<br><font size=2 face="sans-serif">Very tricky...</font>
<br>
<br><font size=2 face="sans-serif">Even though your packets are appearing to be leaving from your pix box with the outside IP It (the packet) still has to have some info about the true originator in it! That is my best guess anyways, assuming that the VPN client has a 192 address being masked by the 501.</font>
<br>
<br><font size=2 face="sans-serif">Since you are using a cisco vpn client I would go ahead and establish the VPN Tunnel directly with that. It should tunnel up nicely with the host Cisco you are connecting too.</font>
<br>
<br><font size=2 face="sans-serif">What you may want to do is take this question to the person who administrates the VPN server and ask him what he allows and doesn't allow.</font>
<br>
<br><font size=2 face="sans-serif">I am pretty sure that by default it drops any IP masquerading.</font>
<br>
<br><font size=2 face="sans-serif">Good Luck,</font>
<br>
<br><font size=2 face="sans-serif">Shawn</font>
<br><font size=2 face="sans-serif"><br>
</font><font size=3 face="Times New Roman"><b>Shawn Taylor</b></font>
<br><font size=3 face="Times New Roman"><b>Systech Retail Systems</b></font>
<br><font size=3 face="Times New Roman"><b>2600 Sumner Boulevard</b></font>
<br><font size=3 face="Times New Roman"><b>Raleigh, NC</b> <b>27616</b></font>
<br><font size=3 face="Times New Roman"><b>1-800-232-0820 ext 127</b></font>
<br><a href=mailto:staylor@srspos.com><font size=3 color=blue face="Times New Roman"><u>staylor@srspos.com</u></font></a>
<p><font size=3 face="Times New Roman"> </font>
<br>
<br>
<br>
<table width=100%>
<tr valign=top>
<td>
<td><font size=1 face="sans-serif"><b>Glen Ford <gford@idiom.com></b></font>
<br><font size=1 face="sans-serif">Sent by: trilug-admin@trilug.org</font>
<p><font size=1 face="sans-serif">01/30/2003 11:19 PM</font>
<br><font size=1 face="sans-serif">Please respond to trilug</font>
<br>
<td><font size=1 face="Arial"> </font>
<br><font size=1 face="sans-serif"> To: TriLUG <trilug@trilug.org></font>
<br><font size=1 face="sans-serif"> cc: </font>
<br><font size=1 face="sans-serif"> Subject: [TriLUG] PIX 501 questions</font></table>
<br>
<br>
<br><font size=2 face="Courier New">Not a directly Linux related question, but I hope the good folks on this <br>
list might be able to help.<br>
In an effort to learn a little about Cisco Pix products I has swapped <br>
out my Linksys DSL route with a PIX 501. I use the Linksys and now the <br>
pix as firewall between my home boxes and my RoadRunner cable modem. <br>
Pretty standard stuff.<br>
<br>
<br>
I am having two problems with my PIX 501.<br>
<br>
<br>
1. The outside interface of my PIX gets assigned by the ISP via dhcp. <br>
This works for the most part, except periodically loose connectivity to <br>
my RoadRunner router. I know this because my wife complains that she <br>
can not use the browser. I check the connection by pinging the router <br>
from the command line inside the PIX. The pings fail and I have to issue <br>
the following command to regain my connectivity."ip address outside dhcp <br>
setroute retry 5" . This is proving to be irritating. Why does the <br>
outside PI loose connectivity to the route?<br>
<br>
<br>
2. With the Linksys I am able to use Cisco VPN client for Linux without <br>
any problems. I.E. from server behind Linksys I am able to establish a <br>
vpn connection to my corporate network. This is a ipsec tunnel over UDP <br>
port 500 (esp). The Linksys passes this traffic without any problems. <br>
linux (vpn client) ---> linksys ----> vpn end-point<br>
However when I use the PIX it does not work. I know I am passing the <br>
udp port 500 traffic because I see it leaving the outside interface of <br>
the PIX. I use debug command to see it. I do not see any reply traffic <br>
coming pack from the vpn request. The packets leaving the PIX are <br>
addressed with source of the outside interface and destination of my <br>
corporate vpn end point. This all seem correct except I do not see any <br>
traffic coming back from the corporate end-point. After some time the <br>
vpn client croaks and says that it timed out trying to make the connection.<br>
<br>
Any help with either/both of these two questions would be much appreciated.<br>
<br>
Thanks,<br>
/Glen<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
_______________________________________________<br>
TriLUG mailing list<br>
http://www.trilug.org/mailman/listinfo/trilug<br>
TriLUG Organizational FAQ:<br>
http://www.trilug.org/~lovelace/faq/TriLUG-faq.html<br>
</font>
<br>
<br>