Cisco pix 501 - 5.5 PPTP VPN

[ZATAZ Audits]

Hello,

Somebody know how to delete an active PPTP VPN connexion
on a Cisco pix 501 (5.5) without dropping every active VPN connexions ?

For example :

- You have 5 VPN users connected.
- You delete one account (no more right to access on the PIX)
- If you take a look on the active PPTP VPN connexion the deleted user
is still connected.

The only way to disconnect this user is to drop every connected users ...

Any idea ?

Regards.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Torbjörn Samuelsson]

Hi

I don't know about Cisco Pix.
But one ide that hit me that might work as an alternative solution.
Is to make a null route to the IP address of the user you no longer
approve to be connected.
And when the connection is dropped remove the null route

It is not the right way but I think it will get the job done?

BR Tobbe

Post by ZATAZ Audits
Hello,
Somebody know how to delete an active PPTP VPN connexion
on a Cisco pix 501 (5.5) without dropping every active VPN connexions ?
- You have 5 VPN users connected.
- You delete one account (no more right to access on the PIX)
- If you take a look on the active PPTP VPN connexion the deleted user
is still connected.
The only way to disconnect this user is to drop every connected users ...
Any idea ?
Regards.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[James Patterson Wicks]

You can also use the SHUN command.

Usage: shun src_ip [dst_ip sport dport [prot]]
no shun src_ip
show shun [src_ip|statistics]
clear shun [statistics]



-----Original Message-----
From: full-disclosure-***@lists.grok.org.uk [mailto:full-disclosure-***@lists.grok.org.uk] On Behalf Of Torbjörn Samuelsson
Sent: Monday, June 06, 2005 7:28 AM
To: ZATAZ Audits
Cc: full-***@lists.grok.org.uk
Subject: Re: [Full-disclosure] Cisco pix 501 - 5.5 PPTP VPN

Hi

I don't know about Cisco Pix.
But one ide that hit me that might work as an alternative solution.
Is to make a null route to the IP address of the user you no longer
approve to be connected.
And when the connection is dropped remove the null route

It is not the right way but I think it will get the job done?

BR Tobbe

Post by ZATAZ Audits
Hello,
Somebody know how to delete an active PPTP VPN connexion
on a Cisco pix 501 (5.5) without dropping every active VPN connexions ?
- You have 5 VPN users connected.
- You delete one account (no more right to access on the PIX)
- If you take a look on the active PPTP VPN connexion the deleted user
is still connected.
The only way to disconnect this user is to drop every connected users ...
Any idea ?
Regards.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


This e-mail is the property of Oxygen Media, LLC. It is intended only for the person or entity to which it is addressed and may contain information that is privileged, confidential, or otherwise protected from disclosure. Distribution or copying of this e-mail or the information contained herein by anyone other than the intended recipient is prohibited. If you have received this e-mail in error, please immediately notify us by sending an e-mail to ***@oxygen.com and destroy all electronic and paper copies of this e-mail.

Notice: This email message is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message.


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/