?
Solved

cisco PIX 501 VPN clients can't ping external net when connected

Posted on 2006-03-26
5
Medium Priority
?
355 Views
Last Modified: 2008-03-10
hi all,
I have a Cisco PIX 501 at an office that users connect to when they're at home.  They are all using the Microsoft VPN client/software built-in to Windows XP Pro.
I went through the setup wizard on the PIX 501 to setup client VPN access; everything seemed to go smoothly.
When clients are connected via VPN to the PIX, everyone can access internal network resources (computer, printers, servers, etc.) just fine.  However, they can't browse the Internet or do anything externally.  After they disconnect the from VPN, Internet works fine again.

When I went through the setup wizard on the PIX, it asked for DNS servers to assign to the clients; I entered the same thing that I assign the computers inside the LAN--
DNS 1:  192.168.1.33 (Win Small Biz Server 2003/domain controller)
DNS 2:  68.13.16.xxx (ISP's DNS server)

If you need more info on the setup, just let me know.  any help is appreciated!! Thanks!
0
Comment
Question by:wotech
  • 3
  • 2
5 Comments
 
LVL 19

Accepted Solution

by:
nodisco earned 2000 total points
ID: 16299274
hi there

I dont' have a pptp client to test this on but if you go into the properties of the pptp client -
click on the networking tab
click on TCP/IP and click properties
Click on advanced
Untick the  "Use default gateway on remote network" checkbox

This should send all your reachable traffic from your client out the internet connection and leave all tunnelled traffic over the tunnel.
Its kind of a "poor mans split-tunnelling"

On that note - if you have CCO - I would definetly recommend using Cisco VPN client over pptp anyday.  Not only for the IPSec security, but because you can deploy the client and have greater control over it on the pix - ie split tunnelling access-lists.  

hth
0
 

Author Comment

by:wotech
ID: 16300773
works like a charm!
thanks.

theoretically, though, shouldn't I be able to route traffic through the remote gateway?
0
 
LVL 19

Expert Comment

by:nodisco
ID: 16300947
<<theoretically, though, shouldn't I be able to route traffic through the remote gateway?

No - a PIX will not redirect traffic out an interface it originated from.  In this case the pptp traffic comes in on the outside interface - and if you wanted to go the internet, it would have to back out the outside interface.  The pix will not allow this.

Glad you got working!
0
 

Author Comment

by:wotech
ID: 16301005
ok
cool, thx for the info

have some points!
0
 
LVL 19

Expert Comment

by:nodisco
ID: 16301044
welcome bro

thank you
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

How to set-up an On Demand, IPSec, Site to SIte, VPN from a Draytek Vigor Router to a Cyberoam UTM Appliance. A concise guide to the settings required on both devices
I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Suggested Courses

840 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question