Solved

Cisco PIX 506e + Cisco VPN Client 4.03

Posted on 2004-10-13
15
911 Views
Last Modified: 2013-11-16
Following this:
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a0080093f89.shtml

I was able to setup a VPN connection, however I am unable to browse the remote network.

Any ideas / help on how to troubleshoot this?
0
Comment
Question by:just1coder
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 9
  • 6
15 Comments
 
LVL 79

Expert Comment

by:lrmoore
ID: 12299691
Do you have internal DNS/WINS servers?
Are they properly identified in the vpngroup config?
Did you use a separate IP subnet for your clients than your local LAN?

Can you paste your config?

You can try adding a LMHOSTS file with domain controller identified...

0
 
LVL 2

Author Comment

by:just1coder
ID: 12299703
Sorry, I should have been more specific. I *can* browse to the remote LAN servers via IP address, but not hostname.

Is there a particular part of the config?

LMHOSTS ?
0
 
LVL 2

Author Comment

by:just1coder
ID: 12299722
The remote LAN has internal DNS - no WINS.

There is a seperate submet for the VPN clients.
0
Threat Trends for MSPs to Watch

See the findings.
Despite its humble beginnings, phishing has come a long way since those first crudely constructed emails. Today, phishing sites can appear and disappear in the length of a coffee break, and it takes more than a little know-how to keep your clients secure.

 
LVL 79

Expert Comment

by:lrmoore
ID: 12299876
Try adding a LMHOSTS file on your PC. You only need the two entries for the Domain Controller:

http://support.microsoft.com/kb/180094/EN-US/
0
 
LVL 2

Author Comment

by:just1coder
ID: 12299950
Great - thanks

Is there anything I can do to allow the VPN, as well as the normal traffic simultaneously?

Whenever I open the VPN it drops all of my other connections.
0
 
LVL 79

Accepted Solution

by:
lrmoore earned 70 total points
ID: 12300029
Use the split-tunnel acl and only define traffic from your local lan to the VPN client subnet

Example:

   access-list split_tunnel_acl permit ip <local lan> mask <client subnet> mask
  vpngroup split-tunnel split_tunnel_acl

0
 
LVL 2

Author Comment

by:just1coder
ID: 12300227
OK, looking good! But now when I have my connection established, and another user connects my connection is dropped.
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 12301357
That's not good...
How many IP addresses are there in your VPN address pool?
0
 
LVL 2

Author Comment

by:just1coder
ID: 12301519
Thanks for you help!! If I had more pts I would certianly assign them :)

For the IP pool, I used: 10.99.99.0 - 10.99.99.255

On another note, adding this to the config seems to have aced my existing PIX-to-PIX config :o

nat (inside) 0 access-list no_nat <-- that was changed to: nat (inside) 0 access-list 101
nat (inside) 1 0.0.0.0 0.0.0.0 0 0

coudl I have just added it as:
nat (inside) 2 access-list 101?

Thank goodness for backups.
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 12301567
I'd have to see your complete config, but I'll try to explain
<you can always buy points>

You need multiple entries in your nat 0 acl. Combine both the VPN clients and the remote site LAN-LAN vpn:

   access-list 101 permit ip <local subnet> mask <remote subnet> mask
   access-list 101 permit ip <local subnet> mask 10.99.99.0 255.255.255.0
   nat (inside) 0 access-list 101
                    ^^
                   This MUST be a zero
0
 
LVL 2

Author Comment

by:just1coder
ID: 12301668
I see. Thanks. I will give that a go.
0
 
LVL 2

Author Comment

by:just1coder
ID: 12309761
I went through the examples line for line and was able to get both working successfully, however I still have the problem where I can not have more than 1 user connected to the VPN at the same time.
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 12309825
Do you have nat-traversal enabled?

 isakmp nat-traversal 20  
0
 
LVL 2

Author Comment

by:just1coder
ID: 12309974
No - will try now.
0
 
LVL 2

Author Comment

by:just1coder
ID: 12310036
Excellent, thank you!
0

Featured Post

DevOps Toolchain Recommendations

Read this Gartner Research Note and discover how your IT organization can automate and optimize DevOps processes using a toolchain architecture.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Wikipedia defines 'Script Kiddies' in this informal way: "In hacker culture, a script kiddie, occasionally script bunny, skiddie, script kitty, script-running juvenile (SRJ), or similar, is a derogatory term used to describe those who use scripts or…
The DROP (Spamhaus Don't Route Or Peer List) is a small list of IP address ranges that have been stolen or hijacked from their rightful owners. The DROP list is not a DNS based list.  It is designed to be downloaded as a file, with primary intention…

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question