I have a PIX 515 and use it for VPN connection. When someone connects to the network via VPN it assigns them an internet network address. The problem is that when they vpn still need access to the internet to get to some sites. They are unable to get to any. Why?
PIX Version 6.2(2)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
clock timezone EST -5
clock summer-time EDT recurring
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
access-list nonat permit ip 192.168.1.0 255.255.255.0 192.168.9.0 255.255.255.0
access-list nonat permit ip 172.21.1.0 255.255.255.0 192.168.9.0 255.255.255.0
access-list permit_in permit tcp any host xx.xx.xx.xx eq www
access-list permit_in permit tcp any host xx.xx.xx.xx eq https
access-list permit_in permit tcp any host xx.xx.xx.xx eq smtp
access-list permit_in permit tcp any host xx.xx.xx.xx eq pcanywhere-data
access-list permit_in permit udp any host xx.xx.xx.xx eq pcanywhere-status
The reason for this is because the PIX does not redirect packets back out the same interface where they were received. In this case, you are receiving PPTP traffic on the outside interface and then asking the PIX to decrypt the traffic and send it back out the outside interface to the Internet. Packets need to come in one interface and leave another interface in order to be allowed.
As for a solution, IPSec has a feature known as split-tunnelling. This allows an IPSec client to encrypt only the traffic destined to the internal network. The remainder of the traffic is unencrypted and sent out the normal ISP links. In your case, however, you are using PPTP for your VPN connections. PPTP does not have this ability. So, the work-arounds in your case are to either move all of your VPN clients to an IPSec client or bring your PPTP tunnels in a seperate interface on the PIX and send them out to the Internet via the existing outside interface (though this last solution can get tricky from a routing stand-point).
Sorry for the problems but I hope this helps to explain.
jryan, I had a simular problem with my pix515 and clients dropping the local network. I had to add a tunnel split command as follows: "vpngroup [groupname] split-tunnel split" However I think there is some difference in your command verbage then mine. Not sure as too why, but all my groups read as: "vpngroup [groupname] [command]" maybe cause mine is set up for individual logins and not a group as i think yours are.
We have configured the outside and inside Interface with official ipv6 adresses, set a default route on outside Interface to our router, we also have definied a rule , which also gets hits, to permit tcp from inside Interface to any6.
In Syslog I also se...