Thanks for your reply. Currently in the config the loopback interface is set like this:

interface Loopback0

description Do not delete - SDM WebVPN generated interface

ip address 192.168.2.1 255.255.255.252

ip nat inside

ip virtual-reassembly

And the IP local pool for the VPN configured like this:

!

ip local pool VPN 192.168.5.50 192.168.5.100

ip forward-protocol nd

ip route 0.0.0.0 0.0.0.0 Dialer0

!

Is that the problem? Should the VPN local pool be 192.168.2.xx instead of 192.168.5.xx??

Either change the pool or change the IP address of the loopback interface. The idea is to have both in the same subnet.

Thanks...I will try this and report back.

I'm going to try and re-config this today...another question: I noticed the SDM configured the loopback IP 192.168.2.1 with a mask of 255.255.255.252, effectively limiting this subnet to 3 IPs. Does that mean my local pool needs to be configured with addresses 192.168.2.2 - 192.168.2.4 with mask 255.255.255.252 or can I put them both with the .0 class C mask and take advantage of the whole range? Is it this way because this device is limited to 3 VPN connections?

I would recommend changing the loopback address network to 255.255.255.0, and then you have the option to use the whole range.

Ok, that worked...sort of. Now I have a new problem. We were able to connect with the SSL VPN client and get an IP address but cannot reach any devices on the remote lan (192.168.1.x.) I can ping the router gateway at 192.168.1.1 through the tunnel but cannot ping, remote desktop, or map a drive to any device on that network. Current config attached.

We are also still getting a different error when trying to connect from Vista machines...says it's unable to load the SSL VPN client. Is there a different version for Vista?

Thanks for the help so far.

For the first problem, you're using zone-based firewall, which is not supported in 12.4(15)T with SSLVPN, but it is supported starting 12.4(20)T3. If you don't wish to upgrade, you can remove ZBF and use CBAC instead.

The second problem with Vista, make sure you are using the AnyConnect 2.x client and not the sslclient, also known as the SVC 1.x.

PS. Please rate the posts that you think have been helpful to you.

So if I upgrade, I won't have to change the config at all and it will work? Do you recommend I go right to the latest version 12.4(24)T1 or a different one?

Ahhh...that's the problem. It has the SVC pkg on it. What's the easiest method to load the new Anyconnect pkg onto the router?

If you upgrade, you will need to use virtual-templates if you want to use ZBF.

To get the AnyConnect package, you can either use SDM, or FTP to transfer the file on to the flash and then use it.

Thanks for all your help so far but I'm still having problems with this thing. I upgraded the IOS version to the latest available 12.4(24)T1 AdvIPServ. which is 3 mb larger then the orginal image. I also uninstalled the old SSL VPN package and downloaded the Anyconnect pkg which was 3 mb. Using CCP, the pkg wouldn't load because it said the flash memory was full. I removed some stuff to make room and it finally started to install but failed at the end. I then saw that a brand new Anyconnect client came out yesterday that was only 2.6 mb and downloaded that one and tried to install it with the same result. I even deleted the CP express file from flash to make more room and the install still wont finish. The file exists in the flash memory but I guess it won't unpack or whatever. What can I do to get this working?

Ok, I finally got the AnyConnect pkg loaded using the command line and it works. The clients still couldn't access anything on the LAN so I ended up stripping out all the firewall related lines. Now they are able to see everything. A new problem has come up though - none of the local clients can access the internet anymore. I think it has something to do with the bridge mode config that was added by Cisco Network Assistant or one of those other tools when I loaded it. So, with my current config, what do I need to do to get access to the internet back and what's the best way to set up the firewall so everything still works...thanks.