cisco vpn client/PIX connectivity woes

Unanswered Question
Jul 24th, 2007

i'm pretty new to the pix world. i'm trying to learn a few things using various tutorials i've found on the net.

i have a pix 501 that i'm trying to use as a VPN endpoint. i have a winxp machine running vpn client 4.0.

here's the setup:

(internet)-----[cisco 831]-----[pix 501]-----(internal network)

i can connect to the pix and am assigned an IP address, but beyond this nothing happens.

i cannot look inside the internal network, and i cannot pass through the VPN to connect to the outside world either (browsing, etc).

here's my pix configuration. maybe someone can find something in here that will help.

i read someplace about something to do with a "split scope." while i wasn't really able to understand fully what that means, i gathered it had something to do with the pix dealing with two separate networks. is there some specific command that i need to implement? also, can someone give me the layperson's explanation of what this "split scope" does if it is the source of the problem?

i've attached a txt file with my pix config for review.

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
mattiaseriksson Wed, 07/25/2007 - 00:36

Is your vpn-client behind a NAT gateway? Then you need to enable NAT traversal.

isakmp nat-traversal 20

And the reason for split-tunneling not working could also be because the access-list statements have the wrong netmask.

Try changing:

access-list 101 permit ip

to access-list 101 permit ip

And the same with access-list 102.

You also don't need to permit vpn traffic, so you can remove the conduits:

conduit permit ip host any

conduit permit ip host any

And if you need to open for inbound traffic on your firewall you should use access-lists instead of conduits.

I hope this helps, pleas rate if it does.


This Discussion