Solved

Need Cisco pix 515e VPN client to access internal+internet with split tunneling

Posted on 2008-06-13
6
330 Views
Last Modified: 2010-04-21
Hi all expert,

I am trying to  do split tunneling so my users can have access to the internal network + to have access to the internet at the same time.
I have tried these commands:
access-list vpnclientip permit ip 192.168.10.0 255.255.255.0 any
vpngroup vpnrad1 split-tunnel vpnclientip
From this link: http://www.experts-exchange.com/Security/Software_Firewalls/Q_21538125.html?sfQueryTermInfo=1+515e+cisco+pix+split+tunnel
Bout it did not work, I get access to internet bout not inside anymore. I had to revert back with the no command

Here is my config as attach code snippet
 
By the way I had no gateway when I did  ipconfig /all

Thanks for all the great work you guys or doing!






PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz1 security4
enable password xxxxxxxxxxxxx encrypted
passwd xxxxxxxxxxxxxxxx encrypted
hostname PIX
domain-name finrad.com
clock timezone EST -5
clock summer-time EDT recurring
fixup protocol dns maximum-length 1280
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 192.168.10.26 SRV-NS3-DMZ
name 192.168.1.14 SRV-SQL2
name 192.168.1.15 SRV-BCK1
name 192.168.1.5 SRV-SQL1
name 192.168.1.31 SRV-EXCH2
name 192.168.1.24 SRV-DC3
name 192.168.10.24 BARRACUDA
name 192.168.1.71 XEROX
name 192.168.1.16 SRV-APACH1
name 192.168.10.56 SRV-SQL3-DMZ
name 192.168.10.55 SRV-NS2-DMZ
name 192.168.1.9 srv-sql4
name 192.168.1.3 SRV-DC2
name 192.168.1.2 SRV-DC1
name 192.168.10.30 SRV-NS5-DMZ
access-list acl_outbound permit udp any any 
access-list outside deny ip 0.0.0.0 255.0.0.0 any 
access-list outside deny ip 10.0.0.0 255.0.0.0 any 
access-list outside deny ip 127.0.0.0 255.0.0.0 any 
access-list outside deny ip 172.16.0.0 255.240.0.0 any 
access-list outside deny ip 169.254.0.0 255.255.0.0 any 
access-list outside deny ip 192.0.2.0 255.255.255.0 any 
access-list outside permit ip 192.168.200.0 255.255.255.0 any 
access-list outside permit icmp 192.168.200.0 255.255.255.0 any 
access-list outside deny ip 192.168.0.0 255.255.0.0 any 
access-list outside deny ip 224.0.0.0 224.0.0.0 any 
access-list outside permit icmp any any time-exceeded 
access-list outside permit icmp any any echo-reply 
access-list outside permit tcp 192.168.200.0 255.255.255.0 any 
access-list outside permit tcp any host xxx.xxx.xxx.xxx eq smtp 
access-list outside permit tcp any host xxx.xxx.xxx.xxx eq https 
access-list outside permit tcp any host xxx.xxx.xxx.xxx eq https 
access-list outside permit tcp any host xxx.xxx.xxx.xxx eq www 
access-list outside permit tcp any host xxx.xxx.xxx.xxx eq www 
access-list outside permit tcp any host xxx.xxx.xxx.xxx eq ftp 
access-list outside permit tcp any host xxx.xxx.xxx.xxx eq ftp-data 
access-list outside permit tcp any eq 8080 host xxx.xxx.xxx.xxx eq 8080 
access-list outside permit tcp any host xxx.xxx.xxx.xxx eq smtp 
access-list outside permit tcp any host xxx.xxx.xxx.xxx eq domain 
access-list outside permit udp any host xxx.xxx.xxx.xxx eq domain 
access-list inside deny ip any 0.0.0.0 255.0.0.0 
access-list inside deny ip any 10.0.0.0 255.0.0.0 
access-list inside deny ip any 127.0.0.0 255.0.0.0 
access-list inside deny ip any 169.254.0.0 255.255.0.0 
access-list inside deny ip any 224.0.0.0 224.0.0.0 
access-list inside permit icmp 192.168.1.0 255.255.255.0 any 
access-list inside permit ip 192.168.1.0 255.255.255.0 192.168.200.0 255.255.255.0 
access-list inside permit ip 192.168.1.0 255.255.255.0 192.168.10.0 255.255.255.0 
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq www 
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq https 
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 3389 
access-list inside permit udp 192.168.1.0 255.255.255.0 any eq isakmp 
access-list inside permit udp 192.168.1.0 255.255.255.0 any eq 4500 
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 5900 
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 5000 
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 3724 
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 11999 
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 43594 
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 43595 
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 17185 
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 8080 
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 8003 
access-list inside permit udp 192.168.1.0 255.255.255.0 any eq 2300 
access-list inside permit udp 192.168.1.0 255.255.255.0 any eq 2301 
access-list inside permit udp 192.168.1.0 255.255.255.0 any eq 6073 
access-list inside permit udp 192.168.1.0 255.255.255.0 any eq 1863 
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 1863 
access-list inside permit udp 192.168.1.0 255.255.255.0 any eq 5190 
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 6891 
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 6892 
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 6893 
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 6894 
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 6895 
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 6896 
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 6897 
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 6898 
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 6899 
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 6900 
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 3101 
access-list inside permit udp 192.168.1.0 255.255.255.0 any eq 6901 
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 6901 
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq nntp 
access-list inside permit udp 192.168.1.0 255.255.255.0 any eq 64520 
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 28800 
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 28801 
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 28802 
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 28803 
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 28804 
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 28805 
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq 9009 
access-list inside permit tcp 192.168.1.0 255.255.255.0 any eq ftp 
access-list inside permit udp 192.168.1.0 255.255.255.0 host xxx.xxx.213.82 eq 5060 
access-list inside permit udp 192.168.1.0 255.255.255.0 host xxx.xxx.213.82 eq 5080 
access-list inside permit udp 192.168.1.0 255.255.255.0 host 66.46.213.84 eq 5060 
access-list inside permit udp 192.168.1.0 255.255.255.0 host 66.46.213.86 eq 5060 
access-list inside permit udp host SRV-DC1 any eq domain 
access-list inside permit tcp host SRV-DC1 any eq domain 
access-list inside permit udp host SRV-DC1 any eq ntp 
access-list inside permit tcp host SRV-DC2 any eq 123 
access-list inside permit tcp host SRV-EXCH2 host SRV-NS3-DMZ eq smtp 
access-list inside permit tcp host XEROX host SRV-NS3-DMZ eq smtp 
access-list inside permit udp host SRV-DC2 any eq domain 
access-list inside permit tcp host SRV-DC2 any eq domain 
access-list inside permit udp host SRV-DC2 any eq ntp 
access-list dmz1 permit ip any 192.168.200.0 255.255.255.0 
access-list dmz1 deny ip any 0.0.0.0 255.0.0.0 
access-list dmz1 deny ip any 10.0.0.0 255.0.0.0 
access-list dmz1 deny ip any 127.0.0.0 255.0.0.0 
access-list dmz1 deny ip any 172.16.0.0 255.240.0.0 
access-list dmz1 deny ip any 169.254.0.0 255.255.0.0 
access-list dmz1 deny ip any 192.168.0.0 255.255.255.0 
access-list dmz1 deny ip any 224.0.0.0 224.0.0.0 
access-list dmz1 permit tcp 192.168.10.0 255.255.255.0 any eq www 
access-list dmz1 permit tcp 192.168.10.0 255.255.255.0 any eq https 
access-list dmz1 permit tcp 192.168.10.0 255.255.255.0 host SRV-DC1 eq 1025 
access-list dmz1 permit udp 192.168.10.0 255.255.255.0 host SRV-DC1 eq domain 
access-list dmz1 permit tcp 192.168.10.0 255.255.255.0 host SRV-DC1 eq domain 
access-list dmz1 permit tcp 192.168.10.0 255.255.255.0 host SRV-DC1 eq ldap 
access-list dmz1 permit udp 192.168.10.0 255.255.255.0 host SRV-DC1 eq 389 
access-list dmz1 permit tcp 192.168.10.0 255.255.255.0 host SRV-DC1 eq 135 
access-list dmz1 permit tcp 192.168.10.0 255.255.255.0 host SRV-DC1 eq 445 
access-list dmz1 permit udp 192.168.10.0 255.255.255.0 host SRV-DC1 eq netbios-dgm 
access-list dmz1 permit tcp 192.168.10.0 255.255.255.0 host SRV-DC2 eq 1025 
access-list dmz1 permit udp 192.168.10.0 255.255.255.0 host SRV-DC2 eq domain 
access-list dmz1 permit tcp 192.168.10.0 255.255.255.0 host SRV-DC2 eq domain 
access-list dmz1 permit udp 192.168.10.0 255.255.255.0 host SRV-DC1 eq ntp 
access-list dmz1 permit udp 192.168.10.0 255.255.255.0 host SRV-DC2 eq ntp 
access-list dmz1 permit icmp any 192.168.0.0 255.255.0.0 time-exceeded 
access-list dmz1 permit icmp any 192.168.0.0 255.255.0.0 echo-reply 
access-list dmz1 permit icmp host SRV-NS5-DMZ host SRV-DC1 echo 
access-list dmz1 permit icmp host SRV-NS2-DMZ host SRV-DC1 echo 
access-list dmz1 permit icmp host SRV-NS3-DMZ host SRV-DC1 echo 
access-list dmz1 permit icmp host SRV-SQL3-DMZ host SRV-DC1 echo 
access-list dmz1 permit icmp host SRV-NS5-DMZ host SRV-DC2 echo 
access-list dmz1 permit icmp host SRV-NS2-DMZ host SRV-DC2 echo 
access-list dmz1 permit icmp host SRV-NS3-DMZ host SRV-DC2 echo 
access-list dmz1 permit icmp host SRV-SQL3-DMZ host SRV-DC2 echo 
access-list dmz1 permit tcp host SRV-NS3-DMZ any eq smtp 
access-list dmz1 permit tcp host BARRACUDA any eq smtp 
access-list dmz1 permit udp host SRV-NS5-DMZ host SRV-DC1 eq 389 
access-list dmz1 permit udp host SRV-NS2-DMZ host SRV-DC1 eq 389 
access-list dmz1 permit udp host SRV-NS3-DMZ host SRV-DC1 eq 389 
access-list dmz1 permit udp host SRV-SQL3-DMZ host SRV-DC1 eq 389 
access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-DC1 eq ldap 
access-list dmz1 permit tcp host SRV-NS2-DMZ host SRV-DC1 eq ldap 
access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC1 eq ldap 
access-list dmz1 permit tcp host SRV-SQL3-DMZ host SRV-DC1 eq ldap 
access-list dmz1 permit udp host SRV-NS5-DMZ host SRV-DC1 eq 88 
access-list dmz1 permit udp host SRV-NS2-DMZ host SRV-DC1 eq 88 
access-list dmz1 permit udp host SRV-NS3-DMZ host SRV-DC1 eq 88 
access-list dmz1 permit udp host SRV-SQL3-DMZ host SRV-DC1 eq 88 
access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-DC1 eq 88 
access-list dmz1 permit tcp host SRV-NS2-DMZ host SRV-DC1 eq 88 
access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC1 eq 88 
access-list dmz1 permit tcp host SRV-SQL3-DMZ host SRV-DC1 eq 88 
access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC1 eq 135 
access-list dmz1 permit tcp host SRV-NS2-DMZ host SRV-DC1 eq 135 
access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-DC1 eq 135 
access-list dmz1 permit tcp host SRV-SQL3-DMZ host SRV-DC1 eq 135 
access-list dmz1 permit udp host SRV-SQL3-DMZ host SRV-DC1 eq 135 
access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-DC1 eq 137 
access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC1 eq 137 
access-list dmz1 permit tcp host SRV-NS2-DMZ host SRV-DC1 eq 445 
access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC1 eq 445 
access-list dmz1 permit tcp host SRV-SQL3-DMZ host SRV-DC1 eq 445 
access-list dmz1 permit tcp host SRV-NS2-DMZ host SRV-DC1 eq 1212 
access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC1 eq 1212 
access-list dmz1 permit tcp host SRV-SQL3-DMZ host SRV-DC1 eq 1212 
access-list dmz1 permit tcp host SRV-NS2-DMZ host SRV-DC1 eq 3268 
access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC1 eq 3268 
access-list dmz1 permit tcp host SRV-SQL3-DMZ host SRV-DC1 eq 3268 
access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-EXCH2 eq 691 
access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-SQL2 eq 1433 
access-list dmz1 permit tcp host SRV-NS5-DMZ host srv-sql4 eq 1433 
access-list dmz1 permit tcp host SRV-NS5-DMZ host srv-sql4 eq 6112 
access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-SQL2 eq 6112 
access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-SQL1 eq 1433 
access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-SQL1 eq 6112 
access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-BCK1 range 10000 10020 
access-list dmz1 permit tcp host SRV-NS2-DMZ host SRV-BCK1 range 10000 10020 
access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-BCK1 range 10000 10020 
access-list dmz1 permit tcp host SRV-SQL3-DMZ host SRV-BCK1 range 10000 10020 
access-list dmz1 permit udp host SRV-NS5-DMZ host SRV-DC2 eq 389 
access-list dmz1 permit udp host SRV-NS2-DMZ host SRV-DC2 eq 389 
access-list dmz1 permit udp host SRV-NS3-DMZ host SRV-DC2 eq 389 
access-list dmz1 permit udp host SRV-SQL3-DMZ host SRV-DC2 eq 389 
access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-DC2 eq ldap 
access-list dmz1 permit tcp host SRV-NS2-DMZ host SRV-DC2 eq ldap 
access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC2 eq ldap 
access-list dmz1 permit tcp host SRV-SQL3-DMZ host SRV-DC2 eq ldap 
access-list dmz1 permit udp host SRV-NS5-DMZ host SRV-DC2 eq 88 
access-list dmz1 permit udp host SRV-NS2-DMZ host SRV-DC2 eq 88 
access-list dmz1 permit udp host SRV-NS3-DMZ host SRV-DC2 eq 88 
access-list dmz1 permit udp host SRV-SQL3-DMZ host SRV-DC2 eq 88 
access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-DC2 eq 88 
access-list dmz1 permit tcp host SRV-NS2-DMZ host SRV-DC2 eq 88 
access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC2 eq 88 
access-list dmz1 permit tcp host SRV-SQL3-DMZ host SRV-DC2 eq 88 
access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC2 eq 135 
access-list dmz1 permit tcp host SRV-NS2-DMZ host SRV-DC2 eq 135 
access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-DC2 eq 135 
access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC2 eq 445 
access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC2 eq 1212 
access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC2 eq 3268 
access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-DC1 eq 8000 
access-list dmz1 permit tcp host SRV-NS2-DMZ host SRV-DC1 eq 8000 
access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC1 eq 8000 
access-list dmz1 permit tcp host SRV-SQL3-DMZ host SRV-DC1 eq 8000 
access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-DC1 eq domain 
access-list dmz1 permit udp host SRV-NS5-DMZ host SRV-DC1 eq domain 
access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-DC2 eq https 
access-list dmz1 permit tcp host SRV-NS5-DMZ host SRV-DC2 eq domain 
access-list dmz1 permit udp host SRV-NS5-DMZ host SRV-DC2 eq domain 
access-list dmz1 permit tcp host SRV-NS2-DMZ host SRV-DC2 eq https 
access-list dmz1 permit tcp host SRV-NS2-DMZ range 27000 27009 host SRV-DC2 range 27000 27009 
access-list dmz1 permit tcp host SRV-NS3-DMZ host SRV-DC2 eq https 
access-list dmz1 permit tcp host SRV-SQL3-DMZ host SRV-DC2 eq https 
access-list dmz1 permit tcp host BARRACUDA host SRV-DC1 eq ldap 
access-list dmz1 permit tcp host BARRACUDA host SRV-DC2 eq ldap 
access-list vpnclientacl permit ip any 192.168.200.0 255.255.255.0 
access-list dmz_vpnclientacl permit ip any 192.168.200.0 255.255.255.0 
access-list dmz_nat0_outbound permit ip 192.169.10.0 255.255.255.0 192.168.200.0 255.255.255.0 
access-list dmz_access_in permit ip 192.168.10.0 255.255.255.0 192.168.200.0 255.255.255.0 
pager lines 24
logging on
logging timestamp
logging monitor warnings
logging buffered debugging
logging trap warnings
logging history debugging
logging host inside SRV-DC1
logging host inside SRV-DC2
icmp deny any outside
mtu outside 1500
mtu inside 1500
mtu dmz1 1500
ip address outside xxx.xxx.xxx.xxx 255.255.255.xxx
ip address inside 192.168.1.1 255.255.255.0
ip address dmz1 192.168.10.1 255.255.255.0
ip audit info action reset
ip audit attack action reset
ip local pool vpnclientip 192.168.200.64-192.168.200.127
pdm location 66.46.213.82 255.255.255.255 outside
pdm location 66.46.213.84 255.255.255.255 outside
pdm location 66.46.213.86 255.255.255.255 outside
pdm location SRV-SQL1 255.255.255.255 inside
pdm location SRV-SQL2 255.255.255.255 inside
pdm location SRV-BCK1 255.255.255.255 inside
pdm location SRV-APACH1 255.255.255.255 inside
pdm location SRV-DC3 255.255.255.255 inside
pdm location SRV-EXCH2 255.255.255.255 inside
pdm location 192.168.1.121 255.255.255.255 inside
pdm location BARRACUDA 255.255.255.255 inside
pdm location 192.168.10.0 255.255.255.0 inside
pdm location 192.168.0.0 255.255.0.0 inside
pdm location SRV-NS3-DMZ 255.255.255.255 dmz1
pdm location 0.0.0.0 255.0.0.0 outside
pdm location 10.0.0.0 255.0.0.0 outside
pdm location 61.95.179.130 255.255.255.255 outside
pdm location 127.0.0.0 255.0.0.0 outside
pdm location 169.254.0.0 255.255.0.0 outside
pdm location 172.16.0.0 255.240.0.0 outside
pdm location BARRACUDA 255.255.255.255 outside
pdm location 192.168.200.0 255.255.255.0 outside
pdm location 192.168.0.0 255.255.0.0 outside
pdm location 224.0.0.0 224.0.0.0 outside
pdm location BARRACUDA 255.255.255.255 dmz1
pdm location XEROX 255.255.255.255 inside
pdm location 192.168.0.0 255.255.255.0 inside
pdm location 192.0.2.0 255.255.255.0 outside
pdm location SRV-NS2-DMZ 255.255.255.255 dmz1
pdm location SRV-SQL3-DMZ 255.255.255.255 dmz1
pdm location 24.200.240.249 255.255.255.255 outside
pdm location 24.200.240.248 255.255.255.255 outside
pdm location SRV-APACH1 255.255.255.255 dmz1
pdm location srv-sql4 255.255.255.255 inside
pdm location SRV-DC2 255.255.255.255 inside
pdm location SRV-DC1 255.255.255.255 inside
pdm location 192.168.10.25 255.255.255.255 dmz1
pdm location SRV-NS5-DMZ 255.255.255.255 dmz1
pdm location 192.168.10.50 255.255.255.255 dmz1
pdm location 192.168.200.0 255.255.255.0 inside
pdm location 10.181.1.0 255.255.255.0 dmz1
pdm location 192.169.10.0 255.255.255.0 dmz1
pdm location 172.16.1.0 255.255.255.0 outside
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list vpnclientacl
nat (inside) 1 192.168.1.0 255.255.255.0 0 0
nat (dmz1) 0 access-list dmz_vpnclientacl
nat (dmz1) 1 192.168.10.0 255.255.255.0 0 0
static (dmz1,outside) tcp xxx.xxx.xxx.xxx https SRV-NS3-DMZ https netmask 255.255.255.255 500 50 
static (dmz1,outside) tcp xxx.xxx.xxx.xxx smtp BARRACUDA smtp netmask 255.255.255.255 500 50 
static (dmz1,outside) tcp xxx.xxx.xxx.xxxftp SRV-NS5-DMZ ftp netmask 255.255.255.255 0 0 
static (dmz1,outside) tcp xxx.xxx.xxx.xxx ftp-data SRV-NS5-DMZ ftp-data netmask 255.255.255.255 0 0 
static (dmz1,outside) tcp xxx.xxx.xxx.xxx www SRV-NS5-DMZ www netmask 255.255.255.255 0 0 
static (dmz1,outside) tcp xxx.xxx.xxx.xxx https SRV-NS2-DMZ https netmask 255.255.255.255 0 0 
static (dmz1,outside) tcp xxx.xxx.xxx.xxx www SRV-NS2-DMZ www netmask 255.255.255.255 0 0 
static (dmz1,outside) tcp xxx.xxx.xxx.xxx 8080 SRV-NS5-DMZ 8080 netmask 255.255.255.255 0 0 
static (inside,dmz1) 192.168.0.0 192.168.0.0 netmask 255.255.0.0 500 50 
access-group outside in interface outside
access-group inside in interface inside
access-group dmz1 in interface dmz1
route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+ 
aaa-server TACACS+ max-failed-attempts 3 
aaa-server TACACS+ deadtime 10 
aaa-server RADIUS protocol radius 
aaa-server RADIUS max-failed-attempts 3 
aaa-server RADIUS deadtime 10 
aaa-server RADIUS (inside) host SRV-DC2 fkP8cd43 timeout 5
aaa-server RADIUS (inside) host SRV-DC1 fkP8cd43 timeout 5
aaa-server LOCAL protocol local 
ntp server SRV-DC1 source inside prefer
http server enable
http SRV-BCK1 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community xxxxxx
no snmp-server enable traps
floodguard enable
service resetinbound
service resetoutside
crypto ipsec transform-set vpnclientset esp-3des esp-sha-hmac 
crypto dynamic-map dyn-vpn 30 set transform-set vpnclientset
crypto map pixmap 30 ipsec-isakmp dynamic dyn-vpn
crypto map pixmap client authentication RADIUS 
crypto map pixmap interface outside
isakmp enable outside
isakmp nat-traversal 20
isakmp policy 30 authentication pre-share
isakmp policy 30 encryption 3des
isakmp policy 30 hash md5
isakmp policy 30 group 2
isakmp policy 30 lifetime 86400
vpngroup vpnrad1 address-pool vpnclientip
vpngroup vpnrad1 dns-server SRV-DC1 SRV-DC2
vpngroup vpnrad1 wins-server SRV-DC1 SRV-DC2
vpngroup vpnrad1 default-domain xxxxxxx.com
vpngroup vpnrad1 idle-time 28800
vpngroup vpnrad1 max-time 28800
vpngroup vpnrad1 password ********
telnet SRV-BCK1 255.255.255.255 inside
telnet timeout 30
ssh SRV-BCK1 255.255.255.255 inside
ssh timeout 20
console timeout 0
terminal width 80
Cryptochecksum:xxxxxxxxxxxxxxxxxxxxxxxx

Open in new window

0
Comment
Question by:sdesmarais
  • 4
  • 2
6 Comments
 
LVL 28

Accepted Solution

by:
batry_boy earned 500 total points
ID: 21781072
Try this:

access-list vpnclientip permit ip 192.168.1.0 255.255.255.0 any
vpngroup vpnrad1 split-tunnel vpnclientip
0
 

Author Comment

by:sdesmarais
ID: 21781463
I was so close !
I just had to select the inside interface.

Thanks batry_boy
Here is 500 points more for you :)
0
 

Author Closing Comment

by:sdesmarais
ID: 31466976
Thanks
0
Visualize your virtual and backup environments

Create well-organized and polished visualizations of your virtual and backup environments when planning VMware vSphere, Microsoft Hyper-V or Veeam deployments. It helps you to gain better visibility and valuable business insights.

 

Author Comment

by:sdesmarais
ID: 21783708
One side effect of these commands, the VPN clients cannot access the DMZ anymore.
I tried to reapply these commands:
access-list dmz_vpnclientacl permit ip any 192.168.200.0 255.255.255.0
nat (dmz1) 0 access-list dmz_vpnclientacl
However, it did not work.

Thanks in advance
0
 
LVL 28

Expert Comment

by:batry_boy
ID: 21787220
Add these commands:

access-list vpnclientip permit ip 192.168.10.0 255.255.255.0 any
nat (dmz1) 0 access-list vpnclientacl

The "nat" command above should be the only nat statement that references the "dmz1" interface.  If you have others, remove them with the "no" form of those commands...
0
 

Author Comment

by:sdesmarais
ID: 21790756
thanks batry_boy  this one is fixed
0

Featured Post

Now Available: Firebox Cloud for AWS and FireboxV

Firebox Cloud brings the protection of WatchGuard’s leading Firebox UTM appliances to public cloud environments. It enables organizations to extend their security perimeter to protect business-critical assets in Amazon Web Services (AWS).

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

I recently updated from an old PIX platform to the new ASA platform.  While upgrading, I was tremendously confused about how the VPN and AnyConnect licensing works.  It turns out that the ASA has 3 different VPN licensing schemes. "site-to-site" …
Exchange server is not supported in any cloud-hosted platform (other than Azure with Azure Premium Storage).
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…

749 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question