permit tcp host 192.1.6.20 host 192.1.12.100 eq tacacs access-list outsideacl extended permit icmp any any echo-reply access-list outsideacl extended permit icmp any any echo access-list dmzacl extended permit icmp any any echo access-list dmzacl extended permit icmp any any echo-reply icmp unreachable rate-limit 1 burst-size 1 icmp permit any DMZ55 global (outside) 1 interface global (DMZ55) 1 interface nat (inside) 1 0.0.0.0 0.0.0.0 static (inside,outside) 192.1.12.100 10.1.1.100 netmask 255.255.255.255 static (inside,outside) 192.1.12.15 10.2.2.1 netmask 255.255.255.255 access-group outsideacl in interface outside access-group dmzacl in interface DMZ55 route inside 10.1.1.0 255.255.255.0 10.2.2.1 1 route inside 1.0.0.0 255.255.255.0 10.2.2.1 1 ! router ospf 1 network 192.1.12.0 255.255.255.0 area 0 log-adj-changes ! aaa-server TAC protocol tacacs+ aaa-server TAC host 10.1.1.100 key pixkey aaa authentication include telnet inside 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 TAC ! class-map inspection_default match default-inspection-traffic ! policy-map type inspect dns preset_dns_map parameters message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp ! service-policy global_policy global pixfirewall#
