cisco vpn client/PIX connectivity woes

[webintensive]

i'm pretty new to the pix world. i'm trying to learn a few things using various tutorials i've found on the net.

i have a pix 501 that i'm trying to use as a VPN endpoint. i have a winxp machine running vpn client 4.0.

here's the setup:

(internet)-----[cisco 831]-----[pix 501]-----(internal network)

i can connect to the pix and am assigned an IP address, but beyond this nothing happens.

i cannot look inside the internal network, and i cannot pass through the VPN to connect to the outside world either (browsing, etc).

here's my pix configuration. maybe someone can find something in here that will help.

i read someplace about something to do with a "split scope." while i wasn't really able to understand fully what that means, i gathered it had something to do with the pix dealing with two separate networks. is there some specific command that i need to implement? also, can someone give me the layperson's explanation of what this "split scope" does if it is the source of the problem?

i've attached a txt file with my pix config for review.

[mattiaseriksson]

Is your vpn-client behind a NAT gateway? Then you need to enable NAT traversal.

isakmp nat-traversal 20

And the reason for split-tunneling not working could also be because the access-list statements have the wrong netmask.

Try changing:

access-list 101 permit ip 192.168.100.240 255.255.255.240 10.10.100.8 255.255.255.252

to access-list 101 permit ip 192.168.100.240 255.255.255.240 10.10.100.8 255.255.255.248

And the same with access-list 102.

You also don't need to permit vpn traffic, so you can remove the conduits:

conduit permit ip host 10.10.100.9 any

conduit permit ip host 10.10.100.10 any

And if you need to open for inbound traffic on your firewall you should use access-lists instead of conduits.

I hope this helps, pleas rate if it does.

[lovedayt]

I am having this problem also.

my inside is 192.168.1.0/24

I can connect, but no resources on the LAN other than the firewall are visible.

my access to the firewall is PDM 3.0