Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Users might experience few discrepancies in Search results. We are working on this on our side. We apologize for the inconvenience it may have caused.
New Member

Ez-VPN throught Internet using PIX 501 and 3640, routing problem.

I'v tried this configuration, I've connected a PIX 501 (remote office test) and a 3640 (hq test) using Ez-VPN, all is working fine except for routing, when the IpSec tunnel is up all traffic pass throught the IPSec Tunnel.

I don't understand how to route traffic for HQ ip address trought the IP Sec Tunnel and all other traffic using the standard internet connection.

I've tried the route command without success.

---

route outside 0.0.0.0 0.0.0.0 x.x.x.x (internet traffic)

route outside 10.1.1.0 255.255.255.0 y.y.y.y (HQ traffic)

vpnclient vpngroup hwclient password ********

vpnclient username prototype password ********

vpnclient server x.x.x.x

vpnclient mode network-extension-mode

vpnclient enable

Thanks in advance for your help,

Antonio

1 REPLY
New Member

Re: Ez-VPN throught Internet using PIX 501 and 3640, routing pro

I'm not very sure that I understand what exactly is the Easy VPN Client and what exactly is the Easy VPN Server. So I accept that the PIX is client and the router is the server.

Let me to explain the following about the ideology of the Easy VPN. Cisco Easy VPN does not allow the client side to specify what traffic goes in VPN IPSec tunnel and what pass it. I believe this is by security (and architecture) reasons and will not discuss how secure is.

If you want to specify what traffic should be crypted and what not you should you "split-tunnel" feature at the VPN server. Not on the PIX side. Also you should use Cisco IOS Easy VPN server that support that feature. You should use "acl" command in your crypto map configuration.

http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122newft/122t/122t8/ftunity.htm#xtocid24

99
Views
0
Helpful
1
Replies
CreatePlease to create content