Cisco VPN and Port Forward Issue

All,
I have a Cisco PIX I have setup for VPN and Port Forwarding. I am forwarding two ports, web server and terminal services, to a server on the internal network. My problem is when I attempt to access terminal server or web server of that server while connected to VPN, I am unable to to connect.

Is it possible to connect to those ports if I am forwarding from my public IP address also?

Thanks,
Tareef
TareefAAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

lrmooreCommented:
Are you trying to access these by their public IP that you have static xlates for?
Are you using IP address or DNS name?
Yes, it should be possible to access those ports through the VPN even though you have static nat.
Are you using a different IP subnet for your clients than the inside network?
Can you access anything else on the network while connected via VPN?
Do you have any access-groups assigned to the inside interface?
Do you have split-tunneling enabled?
0
TareefAAuthor Commented:
Hello lrmoore,
Answers below:

Are you trying to access these by their public IP that you have static xlates for? No, private/internal
Are you using IP address or DNS name? tried both
Are you using a different IP subnet for your clients than the inside network? Yes, inside is 10.0.0.0, client vpn network is 10.1.0.0
Can you access anything else on the network while connected via VPN? Yes, anything not using port forwarding
Do you have any access-groups assigned to the inside interface? Yes, allowing all traffic from VPN client network
Do you have split-tunneling enabled? Yes

Thanks
0
lrmooreCommented:
>Do you have any access-groups assigned to the inside interface? Yes, allowing all traffic from VPN client network
Can you post your acl?
0
Choose an Exciting Career in Cybersecurity

Help prevent cyber-threats and provide solutions to safeguard our global digital economy. Earn your MS in Cybersecurity. WGU’s MSCSIA degree program was designed in collaboration with national intelligence organizations and IT industry leaders.

TareefAAuthor Commented:
Here is my acl:

access-list inside_outbound_nat0_acl permit ip any 192.168.3.0 255.255.255.0
access-list outside_cryptomap_dyn_40 permit ip any 192.168.3.0 255.255.255.0
access-list 103 permit icmp any any
access-list splitvpn permit ip 192.168.0.0 255.255.255.0 192.168.1.0 255.255.255.224
access-list splitvpn permit ip 192.168.1.0 255.255.255.0 192.168.3.0 255.255.255.224

Thanks,
Tareef
0
lrmooreCommented:
None of those will be applied to the inside interface...

Hint: don't use "any" in the vpn specific acls. Assuming inside lan is 192.168.1.0 and VPN client pool is 192.168.3.0:

access-list inside_outbound_nat0_acl permit ip 192.168.1.0 255.255.255.0 192.168.3.0 255.255.255.0
access-list outside_cryptomap_dyn_40 permit ip 192.168.1.0 255.255.255.0 192.168.3.0 255.255.255.0
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
TareefAAuthor Commented:
I think that worked.

Thanks!
Tareef
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Software Firewalls

From novice to tech pro — start learning today.