Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
New Member

cisco vpn client/PIX connectivity woes

i'm pretty new to the pix world. i'm trying to learn a few things using various tutorials i've found on the net.

i have a pix 501 that i'm trying to use as a VPN endpoint. i have a winxp machine running vpn client 4.0.

here's the setup:

(internet)-----[cisco 831]-----[pix 501]-----(internal network)

i can connect to the pix and am assigned an IP address, but beyond this nothing happens.

i cannot look inside the internal network, and i cannot pass through the VPN to connect to the outside world either (browsing, etc).

here's my pix configuration. maybe someone can find something in here that will help.

i read someplace about something to do with a "split scope." while i wasn't really able to understand fully what that means, i gathered it had something to do with the pix dealing with two separate networks. is there some specific command that i need to implement? also, can someone give me the layperson's explanation of what this "split scope" does if it is the source of the problem?

i've attached a txt file with my pix config for review.


Re: cisco vpn client/PIX connectivity woes

Is your vpn-client behind a NAT gateway? Then you need to enable NAT traversal.

isakmp nat-traversal 20

And the reason for split-tunneling not working could also be because the access-list statements have the wrong netmask.

Try changing:

access-list 101 permit ip

to access-list 101 permit ip

And the same with access-list 102.

You also don't need to permit vpn traffic, so you can remove the conduits:

conduit permit ip host any

conduit permit ip host any

And if you need to open for inbound traffic on your firewall you should use access-lists instead of conduits.

I hope this helps, pleas rate if it does.

New Member

Re: cisco vpn client/PIX connectivity woes

I am having this problem also.

my inside is

I can connect, but no resources on the LAN other than the firewall are visible.

my access to the firewall is PDM 3.0

作成コンテンツを作成するには してください