Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

VPNClient V4.0.x and client netmask


I've set up a VPN using PIX 6.3(1) and VPNClient using the vpngroup

commands on the PIX , client IPs are allocated out of an IP pool.

Using w2K and VPNClient v4.0.1 - everything works fine.

I'm using 10.x.y.z IPs for all my internal networks (including the IP pool) and

I've noticed that when the tunnel is up, the IP netmask on the client is set to

Is this "correct" ?

I'd expect to be able to specify this using a vpngroup command but I

can't find anything in the PIX6.3(1) docs.

Many Thanks,

Cisco Employee

Re: VPNClient V4.0.x and client netmask

The mask is not set anywhere by the VPN client or the VPN termination device. The underlying operating system (Windows) sets this mask automatically, and it simply uses a class A mask for a class A network, etc.

The mask doesn't really matter though. The VPN client simply forwards packets onto the corporate network, these packets will have a source address of whatever IP address the client was given out of the pool. The subnet mask doesn't come into it. As long as your corporate network has a route back to this VPN address that eventually leads back to the PIX, then everything will work.

The only issue this could cause is if you have a local network at your home where the PC is, and it is also a 10.x.x.x network, Windows may end up trying to route local packets over the VPN. Other than that though, the subnet mask really doesn't come into it, so don't worry too much about it.

CreatePlease login to create content