Add management-access inside statement in your config.

Rgds

Jorge

That's it?

I failed to mention that I could use the adsm tool if that mattered whatsoever.

I'll add that statement when I get in tomorrow and get back to you.

Thanks!

that should resolve your problem for lan access through vpn session.. try that and post results.

'management-access inside' isn't for lan access. that's for accessing the inside interface of the PIX/asa over a vpn connection, nothing else.

He is probably better off trying 'sysopt connection permit-ipsec' or 'sysopt connection permit-vpn', depending on OS version

....

and it looks like he already has the command 'management-access Internal'...that's why he's able to ping/asdm to the inside interface over the vpn.

I just got to the office.

I added the "sysopt connection permit-ipsec" command and it took it successfully.

Testing VPN now.

I've managed to get networks pingable, but things like http, dns, mstsc will not work.

Suggestions?

make sure whatever hosts you're trying to connect to over the vpn are allowed over the vpn - if you can ping them over the vpn, they are probably allowed.

Do you have any ACL's on the inside/Internal interface? make sure you're connecting to the right address in the vpn, whether you specified an external or internal IP, it should be the same that you are trying to connect to.

The only ACL is one I put on that is all services, permit any any.

I starting to go nuts. I can't ping anymore other than the inside interface, nothing really seems to be working except the following:

-vmware vi client console to a host I can't ping

-adsm

I'm getting very confused :)

New config attached.

re-add the command sysopt connection permit-ipsec

take out teh split tunneling from your group policy, it looks like you dont' want to do split tunneling anyway, based on your tunnel acl.

are you actually using the the crypto map applied to the inside interface?

My whole goal here is to get this VPN setup so I can build the rest of the network/servers remotely (vmware esx server, and ms terminal services). I'm not horrible concerned with the security yet, hense the wide open ACL.

I'm actually back out of the office now and was just trying to tweak the vpn from my home. Needless to say I just broke it and I'll have to go back into the office to make it half work again. I'll add/remote those commands as soon as I can and repost the results.

Thank again.

Sorry about the delay here.

I've got back to the point establishing a tunnel fine, using ADSM, web access to my inside interface, and pinging my inside interface... NO traffic past the inside still.

I've added the sysopt connection permit-ipsec command, but it doesn't seem to show up in my show run.

Attached is the newest config.

I'm not going to touch it whatsoever without guidance now, no more guesswork for me.

Thanks,

Jim

forgot the attachment... again.