VPN Client NAT-Problem!

[MYOEY 10]

Hallo zusammen,

Ein Cisco VPN Client verbindet sich übers Internet mit der PIX515 und bekommt eine IP Adresse(192.168.192.191) zugewiesen und versucht einen Server(10.10.20.77 ) im LAN hinter der Firewall anzupingen aber leider ohne Erfolg! aber wenn dieser Server die IP des Clients(192.168.192.191) anpingt, bekommt sofot eine Antwort!!!

d. h. der Server kann den Client anpingen und umgekehrt nicht!

 

Syslog sagt:

%PIX-6-609001: Built local-host outside:192.168.192.191

%PIX-6-609001: Built local-host inside:10.10.20.77

%PIX-3-305005: No translation group found for icmp src outside:192.168.192.191 dst inside:10.10.20.77 (type 8, code 0)

%PIX-6-609002: Teardown local-host outside:192.168.192.191 duration 0:00:00

%PIX-6-609002: Teardown local-host inside:10.10.20.77 duration 0:00:00

 

 

Die Konfiguration der PIX:

 

 

PIX515# sho run

: Saved

:

PIX Version 7.0(1)

names

!

interface Ethernet0

speed 100

duplex full

nameif outside

security-level 0

ip address x.x.x.x 255.255.255.224

!

interface Ethernet1

speed 100

duplex full

nameif inside

security-level 100

ip address 10.10.10.1 255.255.255.252

!

enable password TgrUZCH.nAUBBG5iSgLW encrypted

passwd TgrUC.nAUB5TfgiSgLW encrypted

hostname PIX515

ftp mode passive

access-list inside extended permit ip any any

access-list outside extended permit tcp any any eq ssh

access-list outside extended permit icmp any any

access-list 100 extended permit ip any 192.168.192.0 255.255.255.0

pager lines 24

logging enable

logging buffered debugging

logging trap debugging

mtu outside 1500

mtu inside 1500

ip local pool Clients-Pool 192.168.192.191-192.168.192.254

no failover

monitor-interface outside

monitor-interface inside

icmp permit any outside

icmp permit any inside

no asdm history enable

arp timeout 14400

 

global (outside) 1 interface

nat (inside) 1 0.0.0.0 0.0.0.0

 

access-group outside in interface outside

access-group inside in interface inside

route outside 0.0.0.0 0.0.0.0 x.x.x.x 1

route inside 172.16.0.0 255.255.255.0 10.10.10.2 1

route inside 10.10.20.0 255.255.255.0 10.10.10.2

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00

timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

group-policy client-group internal

group-policy client-group attributes

vpn-idle-timeout 30

username admin password 3USUcOPFUiMCO4Jk encrypted privilege 15

aaa authentication ssh console LOCAL

 

crypto ipsec transform-set vpntransport esp-3des esp-md5-hmac

crypto dynamic-map outside_dyn_map 10 match address 100

crypto dynamic-map outside_dyn_map 10 set transform-set vpntransport

crypto map outside_map 65 ipsec-isakmp dynamic outside_dyn_map

crypto map outside_map interface outside

isakmp identity address

isakmp enable outside

isakmp policy 10 authentication pre-share

isakmp policy 10 encryption 3des

isakmp policy 10 hash sha

isakmp policy 10 group 2

isakmp policy 10 lifetime 86400

isakmp nat-traversal 30

telnet 192.168.192.0 255.255.255.0 inside

telnet timeout 5

ssh x.x.x.x 255.255.255.0 outside

ssh timeout 60

console timeout 0

 

tunnel-group client-group type ipsec-ra

tunnel-group client-group general-attributes

address-pool Clients-Pool

default-group-policy client-group

tunnel-group client-group ipsec-attributes

pre-shared-key *

!

class-map inspection_default

match default-inspection-traffic

!

policy-map global_policy

class inspection_default

inspect dns maximum-length 512

inspect ftp

inspect h323 h225

inspect h323 ras

inspect netbios

inspect rsh

inspect rtsp

inspect skinny

inspect esmtp

inspect sqlnet

inspect sunrpc

inspect tftp

inspect sip

inspect xdmcp

inspect icmp

inspect http

!

service-policy global_policy global

: end

 

 

 

Was fehlt eigentlich noch? habe ich da was übersehen??

 

 

Dane im voraus!

 

Gruß

[mturba 10]

Ich denke, dir fehlt, der PIX zu sagen, dass sie kein NAT zwischen dem inside- und dem VPN-Netz machen soll, beispielsweise so:

 

access-list 101 extended permit ip any 192.168.192.0 255.255.255.0

nat (inside) 0 access-list 101

[MYOEY 10]

Viiiiiiielen Dank ... mit der Zeilen funktioniert es jetzt :-)