Hi Elias,
The setting 'management-access inside' allows pinging the inside interface over
vpn.
I don't want to keep it, but for the moment I have 'sysopt ipsec-passthrough'
enabled until everything is running.
Thanks,
Chris
----- UrsprÃngliche Nachricht -----
Von: "Udechime, Elias [NTK]" <Elias.Udechime@sprint.com>
An: "Meidinger Chris" <chris.meidinger@badenIT.de>
Cc: "firewalls@securityfocus.com" <firewalls@securityfocus.com>
Gesendet: 16.03.06 18:15
Betreff: RE: PIX dhcprelay via IPSec.
Chris,
I don't think you can PING the PIX firewall inside interface from
inbound by default for security reason. However, on the PIX specifying
inside or outside does work. Since you running IPSec VPN, you can try
implementing "IPSec Passthrough" traffic.
Elias
-----Original Message-----
From: Meidinger Chris [mailto:chris.meidinger@badenIT.de]
Sent: Thursday, March 16, 2006 2:44 AM
To: Stejerean, Cosmin; firewalls@securityfocus.com
Subject: RE: PIX dhcprelay via IPSec.
Hi Cosmin,
I forgot to mention in my original post, that I can hping on udp/67 in
both directions as well.
I've also noticed, that on the remote firewall i can't ping the
DHCP-Server normally, but i can if I specify the inside interface. That
is, "ping x.x.x.x" doesn't work, but but "ping inside x.x.x.x" does
work.
Can anyone think of a reason for that?
I'd appreciate any more ideas, because I've got quite a bit of pressure
to get this running.
Thanks,
Chris
-----Original Message-----
From: Stejerean, Cosmin [mailto:cosmin@cti.depaul.edu]
Sent: Thursday, March 16, 2006 3:04 AM
To: Meidinger Chris; firewalls@securityfocus.com
Subject: RE: PIX dhcprelay via IPSec.
Do you have rules to allow traffic on UDP 67 on all the PIX boxes? The
fact that you can ping the DHCP server means you can deliver ICMP
packets but UDP packets on port 67 might be filtered along
the way. Try
to send a UDP packet on port 67 to the DHCP server using nmap
and see if
your sniffers pick it up. If it gets dropped you should see where it
gets dropped. If this udp packet makes it through then you
probably have
some more serious issue with the remote pix. Also make sure the return
packet can make it's way back to the remote pix.
Regards,
Cosmin Stejerean
-----Original Message-----
From: Meidinger Chris [mailto:chris.meidinger@badenIT.de]
Sent: Wednesday, March 15, 2006 5:22 PM
To: firewalls@securityfocus.com
Subject: PIX dhcprelay via IPSec.
Hi List,
I have a question about relaying DHCP over VPN with PIX.
I have the following setup:
Client
|
|
|
Remote Site PIX running in network-extension mode
|V|
|P| Internet
|N|
Central PIX acting as concentrator
|
| Net 1
|
Inside Pix providing access control
|
| Net 2
|
DHCP Server x.x.x.x
The client needs to talk to the DHCP-Server in Net 2. It can
ping the DHCP fine so routing and all is OK, but the relayed
Unicasts on udp/67 seem to die inside the remote PIX. No log
messages, no debug messages (at least in any debug mode I
though to try) and still no packet.
I have the following config:
hostname(config)# show dhcprelay
dhcprelay server x.x.x.x outside
dhcprelay enable inside
I see statistics,
hostname(config)# show dhcprelay stat
Packets Relayed
BOOTREQUEST 0
DHCPDISCOVER 48
DHCPREQUEST 0
DHCPDECLINE 0
DHCPRELEASE 0
DHCPINFORM 0
BOOTREPLY 0
DHCPOFFER 0
DHCPACK 0
DHCPNAK 0
but no packet in Net 1 and no packet in Net 2 (got inline
sniffers in both trying to troubleshoot this)
Can anyone point me in the right direction what the problem
might be?
Thanks in advance,
Chris
