Hi Aaron,
No response is stupid, any input is welcome.
I actually have ip permit any/any at the moment just to be sure. As soon as
everything works I'll screw the acess-lists down tighter.
Thanks though,
Chris
----- UrsprÃngliche Nachricht -----
Von: "Aaron Rohyans" <aaronr@imcu.com>
An: "Meidinger Chris" <chris.meidinger@badenIT.de>
Gesendet: 16.03.06 18:21
Betreff: Re: PIX dhcprelay via IPSec.
This may be a stupid response, but have you checked to make sure that "icmp
deny any outside/inside" is not enabled in your config? That might clear up
the ping issue and let you know that you have a legitimate return path for
your UDP packets. Just a thought...
Aaron
----- Original Message -----
From: "Meidinger Chris" <chris.meidinger@badenIT.de>
To: "Stejerean, Cosmin" <cosmin@cti.depaul.edu>;
<firewalls@securityfocus.com>
Sent: Thursday, March 16, 2006 2:43 AM
Subject: RE: PIX dhcprelay via IPSec.
Hi Cosmin,
I forgot to mention in my original post, that I can hping on udp/67 in
both directions as well.
I've also noticed, that on the remote firewall i can't ping the
DHCP-Server normally, but i can if I specify the inside interface. That
is, "ping x.x.x.x" doesn't work, but but "ping inside x.x.x.x" does
work.
Can anyone think of a reason for that?
I'd appreciate any more ideas, because I've got quite a bit of pressure
to get this running.
Thanks,
Chris
-----Original Message-----
From: Stejerean, Cosmin [mailto:cosmin@cti.depaul.edu]
Sent: Thursday, March 16, 2006 3:04 AM
To: Meidinger Chris; firewalls@securityfocus.com
Subject: RE: PIX dhcprelay via IPSec.
Do you have rules to allow traffic on UDP 67 on all the PIX boxes? The
fact that you can ping the DHCP server means you can deliver ICMP
packets but UDP packets on port 67 might be filtered along
the way. Try
to send a UDP packet on port 67 to the DHCP server using nmap
and see if
your sniffers pick it up. If it gets dropped you should see where it
gets dropped. If this udp packet makes it through then you
probably have
some more serious issue with the remote pix. Also make sure the return
packet can make it's way back to the remote pix.
Regards,
Cosmin Stejerean
-----Original Message-----
From: Meidinger Chris [mailto:chris.meidinger@badenIT.de]
Sent: Wednesday, March 15, 2006 5:22 PM
To: firewalls@securityfocus.com
Subject: PIX dhcprelay via IPSec.
Hi List,
I have a question about relaying DHCP over VPN with PIX.
I have the following setup:
Client
|
|
|
Remote Site PIX running in network-extension mode
|V|
|P| Internet
|N|
Central PIX acting as concentrator
|
| Net 1
|
Inside Pix providing access control
|
| Net 2
|
DHCP Server x.x.x.x
The client needs to talk to the DHCP-Server in Net 2. It can
ping the DHCP fine so routing and all is OK, but the relayed
Unicasts on udp/67 seem to die inside the remote PIX. No log
messages, no debug messages (at least in any debug mode I
though to try) and still no packet.
I have the following config:
hostname(config)# show dhcprelay
dhcprelay server x.x.x.x outside
dhcprelay enable inside
I see statistics,
hostname(config)# show dhcprelay stat
Packets Relayed
BOOTREQUEST 0
DHCPDISCOVER 48
DHCPREQUEST 0
DHCPDECLINE 0
DHCPRELEASE 0
DHCPINFORM 0
BOOTREPLY 0
DHCPOFFER 0
DHCPACK 0
DHCPNAK 0
but no packet in Net 1 and no packet in Net 2 (got inline
sniffers in both trying to troubleshoot this)
Can anyone point me in the right direction what the problem
might be?
Thanks in advance,
Chris
______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email
______________________________________________________________________
