Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Vpn IP Poll

[VPN-CLIENT]----[INTERNET]---[2.2.2.2-PIX-10.10.10.20]-----[10.10.10.1-ROUTER]---[WAN CLOUD 10.10.0.0/16]

....

access-list nonat permit ip any 10.10.10.0  255.255.255.0

ip address inside 10.10.10.20 255.255.255.0

ip local pool ClientVPN 10.10.10.40-10.10.10.45

nat (inside) 0 access-list nonat

nat (inside) 1 172.27.0.0 255.255.0.0 0 0

route inside 10.10.0 255.255.255.0 10.10.10.1 1

route inside 10.10.20.0 255.255.255.0 10.10.10.1 1

route inside 10.10.21.0 255.255.255.0 10.10.10.1 1

.....

My Vpn client can connect successfully to PIX and got ip 10.10.10.40 but i can not ping to network behind PIX , i tried to trace with wireshark and the ping packet reached to PC client inside the WAN  but i got request time out from VPN Client

1206: ICMP echo-request from outside:10.10.10.40 to 10.10.20.5 ID=1 seq=13310 length=40

1207: ICMP echo-reply from inside: 10.10.20.5 to 10.10.10.40 ID=1 seq=13310 length=40

another question is , is it possible to use private subnet for VPN client pool without touch any router configuration , so if i use 192.168.1.0/24 as i pool how the pc on WAN cloud with ips 10.10.20.30 can replay back the packet goes to PIX and sent to VPN client?

  • VPN
2 REPLIES

Vpn IP Poll

You need to use another IP subnet for the VPN pool - using a subset of the inside will not work.

HTH>

New Member

Vpn IP Poll

Ok. thanks , i can reach the network that the same with PIX but i can not reach other network inside , is possible to do NAT so the user on VPN client can reach other network that i can ping from PIX

[VPN CLIENT] --->[2.2.2.2-PIX-10.10.10.20]-->[NET. 10.10.10.0/24]--[CLOUD]--[OTHER NETWORK ie. 10.10.20.0/24]

315
Views
0
Helpful
2
Replies