Solved

Need Cisco pix 515e VPN client to access internal+internet with split tunneling

Posted on 2008-06-13
6
319 Views
Last Modified: 2010-04-21
Hi all expert,

I am trying to  do split tunneling so my users can have access to the internal network + to have access to the internet at the same time.
I have tried these commands:
access-list vpnclientip permit ip 192.168.10.0 255.255.255.0 any
vpngroup vpnrad1 split-tunnel vpnclientip
From this link: http://www.experts-exchange.com/Security/Software_Firewalls/Q_21538125.html?sfQueryTermInfo=1+515e+cisco+pix+split+tunnel
Bout it did not work, I get access to internet bout not inside anymore. I had to revert back with the no command

Here is my config as attach code snippet
 
By the way I had no gateway when I did  ipconfig /all

Thanks for all the great work you guys or doing!






PIX Version 6.3(5)

interface ethernet0 auto

interface ethernet1 auto

interface ethernet2 auto

nameif ethernet0 outside security0

nameif ethernet1 inside security100

nameif ethernet2 dmz1 security4

enable password xxxxxxxxxxxxx encrypted

passwd xxxxxxxxxxxxxxxx encrypted

hostname PIX

domain-name finrad.com

clock timezone EST -5

clock summer-time EDT recurring

fixup protocol dns maximum-length 1280

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69

names

name 192.168.10.26 SRV-NS3-DMZ

name 192.168.1.14 SRV-SQL2

name 192.168.1.15 SRV-BCK1

name 192.168.1.5 SRV-SQL1

name 192.168.1.31 SRV-EXCH2

name 192.168.1.24 SRV-DC3

name 192.168.10.24 BARRACUDA

name 192.168.1.71 XEROX

name 192.168.1.16 SRV-APACH1

name 192.168.10.56 SRV-SQL3-DMZ

name 192.168.10.55 SRV-NS2-DMZ

name 192.168.1.9 srv-sql4

name 192.168.1.3 SRV-DC2

name 192.168.1.2 SRV-DC1

name 192.168.10.30 SRV-NS5-DMZ

access-list acl_outbound permit udp any any 

access-list outside deny ip 0.0.0.0 255.0.0.0 any 

access-list outside deny ip 10.0.0.0 255.0.0.0 any 

access-list outside deny ip 127.0.0.0 255.0.0.0 any 

access-list outside deny ip 172.16.0.0 255.240.0.0 any 

access-list outside deny ip 169.254.0.0 255.255.0.0 any 

access-list outside deny ip 192.0.2.0 255.255.255.0 any 

access-list outside permit ip 192.168.200.0 255.255.255.0 any 

access-list outside permit icmp 192.168.200.0 255.255.255.0 any 

access-list outside deny ip 192.168.0.0 255.255.0.0 any 

access-list outside deny ip 224.0.0.0 224.0.0.0 any 

access-list outside permit icmp any any time-exceeded 

access-list outside permit icmp any any echo-reply 

access-list outside permit tcp 192.168.200.0 255.255.255.0 any 

access-list outside permit tcp any host xxx.xxx.xxx.xxx eq smtp 

access-list outside permit tcp any host xxx.xxx.xxx.xxx eq https 

access-list outside permit tcp any host xxx.xxx.xxx.xxx eq https 

access-list outside permit tcp any host xxx.xxx.xxx.xxx eq www 

access-list outside permit tcp any host xxx.xxx.xxx.xxx eq www 

access-list outside permit tcp any host xxx.xxx.xxx.xxx eq ftp 

access-list outside permit tcp any host xxx.xxx.xxx.xxx eq ftp-data 

access-list outside permit tcp any eq 8080 host xxx.xxx.xxx.xxx eq 8080 

access-list outside permit tcp any host xxx.xxx.xxx.xxx eq smtp 

access-list outside permit tcp any host xxx.xxx.xxx.xxx eq domain 

access-list outside permit udp any host xxx.xxx.xxx.xxx eq domain 

access-list inside deny ip any 0.0.0.0 255.0.0.0 

access-list inside deny ip any 10.0.0.0 255.0.0.0 

access-list inside deny ip any 127.0.0.0 255.0.0.0 

access-list inside deny ip any 169.254.0.0 255.255.0.0 

access-list inside deny ip any 224.0.0.0 224.0.0.0 

access-list inside permit icmp 192.168.1.0 255.255.255.0 any 

access-list inside permit ip 192.168.1.0 255.255.255.0 192.168.200.0 255.255.255.0 

access-list inside permit ip 192.168.1.0 255.255.255.0 192.168.10.0 255.255.255.0 

access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq www 

access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq https 

access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 3389 

access-list inside permit udp 192.168.1.0 255.255.255.0 any eq isakmp 

access-list inside permit udp 192.168.1.0 255.255.255.0 any eq 4500 

access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 5900 

access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 5000 

access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 3724 

access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 11999 

access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 43594 

access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 43595 

access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 17185 

access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 8080 

access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 8003 

access-list inside permit udp 192.168.1.0 255.255.255.0 any eq 2300 

access-list inside permit udp 192.168.1.0 255.255.255.0 any eq 2301 

access-list inside permit udp 192.168.1.0 255.255.255.0 any eq 6073 

access-list inside permit udp 192.168.1.0 255.255.255.0 any eq 1863 

access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 1863 

access-list inside permit udp 192.168.1.0 255.255.255.0 any eq 5190 

access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 6891 

access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 6892 

access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 6893 

access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 6894 

access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 6895 

access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 6896 

access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 6897 

access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 6898 

access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 6899 

access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 6900 

access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 3101 

access-list inside permit udp 192.168.1.0 255.255.255.0 any eq 6901 

access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 6901 

access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq nntp 

access-list inside permit udp 192.168.1.0 255.255.255.0 any eq 64520 

access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 28800 

access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 28801 

access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 28802 

access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 28803 

access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 28804 

access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 28805 

access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 9009 

access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq ftp 

access-list inside permit udp 192.168.1.0 255.255.255.0 host xxx.xxx.213.82 eq 5060 

access-list inside permit udp 192.168.1.0 255.255.255.0 host xxx.xxx.213.82 eq 5080 

access-list inside permit udp 192.168.1.0 255.255.255.0 host 66.46.213.84 eq 5060 

access-list inside permit udp 192.168.1.0 255.255.255.0 host 66.46.213.86 eq 5060 

access-list inside permit udp host SRV-DC1 any eq domain 

access-list inside permit tcp host SRV-DC1 any eq domain 

access-list inside permit udp host SRV-DC1 any eq ntp 

access-list inside permit tcp host SRV-DC2 any eq 123 

access-list inside permit tcp host SRV-EXCH2 host SRV-NS3-DMZ eq smtp 

access-list inside permit tcp host XEROX host SRV-NS3-DMZ eq smtp 

access-list inside permit udp host SRV-DC2 any eq domain 

access-list inside permit tcp host SRV-DC2 any eq domain 

access-list inside permit udp host SRV-DC2 any eq ntp 

access-list dmz1 permit ip any 192.168.200.0 255.255.255.0 

access-list dmz1 deny ip any 0.0.0.0 255.0.0.0 

access-list dmz1 deny ip any 10.0.0.0 255.0.0.0 

access-list dmz1 deny ip any 127.0.0.0 255.0.0.0 

access-list dmz1 deny ip any 172.16.0.0 255.240.0.0 

access-list dmz1 deny ip any 169.254.0.0 255.255.0.0 

access-list dmz1 deny ip any 192.168.0.0 255.255.255.0 

access-list dmz1 deny ip any 224.0.0.0 224.0.0.0 

access-list dmz1 permit tcp 192.168.10.0 255.255.255.0 any eq www 

access-list dmz1 permit tcp 192.168.10.0 255.255.255.0 any eq https 

access-list dmz1 permit tcp 192.168.10.0 255.255.255.0 host SRV-DC1 eq 1025 

access-list dmz1 permit udp 192.168.10.0 255.255.255.0 host SRV-DC1 eq domain 

access-list dmz1 permit tcp 192.168.10.0 255.255.255.0 host SRV-DC1 eq domain 

access-list dmz1 permit tcp 192.168.10.0 255.255.255.0 host SRV-DC1 eq ldap 

access-list dmz1 permit udp 192.168.10.0 255.255.255.0 host SRV-DC1 eq 389 

access-list dmz1 permit tcp 192.168.10.0 255.255.255.0 host SRV-DC1 eq 135 

access-list dmz1 permit tcp 192.168.10.0 255.255.255.0 host SRV-DC1 eq 445 

access-list dmz1 permit udp 192.168.10.0 255.255.255.0 host SRV-DC1 eq netbios-dgm 

access-list dmz1 permit tcp 192.168.10.0 255.255.255.0 host SRV-DC2 eq 1025 

access-list dmz1 permit udp 192.168.10.0 255.255.255.0 host SRV-DC2 eq domain 

access-list dmz1 permit tcp 192.168.10.0 255.255.255.0 host SRV-DC2 eq domain 

access-list dmz1 permit udp 192.168.10.0 255.255.255.0 host SRV-DC1 eq ntp 

access-list dmz1 permit udp 192.168.10.0 255.255.255.0 host SRV-DC2 eq ntp 

access-list dmz1 permit icmp any 192.168.0.0 255.255.0.0 time-exceeded 

access-list dmz1 permit icmp any 192.168.0.0 255.255.0.0 echo-reply 

access-list dmz1 permit icmp host SRV-NS5-DMZ host SRV-DC1 echo 

access-list dmz1 permit icmp host SRV-NS2-DMZ host SRV-DC1 echo 

access-list dmz1 permit icmp host SRV-NS3-DMZ host SRV-DC1 echo 

access-list dmz1 permit icmp host SRV-SQL3-DMZ host SRV-DC1 echo 

access-list dmz1 permit icmp host SRV-NS5-DMZ host SRV-DC2 echo 

access-list dmz1 permit icmp host SRV-NS2-DMZ host SRV-DC2 echo 

access-list dmz1 permit icmp host SRV-NS3-DMZ host SRV-DC2 echo 

access-list dmz1 permit icmp host SRV-SQL3-DMZ host SRV-DC2 echo 

access-list dmz1 permit tcp host SRV-NS3-DMZ any eq smtp 

access-list dmz1 permit tcp host BARRACUDA any eq smtp 

access-list dmz1 permit udp host SRV-NS5-DMZ host SRV-DC1 eq 389 

access-list dmz1 permit udp host SRV-NS2-DMZ host SRV-DC1 eq 389 

access-list dmz1 permit udp host SRV-NS3-DMZ host SRV-DC1 eq 389 

access-list dmz1 permit udp host SRV-SQL3-DMZ host SRV-DC1 eq 389 

access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-DC1 eq ldap 

access-list dmz1 permit tcp host SRV-NS2-DMZ host SRV-DC1 eq ldap 

access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC1 eq ldap 

access-list dmz1 permit tcp host SRV-SQL3-DMZ host SRV-DC1 eq ldap 

access-list dmz1 permit udp host SRV-NS5-DMZ host SRV-DC1 eq 88 

access-list dmz1 permit udp host SRV-NS2-DMZ host SRV-DC1 eq 88 

access-list dmz1 permit udp host SRV-NS3-DMZ host SRV-DC1 eq 88 

access-list dmz1 permit udp host SRV-SQL3-DMZ host SRV-DC1 eq 88 

access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-DC1 eq 88 

access-list dmz1 permit tcp host SRV-NS2-DMZ host SRV-DC1 eq 88 

access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC1 eq 88 

access-list dmz1 permit tcp host SRV-SQL3-DMZ host SRV-DC1 eq 88 

access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC1 eq 135 

access-list dmz1 permit tcp host SRV-NS2-DMZ host SRV-DC1 eq 135 

access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-DC1 eq 135 

access-list dmz1 permit tcp host SRV-SQL3-DMZ host SRV-DC1 eq 135 

access-list dmz1 permit udp host SRV-SQL3-DMZ host SRV-DC1 eq 135 

access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-DC1 eq 137 

access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC1 eq 137 

access-list dmz1 permit tcp host SRV-NS2-DMZ host SRV-DC1 eq 445 

access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC1 eq 445 

access-list dmz1 permit tcp host SRV-SQL3-DMZ host SRV-DC1 eq 445 

access-list dmz1 permit tcp host SRV-NS2-DMZ host SRV-DC1 eq 1212 

access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC1 eq 1212 

access-list dmz1 permit tcp host SRV-SQL3-DMZ host SRV-DC1 eq 1212 

access-list dmz1 permit tcp host SRV-NS2-DMZ host SRV-DC1 eq 3268 

access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC1 eq 3268 

access-list dmz1 permit tcp host SRV-SQL3-DMZ host SRV-DC1 eq 3268 

access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-EXCH2 eq 691 

access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-SQL2 eq 1433 

access-list dmz1 permit tcp host SRV-NS5-DMZ host srv-sql4 eq 1433 

access-list dmz1 permit tcp host SRV-NS5-DMZ host srv-sql4 eq 6112 

access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-SQL2 eq 6112 

access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-SQL1 eq 1433 

access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-SQL1 eq 6112 

access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-BCK1 range 10000 10020 

access-list dmz1 permit tcp host SRV-NS2-DMZ host SRV-BCK1 range 10000 10020 

access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-BCK1 range 10000 10020 

access-list dmz1 permit tcp host SRV-SQL3-DMZ host SRV-BCK1 range 10000 10020 

access-list dmz1 permit udp host SRV-NS5-DMZ host SRV-DC2 eq 389 

access-list dmz1 permit udp host SRV-NS2-DMZ host SRV-DC2 eq 389 

access-list dmz1 permit udp host SRV-NS3-DMZ host SRV-DC2 eq 389 

access-list dmz1 permit udp host SRV-SQL3-DMZ host SRV-DC2 eq 389 

access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-DC2 eq ldap 

access-list dmz1 permit tcp host SRV-NS2-DMZ host SRV-DC2 eq ldap 

access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC2 eq ldap 

access-list dmz1 permit tcp host SRV-SQL3-DMZ host SRV-DC2 eq ldap 

access-list dmz1 permit udp host SRV-NS5-DMZ host SRV-DC2 eq 88 

access-list dmz1 permit udp host SRV-NS2-DMZ host SRV-DC2 eq 88 

access-list dmz1 permit udp host SRV-NS3-DMZ host SRV-DC2 eq 88 

access-list dmz1 permit udp host SRV-SQL3-DMZ host SRV-DC2 eq 88 

access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-DC2 eq 88 

access-list dmz1 permit tcp host SRV-NS2-DMZ host SRV-DC2 eq 88 

access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC2 eq 88 

access-list dmz1 permit tcp host SRV-SQL3-DMZ host SRV-DC2 eq 88 

access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC2 eq 135 

access-list dmz1 permit tcp host SRV-NS2-DMZ host SRV-DC2 eq 135 

access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-DC2 eq 135 

access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC2 eq 445 

access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC2 eq 1212 

access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC2 eq 3268 

access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-DC1 eq 8000 

access-list dmz1 permit tcp host SRV-NS2-DMZ host SRV-DC1 eq 8000 

access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC1 eq 8000 

access-list dmz1 permit tcp host SRV-SQL3-DMZ host SRV-DC1 eq 8000 

access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-DC1 eq domain 

access-list dmz1 permit udp host SRV-NS5-DMZ host SRV-DC1 eq domain 

access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-DC2 eq https 

access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-DC2 eq domain 

access-list dmz1 permit udp host SRV-NS5-DMZ host SRV-DC2 eq domain 

access-list dmz1 permit tcp host SRV-NS2-DMZ host SRV-DC2 eq https 

access-list dmz1 permit tcp host SRV-NS2-DMZ range 27000 27009 host SRV-DC2 range 27000 27009 

access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC2 eq https 

access-list dmz1 permit tcp host SRV-SQL3-DMZ host SRV-DC2 eq https 

access-list dmz1 permit tcp host BARRACUDA host SRV-DC1 eq ldap 

access-list dmz1 permit tcp host BARRACUDA host SRV-DC2 eq ldap 

access-list vpnclientacl permit ip any 192.168.200.0 255.255.255.0 

access-list dmz_vpnclientacl permit ip any 192.168.200.0 255.255.255.0 

access-list dmz_nat0_outbound permit ip 192.169.10.0 255.255.255.0 192.168.200.0 255.255.255.0 

access-list dmz_access_in permit ip 192.168.10.0 255.255.255.0 192.168.200.0 255.255.255.0 

pager lines 24

logging on

logging timestamp

logging monitor warnings

logging buffered debugging

logging trap warnings

logging history debugging

logging host inside SRV-DC1

logging host inside SRV-DC2

icmp deny any outside

mtu outside 1500

mtu inside 1500

mtu dmz1 1500

ip address outside xxx.xxx.xxx.xxx 255.255.255.xxx

ip address inside 192.168.1.1 255.255.255.0

ip address dmz1 192.168.10.1 255.255.255.0

ip audit info action reset

ip audit attack action reset

ip local pool vpnclientip 192.168.200.64-192.168.200.127

pdm location 66.46.213.82 255.255.255.255 outside

pdm location 66.46.213.84 255.255.255.255 outside

pdm location 66.46.213.86 255.255.255.255 outside

pdm location SRV-SQL1 255.255.255.255 inside

pdm location SRV-SQL2 255.255.255.255 inside

pdm location SRV-BCK1 255.255.255.255 inside

pdm location SRV-APACH1 255.255.255.255 inside

pdm location SRV-DC3 255.255.255.255 inside

pdm location SRV-EXCH2 255.255.255.255 inside

pdm location 192.168.1.121 255.255.255.255 inside

pdm location BARRACUDA 255.255.255.255 inside

pdm location 192.168.10.0 255.255.255.0 inside

pdm location 192.168.0.0 255.255.0.0 inside

pdm location SRV-NS3-DMZ 255.255.255.255 dmz1

pdm location 0.0.0.0 255.0.0.0 outside

pdm location 10.0.0.0 255.0.0.0 outside

pdm location 61.95.179.130 255.255.255.255 outside

pdm location 127.0.0.0 255.0.0.0 outside

pdm location 169.254.0.0 255.255.0.0 outside

pdm location 172.16.0.0 255.240.0.0 outside

pdm location BARRACUDA 255.255.255.255 outside

pdm location 192.168.200.0 255.255.255.0 outside

pdm location 192.168.0.0 255.255.0.0 outside

pdm location 224.0.0.0 224.0.0.0 outside

pdm location BARRACUDA 255.255.255.255 dmz1

pdm location XEROX 255.255.255.255 inside

pdm location 192.168.0.0 255.255.255.0 inside

pdm location 192.0.2.0 255.255.255.0 outside

pdm location SRV-NS2-DMZ 255.255.255.255 dmz1

pdm location SRV-SQL3-DMZ 255.255.255.255 dmz1

pdm location 24.200.240.249 255.255.255.255 outside

pdm location 24.200.240.248 255.255.255.255 outside

pdm location SRV-APACH1 255.255.255.255 dmz1

pdm location srv-sql4 255.255.255.255 inside

pdm location SRV-DC2 255.255.255.255 inside

pdm location SRV-DC1 255.255.255.255 inside

pdm location 192.168.10.25 255.255.255.255 dmz1

pdm location SRV-NS5-DMZ 255.255.255.255 dmz1

pdm location 192.168.10.50 255.255.255.255 dmz1

pdm location 192.168.200.0 255.255.255.0 inside

pdm location 10.181.1.0 255.255.255.0 dmz1

pdm location 192.169.10.0 255.255.255.0 dmz1

pdm location 172.16.1.0 255.255.255.0 outside

pdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list vpnclientacl

nat (inside) 1 192.168.1.0 255.255.255.0 0 0

nat (dmz1) 0 access-list dmz_vpnclientacl

nat (dmz1) 1 192.168.10.0 255.255.255.0 0 0

static (dmz1,outside) tcp xxx.xxx.xxx.xxx https SRV-NS3-DMZ https netmask 255.255.255.255 500 50 

static (dmz1,outside) tcp xxx.xxx.xxx.xxx smtp BARRACUDA smtp netmask 255.255.255.255 500 50 

static (dmz1,outside) tcp xxx.xxx.xxx.xxxftp SRV-NS5-DMZ ftp netmask 255.255.255.255 0 0 

static (dmz1,outside) tcp xxx.xxx.xxx.xxx ftp-data SRV-NS5-DMZ ftp-data netmask 255.255.255.255 0 0 

static (dmz1,outside) tcp xxx.xxx.xxx.xxx www SRV-NS5-DMZ www netmask 255.255.255.255 0 0 

static (dmz1,outside) tcp xxx.xxx.xxx.xxx https SRV-NS2-DMZ https netmask 255.255.255.255 0 0 

static (dmz1,outside) tcp xxx.xxx.xxx.xxx www SRV-NS2-DMZ www netmask 255.255.255.255 0 0 

static (dmz1,outside) tcp xxx.xxx.xxx.xxx 8080 SRV-NS5-DMZ 8080 netmask 255.255.255.255 0 0 

static (inside,dmz1) 192.168.0.0 192.168.0.0 netmask 255.255.0.0 500 50 

access-group outside in interface outside

access-group inside in interface inside

access-group dmz1 in interface dmz1

route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout sip-disconnect 0:02:00 sip-invite 0:03:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+ 

aaa-server TACACS+ max-failed-attempts 3 

aaa-server TACACS+ deadtime 10 

aaa-server RADIUS protocol radius 

aaa-server RADIUS max-failed-attempts 3 

aaa-server RADIUS deadtime 10 

aaa-server RADIUS (inside) host SRV-DC2 fkP8cd43 timeout 5

aaa-server RADIUS (inside) host SRV-DC1 fkP8cd43 timeout 5

aaa-server LOCAL protocol local 

ntp server SRV-DC1 source inside prefer

http server enable

http SRV-BCK1 255.255.255.255 inside

no snmp-server location

no snmp-server contact

snmp-server community xxxxxx

no snmp-server enable traps

floodguard enable

service resetinbound

service resetoutside

crypto ipsec transform-set vpnclientset esp-3des esp-sha-hmac 

crypto dynamic-map dyn-vpn 30 set transform-set vpnclientset

crypto map pixmap 30 ipsec-isakmp dynamic dyn-vpn

crypto map pixmap client authentication RADIUS 

crypto map pixmap interface outside

isakmp enable outside

isakmp nat-traversal 20

isakmp policy 30 authentication pre-share

isakmp policy 30 encryption 3des

isakmp policy 30 hash md5

isakmp policy 30 group 2

isakmp policy 30 lifetime 86400

vpngroup vpnrad1 address-pool vpnclientip

vpngroup vpnrad1 dns-server SRV-DC1 SRV-DC2

vpngroup vpnrad1 wins-server SRV-DC1 SRV-DC2

vpngroup vpnrad1 default-domain xxxxxxx.com

vpngroup vpnrad1 idle-time 28800

vpngroup vpnrad1 max-time 28800

vpngroup vpnrad1 password ********

telnet SRV-BCK1 255.255.255.255 inside

telnet timeout 30

ssh SRV-BCK1 255.255.255.255 inside

ssh timeout 20

console timeout 0

terminal width 80

Cryptochecksum:xxxxxxxxxxxxxxxxxxxxxxxx

Open in new window

0
Comment
Question by:sdesmarais
  • 4
  • 2
6 Comments
 
LVL 28

Accepted Solution

by:
batry_boy earned 500 total points
ID: 21781072
Try this:

access-list vpnclientip permit ip 192.168.1.0 255.255.255.0 any
vpngroup vpnrad1 split-tunnel vpnclientip
0
 

Author Comment

by:sdesmarais
ID: 21781463
I was so close !
I just had to select the inside interface.

Thanks batry_boy
Here is 500 points more for you :)
0
 

Author Closing Comment

by:sdesmarais
ID: 31466976
Thanks
0
Control application downtime with dependency maps

Visualize the interdependencies between application components better with Applications Manager's automated application discovery and dependency mapping feature. Resolve performance issues faster by quickly isolating problematic components.

 

Author Comment

by:sdesmarais
ID: 21783708
One side effect of these commands, the VPN clients cannot access the DMZ anymore.
I tried to reapply these commands:
access-list dmz_vpnclientacl permit ip any 192.168.200.0 255.255.255.0
nat (dmz1) 0 access-list dmz_vpnclientacl
However, it did not work.

Thanks in advance
0
 
LVL 28

Expert Comment

by:batry_boy
ID: 21787220
Add these commands:

access-list vpnclientip permit ip 192.168.10.0 255.255.255.0 any
nat (dmz1) 0 access-list vpnclientacl

The "nat" command above should be the only nat statement that references the "dmz1" interface.  If you have others, remove them with the "no" form of those commands...
0
 

Author Comment

by:sdesmarais
ID: 21790756
thanks batry_boy  this one is fixed
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
OSPF metric and destination 2 37
Does Cisco ASA 5506-X have full dmz capabilities 3 36
BGP Code 12 41
syslog id vs. msg 2 20
This article offers some helpful and general tips for safe browsing and online shopping. It offers simple and manageable procedures that help to ensure the safety of one's personal information and the security of any devices.
Use of TCL script on Cisco devices:  - create file and merge it with running configuration to apply configuration changes
Need to grow your business through quality cloud solutions? With everything required to build a cloud platform and solution, you may feel like the distance between you and the cloud is quite long. Help is here. Spend some time learning about the Con…
A company’s greatest vulnerability is their email. CEO fraud, ransomware and spear phishing attacks are the no1 threat to a company’s security. Cybercrime is responsible for the largest loss of money to companies today with losses projected to r…

919 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now