Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
Community Member

How VPN client can access all LAN servers, PC's......??

I need to configure user with VPN client to access all LAN through configuring VPN on PIX 506E - ver 6.2

Can I do this on PIX? if yes, How??


Community Member

Re: How VPN client can access all LAN servers, PC's......??

If your PIX Firewall is your default gateway it is based upon the config listed below. If you have another device as the default-gateway you will also need a line of routing pointing towards the PIX for the IP Address range given to the clients.

I would also recommend upgrading to 6.3 to give you a few more commands. Can 6.2 do NAT-TRAVERSAL?

enable password big-secret

passwd little-secret

hostname steve-pix


fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol ils 389

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69


name inside-network

name default-gateway

access-list 110 permit ip inside-network

pager lines 24

logging on

mtu outside 1500

mtu inside 1500

ip address outside

ip address inside

ip audit info action alarm

ip audit attack action alarm

ip local pool home

arp timeout 14400

global (outside) 1

nat (inside) 0 access-list 110

nat (inside) 1 0 0

route outside default-gateway 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute uauth 0:30:00 inactivity

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

aaa-server LOCAL protocol local

aaa authentication enable console LOCAL

aaa authorization command LOCAL

http server enable

http inside-network inside

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

sysopt connection permit-ipsec

crypto ipsec transform-set glasgow esp-3des esp-md5-hmac

crypto dynamic-map dynmap 10 set transform-set glasgow

crypto map mymap 10 ipsec-isakmp dynamic dynmap

crypto map mymap client authentication LOCAL

crypto map mymap interface outside

isakmp enable outside

isakmp policy 10 authentication pre-share

isakmp policy 10 encryption 3des

isakmp policy 10 hash md5

isakmp policy 10 group 2

isakmp policy 10 lifetime 86400

vpngroup pix506 address-pool home

vpngroup pix506 default-domain

vpngroup pix506 split-tunnel 110

vpngroup pix506 idle-time 1800

vpngroup pix506 password whatever

telnet inside-network inside

telnet timeout 5

management-access inside

console timeout 15

username stevew password stevew privilege 15

This configuration, if I have pasted it correctly, will allow you to connect a VPN Client to the outside interface of the PIX. You will need to set-up the client for GROUP - pix506, PASSWORD - whatever

The AAA setup points the authentication LOCAL, so you will require to type in usernames and passwords.

Have fun

Steve Wilson

CreatePlease to create content