Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Split tunnel P501-to-CVPN 3005?

I have a pix 501 configured as an Easy VPN client and CAN connect to my Cisco 3005 VPN concentrator without issue in a test environment.

Basic Config - looks like this:

vpnclient vpngroup ******** password ********

vpnclient username ******** password ********

vpnclient server aaa.bbb.ccc.ddd

vpnclient mode client-mode

vpnclient enable

As far as connectivity, this is adequate - the 3005 is located at our main office and we do not need access into the network behind the PIX(which will eventually be on a DHCP-enabled cable network).

How can I add split-tunneling to such a configuration?? (the end-users don't need all of their traffic coming back here before going to the world). I have made a few failed attempts at adding an ACL and binding it to the nat, but to no avail.

Any suggestions are appreciated.

Thank You in advance.

1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Re: Split tunnel P501-to-CVPN 3005?

Split tunnelling, as with software clients, is configured on the head-end concentrator. This information is then passed down to the PIX EzVPN client during the negotiation process.

Configure a network list on the 3005, then configure split tunnelling for that group on the 3005 and use the list you just created. You shouldn't need to do anything on the PIX itself.

2 REPLIES
Cisco Employee

Re: Split tunnel P501-to-CVPN 3005?

Split tunnelling, as with software clients, is configured on the head-end concentrator. This information is then passed down to the PIX EzVPN client during the negotiation process.

Configure a network list on the 3005, then configure split tunnelling for that group on the 3005 and use the list you just created. You shouldn't need to do anything on the PIX itself.

New Member

Re: Split tunnel P501-to-CVPN 3005?

Thank you for your quick response. I edited the group on the 3005 to do tunneling and the VOILA! the split-tunnel negotiated. Exactly what I needed.

101
Views
0
Helpful
2
Replies