Solved

Cisco Client VPN

Posted on 2007-03-30
5
281 Views
Last Modified: 2010-04-09
We have users using cisco client VPN to connect to our PIX 506E

when connected they cannot access the internet.

I know theres a fix somewhere in the config for this - anyone know what it is thanks?
0
Comment
Question by:chouckham
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
5 Comments
 
LVL 77

Assisted Solution

by:Rob Williams
Rob Williams earned 200 total points
ID: 18823361
By default the Cisco client is configured to not allow "Split-tunneling". This isolates your local network from the VPN, and therefore the corporate network, as an important security feature. As a result it also blocks your local access to the Internet.
Split-tunneling can be enabled, but it has to be done by on the PIX, by the Cisco administrator. It is not recommended.
If you are the admin and looking for the commands somebody else will be along to assist. I am not a "Cisco guy".
0
 
LVL 3

Author Comment

by:chouckham
ID: 18823391
RobWill - thanks - (ill split the solution to give you some of the points.)

Yeah i thought this would be the feature i was looking for. "split-tunneling"

Any one know how to set this up? thanks
0
 
LVL 77

Expert Comment

by:Rob Williams
ID: 18823489
Hang tight, I'm sure someone will be around. It's fairly straight forward, but I don't have a grasp of the commands, and some differ with different OS's.
0
 
LVL 10

Accepted Solution

by:
Sorenson earned 300 total points
ID: 18823624
If this is the only VPN that the pix has on it, then you can use the ACL that is configured for the nat (inside) 0 command to configure the split tunneling.


vpngroup xxxxxxx split-tunnel   access-listnamenumberfromnat0

or if you have multiple vpns and only the split tunnel for this specific group, create an acl
!
access-list splittun permit ip x.x.x.x 255.255.255.0  z.z.z.z 255.255.255.0
!
replace x.x.x.x with your internal subnets, and z.z.z.z with your ip pool addresses (adjust mask lengths to be the correct ones :)  )  add multiple lines for multiple inside subnets.  Then:
!
vpngroup xxxxx split-tunnel splittun
!
hope that helps!



0
 
LVL 77

Expert Comment

by:Rob Williams
ID: 18835794
Thanks chouckham,
Cheers !
--Rob
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Quality of Service (QoS) options are nearly endless when it comes to networks today. This article is merely one example of how it can be handled in a hub-n-spoke design using a 3-tier configuration.
Let’s face it: one of the reasons your organization chose a SaaS solution (whether Microsoft Dynamics 365, Netsuite or SAP) is that it is subscription-based. The upkeep is done. Or so you think.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…

724 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question