at the beginning, i'm sorry for my long message.
i've read here more post about my trouble...but still not foun any solution.
My problem is about a VPN IPSEC TUNNEL on cisco pix 515e
device.
The pix OS version is 7.0.6.
my win xp client have sp2 installed, and try to make vpn tunnel with IPSEC via cisco client 4.6.00.0049
The strange behavior is:
XP client with Cisco VPN client authenticate itself but can't ping any host of the remote lan.
Pix is configured with:
PAT on outside interface
and PAT on DMZ interface.
no nat acl for exclude packet sourced from inside network and destinated to vpn pool address.
(this acl haven't any matched when tunnel is up and running)
split tunnel acl for inside lan.
when i make IPSEC vpn up, and check it via sh crypto ipsec sa i found tunnel active.
when i make sh access-list to check if acl are matched, i found only crypto_dyn20_ acl matched.
nonat acl and splittunnel acl are zero matched.
if i try to ping from client some host on inside network,
nothing appears on stats page on the vpn client.
if i ping from pix to vpn client i see decrypted packet on stats page on client.
no encryption appears to be done on client.
if i try to traceroute from xp client any inside network host, stars appears from first hop..
on my pix i've enabled ipsec-over tcp and
nat-t
where is my mistake?
please help me!
i'm going crazy!!
i attach my pix config.
thanks a lot .
Daniele
