Cisco VPN version 3.6.3(A): Printing to a local TCP/IP network printer

Thanks, I was hoping you were watching, and would give me some advice, lrm...  :)

Is Split-tunneling allowed on the PIX with the clients?<<     Not sure, but I will check tomorrow.
Is 'allow local LAN access' box checked on the client?<<     Yes, I have enabled this checkbox, and no change.
I think your PIX admin is smoking something. You can upgrade your client to latest 4.7 if you want to without changing anything on the PIX. What version OS is running on the PIX?<<     *grin*  I agree!

I do know that once the VPN is established, I cannot ping the local Printer's IP address.  I have tried using IPX, and although it works on the old 98 clients (running the VPN client), I cannot print via IPX at all on the XP clients.

The gentleman that administers this network is an long-time CNE guy, that has resisted any changes to the network from the beginning of time.  You know the type...  Personally, I would like to install a hardware appliance at the remote locations, and create hardware to hardware VPNs, but they tell me it is not in the budget...  I can get a heck of a price on 80 Cisco 501's, but, they still won't spring for it...

I will see if version 4.7 corrects this tomorrow, and get back to you.

Thanks again for stopping in and helping, lrmoore!

FE

just stumbling around... hope I can help you out..

If they won't spring for PIX 501's how about Linksys RV042's ?

One more question. The Client's home LAN with the local printer - does it just happen to be the same as the lan IP subnet on the other end of the VPN tunnel??? If yes, then you have but one choice - change the local LAN IP subnet to be different..

Good question, Lrm..   No, I purposefully setup the 'home' locations with a Class C scheme, whereas we are running Class B at corporate...  

Linksys RV042?  have not used one of these before..  are they compatible with PIX concentrators?  (I know that you can purchase firmware upgrades for WiFi Linksys models, and that they can be used to connect to the concentrator...)

This was an interesting read..

http://www.experts-exchange.com/Networking/Broadband/VPN/Q_21135245.html

You really stuck with him on this question...  talk about perseverence!

But, the bottom line is that we shouild be able to print to our local TCP printers (by the way, these use external Jetdirect hardware) using the current hardware, but different client software...  

I might have the 4.7 client somewhere on my network, so I will take a look and see if I can find it, then test from here...

Lrm..  you don't have a link for 4.7, do you?  I thought that I could download it directly from Cisco, but my CCNA does not give me that privelege...  :(

I could get you a link on Friday, but I'm away from home this week and no way to post it up..

No problem, lrm..  we can wait till then, while I try to find a way around this...

could you tell me what to look for in the running config, or how to enable 'split tunneling' with a command?  (although they don't give me access to the PIX, I will look for a saved copy on the IT secure server, where I do have access...)

If split-tunneling is enabled, there will be a command in the vpngroup like this:
  vpngroup GROUPNAME split-tunnel <Access-list>

It probably doesn't matter one way or other for this particular issue, just trying to get a big picture..
The bigger issue could be the same IP subnets on both ends of the VPN... You didn't answer that question.

>>The bigger issue could be the same IP subnets on both ends of the VPN... You didn't answer that question.>>

Nope, we are using 172.16.x.x / 16 at Corporate, whereas I am using a Class C 192.168.1.x at our remote locations.

Here is a question for you though...  I noticed that once I enable the VPN, I cannot ping the local IP Address of the Jetdirect Printer.  The print job spools, and when I disconnect from the VPN, then it prints, and I assume this is because it can finally 'see' the TCP printer.

So, when the VPN is enabled, should I be able to ping resources on the local subnet?  
Is there a way I can setup routes to these resources so I can route these packets to the proper location?

I should know the answers to these questions, but for the life of me I cannot get myself around it!

FE

No routing will help at all. Local addresses are just that - local and no route needed.
If split-tunneling is not enabled, then ALL ip traffic will be forced down the tunnel - probably including local subnet traffic.
VPN concentrators and the new ASA5500 has more options for controlling the behavior of the VPN client, but the PIX only provides basic connectivity..

Thanks.  I got our account information from our CIO today and downloaded the 4.7 client.  It worked flawlessly, but did not help my situation, as you probably already know...    The CNE admin will eat a little crow tomorrow..

I am going to dig a little deeper tomorrow and see if I can find anything that looks like split tunneling on our concentrator..  (BTW:  I did find out today that we are using a Cisco Concentrator, not the PIX, for our VPN...)

Take care..  it looks like you are going to have a 'white' Xmas coming to your area of the country..  :)

I wouldn't count on a white Christmas south of the Mason Dixon line...
I'm in Arizona today, but back in Alabama tomorrow...

Cheers!

..

Got em!  Thanks, lrm!

One more question...  is there a setting on a Cisco VPN Concentrator that specifically allows Lan Access?  (the other side of the client 'allow local LAN access')

That is what I was looking for!  Thanks again for all your help!

I am going to leave this open over the weekend, in case I have another question, but I think that was what I was missing...