AI, ML, Development + Cisco Learning Blog Learning about Machine Learning, Artificial Intelligence, related devlopment topics and formerly Routing and Switching, Datacenter, Security and other topics, CCIE #23664, Frank Wagner

5. August 2006

How to configure a Windows XP to Pix 501 connection over PPTP

Filed under: pix — ocsic @ 02:52


PIX 501 setup

Some things to keep clear before you can configure your pix. You should add yourself to the PDM (Pix device manager) access. This can be done for example with:

http inside

If your coming from subnet on the inside interface to connect to your PDM.

If every thing is setup and interfaces have their addresses you can connect to your pix with https:

It will bring you to many different login screens …

PIX 501 setup

Here you can see, until now there are only two interfaces defined. Interface inside and interface outside. It’s important for the pix to understand, that you logically sit in the middle of the firewall. The pix can’t route, it just controlls packets from one interface to the other. A packet never can leave the interface it came from. It must leave the other interface. So also every rule you set up, must contain two different interfaces.

To see for example icmp ping’s, turn on debugging on the pix with:

debug icmp trace

to turn it off again use:

undebug all

As this is clear now, i start to configure the pix for VPN access.

First you should set up an IP Pool the pix can give address from to setup the VPN Clients.

PIX501 IP Pool

Setting up the range for addresse you could give to the clients. Be carefull not to lease addresses that yre already used. So it’s the best to use a range:

PIX501 IP Pool address range

After that you can setup a user and the PPTP (Point to Point Tunneling Protocol) Connection for the XP Client.

PIX 501 setup PPTP

Don’t forgett to enable the VPDN access on the outside interface.

After that you should add one user:

PIX 501 setup user add

That enough for now.

You should configure the XP connection now.

Go to your XP client and start network configuration and the assistent to add e new connection. Use „Connection with network or office, VPN“. Just use the defaults. It should work.

Powered by WordPress