Routed Internal network problem

[bibo]

Hello all!

It should be fine if someone more experienced can help me:

I'm using Cisco VPN client 3.5.1 to connect to PIX515E, and it works fine if I want to

access network segment where Cisco PIX inside interface resides on (Network 10.1.1.0/24 for example).

But if I want to access some host in routed internal network, I can't get connectivity.

I tried to add route mannually on W2k Pro client, but Windows can't accept that route,

because it don't know anything about Cisco VPN established connection.

I tried to add route on Cisco PIX, but it don't working.

Shema of the sistem is:

VPN Client------------->PIX firewall--10.1.1.0/24net--->Internal router--->Some int. network --->HOST (193.x.x.x/24 net)

There is no any internal network routing problem because

HOST is visible from internal network segment (10.1.1.0/24 net).

How I can define route to allow VPN users to access to internal net over Internal router?

Where to define route: on VPN client or on PIX, or both of them?

Does some newer version of Cisco VPN client support that?

Thanks a lot!

Branko.

[#2]

If you have set your VPN users up to grab an ip address that is not on the same subnet as the inside

of the concentrator than regular routing would need to take place. Basically at some point of

default contact on the network a device that all traffic goes through would need to know that when

traffic is destined for the VPN pool it needs to be sent to the concentrators inside interface. If

the default gateway on the network is a PIX firewall (or another Firewall device) than this would

not work due to the fact that most firewalls cannot route hence returning a packet out the same

interface it came in would be a security breach and not allowed. If that's the case you would need

to point everyones default gateway at an internal router and have it's default gateway being the

firewall device, and have it also have a route pointing back to the concentrator for the VPN pool.

If the default gateway for the machines on the local network happens to be a router, then simply put

a route in there pointing all traffic destined for the VPN network to the concentrators inside

interface.