Cisco vpn connects but has limited connection

Try adding the following command:

isakmp nat-traversal

Added the line and I have the same result. It connects but I have no access to the network.

Does anyone have any suggestions?

I added the above and it seems to be working now. I can get to the network without any problem but I did notice that the connection shows that I am connected to an unidentified network as before it show I was connected to our AHSAA network. Not sure if that matters? Also I would like to have it that the client has internet access locally when he is connected to the vpn.

I don't think it matters any, and I believe it's something Windows specific that I don't know much about.
I'll try to look around..

Meanwhile, the latter request can be achieved by configuring split-tunnel:

access-l SplitTunnelAcl permit ip 10.2.0.0 255.255.255.0 10.2.0.144 255.255.255.240
vpngroup ASHAA split-tunnel SplitTunnelAcl
vpngroup ASHAA-VPN split-tunnel SplitTunnelAcl

(Provided you wanna do it for both groups .. I dunno which one you use)

I added the configuration for split-tunnel and I still can not get on the internet.

If you rightclick the vpn-icon in the systray while connectec, and choose statistcs then click route details tab.
Did the tunnel split correctly?

And if so, are you able to ping 64.233.183.147?

I have nothing under Local LAN Routes and 0.0.0.0 under Secured Routes.

And I can not ping 64.233.183.147.

Something is wrong then, you should not have 0.0.0.0 in secured routes with split-tunnel on.
Could you double check, and maybe paste the config here?  Just "sh vpngroup" & "sh access-l SplitTunnelAcl"

Oh yeah, you may try to experience with "allow local LAN access" in the transport tab of the VPN client (during modify connection).  I've never had to enable it, but have heard of some that did.

Another thing you may try is to enable logging in the client, and set IKE to level 3 (high) - disable all other.  Open log window and try connect.
Somewhere you should see lines like this if you receive split-tunnel info:


29     20:15:58.355  03/22/09  Sev=Info/5      IKE/0x63000010
MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_ADDRESS: , value = 192.168.1.151

30     20:15:58.355  03/22/09  Sev=Info/5      IKE/0x6300000D
MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SPLIT_INCLUDE (# of split_nets), value = 0x00000001

31     20:15:58.355  03/22/09  Sev=Info/5      IKE/0x6300000F
SPLIT_NET #1
      subnet = 192.168.1.0
      mask = 255.255.255.0
      protocol = 0
      src port = 0
      dest port=0
---
Just for the record.. what OS are you using, and what version of client?

See results  of sh:

vpngroup AHSAA-VPN dns-server 10.2.0.10 10.2.0.5
vpngroup AHSAA-VPN wins-server 10.2.0.10
vpngroup AHSAA-VPN default-domain ahsaa.net
vpngroup AHSAA-VPN idle-time 1800
vpngroup AHSAA-VPN password ********
vpngroup AHSAA address-pool ahsaa-pool
vpngroup AHSAA dns-server 10.2.0.10 10.2.0.5
vpngroup AHSAA wins-server 10.2.0.10
vpngroup AHSAA default-domain ahsaa.net
vpngroup AHSAA idle-time 1800
vpngroup AHSAA password ********
vpngroup ASHAA split-tunnel SplitTunnelAcl
vpngroup ASHAA idle-time 1800
vpngroup ASHAA-VPN split-tunnel SplitTunnelAcl
vpngroup ASHAA-VPN idle-time 1800

access-list SplitTunnelAcl; 1 elements
access-list SplitTunnelAcl line 1 permit ip 10.2.0.0 255.255.255.0 10.2.0.144 255.255.255.240 (hitcnt=0)

I'm using windows vista Ultimate and Cisco 4.8.01.0590 client.  

"allow local LAN access" did not work. See log results below:
log.txt

Odd, that should work..  Kinda puts it down to grasping at straws.  I usually advocate 1 ACL, 1 Purpose so maybe it was wrong to say to apply the same one to both groups.  And I notice they display idle-time twice, which looks odd too.
Since only 1 of them have an address pool, I assume only that one is being used.  I'd say kill them both, and recreate the used one:

clear vpngroup
vpngroup AHSAA address-pool ahsaa-pool
vpngroup AHSAA dns-server 10.2.0.10 10.2.0.5
vpngroup AHSAA wins-server 10.2.0.10
vpngroup AHSAA default-domain ahsaa.net
vpngroup AHSAA idle-time 1800
vpngroup AHSAA password ********
vpngroup ASHAA split-tunnel SplitTunnelAcl
>then kill any dynamic SAs
clear crypto isak sa


If that doesn't help, I'd say try a reboot of the PIX and/or upgrade your VPN client.  For the latter you might have to extend your transformset.
For reference, here's the interesting part of a working config, used from a Vista with client 5.0.02.0090

access-list nonat permit ip any 192.168.1.144 255.255.255.240
access-list splitTunnelAcl permit ip 192.168.1.0 255.255.255.0 192.168.1.144 255.255.255.240
ip local pool VPNPool 192.168.1.151-192.168.1.160
nat (inside) 0 access-list nonat
sysopt connection permit-ipsec
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-AES-128-SHA ESP-3DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map client authentication LOCAL
crypto map outside_map interface outside
isakmp enable outside
isakmp identity address
isakmp nat-traversal 20
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup Pix address-pool VPNPool
vpngroup Pix split-tunnel splitTunnelAcl
vpngroup Pix idle-time 1800
vpngroup Pix password ********

I made the changes and now I cannot connect at all. I then changed it back to the way it was and I still can not connect. Attach is my VPN log.
newlog.txt

Got the old config working by resetting the password but still can not get local internet to work. I will reboot the PIX tomorrow when I get to the office.

I rebooted the PIX and the split-tunnel is still not working but now I can't connect to my exchange server (10.2.0.5). I can't even ping it but I can ping other items on the network. I no that it is working because I can connect to it from windows vpn that is setup on that machine and from outlook web. I have reattached my config file:

Building configuration...
: Saved
:
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password hZSro8eQr1VtlHLB encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname ahsaa-pix
domain-name ahsaa.net
clock timezone CST -6
clock summer-time CDT recurring
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol pptp 1723
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 66.0.21.0 ASD
name 66.0.21.146 ASD-External
name 12.129.20.0 MEHS-1
name 12.129.199.61 MEHS-2
name 12.129.219.155 MEHS-3
name 63.214.222.0 MEHS-4
name 206.16.57.70 MEHS-6
name 65.55.251.0 MEHS-5
name 213.199.154.0 MEHS-9
name 213.244.175.0 MEHS-10
name 207.46.51.64 MEHS-7
name 207.46.163.0 MEHS-8
name 216.32.180.0 MEHS-11
name 216.32.181.0 MEHS-12
name 76.12.24.44 AHSAA-DB
name 65.55.88.0 MEHS-13
object-group service mail tcp
  description sss
  port-object eq www
  port-object eq https
  port-object eq pop3
object-group service DNS udp
  port-object eq nameserver
  port-object eq www
  port-object eq domain
object-group service RDP tcp
  port-object range 3389 3389
object-group network MEHS
  network-object MEHS-1 255.255.255.0
  network-object MEHS-2 255.255.255.255
  network-object MEHS-3 255.255.255.255
  network-object MEHS-4 255.255.255.0
  network-object MEHS-5 255.255.255.192
  network-object MEHS-6 255.255.255.255
  network-object MEHS-7 255.255.255.192
  network-object MEHS-8 255.255.255.0
  network-object MEHS-9 255.255.255.0
  network-object MEHS-10 255.255.255.0
  network-object MEHS-11 255.255.255.0
  network-object MEHS-12 255.255.255.0
  network-object MEHS-13 255.255.255.0
access-list inside_access_in permit tcp host 10.2.0.5 any object-group mail
access-list inside_access_in permit tcp any any
access-list inside_access_in permit icmp any any
access-list inside_access_in permit ip any any
access-list inside_access_in permit udp any any
access-list inside_access_in permit tcp host 10.2.0.118 any
access-list outside_access_in permit tcp any host xx.xx.xx.xx object-group RDP
access-list outside_access_in permit tcp object-group MEHS host xx.xx.xx.xx eq smtp
access-list outside_access_in permit tcp any host xx.xx.xx.xx object-group mail
access-list outside_access_in permit icmp any any
access-list outside_access_in permit tcp host ASD-External any
access-list outside_access_in permit ip host ASD-External any
access-list outside_access_in permit udp host ASD-External any
access-list outside_access_in permit udp any object-group DNS any object-group DNS
access-list outside_access_in permit tcp host AHSAA-DB host xx.xx.xx.xx eq smtp
access-list outside_access_in permit gre any any
access-list outside_access_in permit tcp any host xx.xx.xx.xx eq ftp
access-list outside_access_in permit tcp any host xx.xx.xx.xx eq pptp
access-list nonat permit ip any 10.2.0.144 255.255.255.240
access-list SplitTunnelAcl permit ip 10.2.0.0 255.255.255.0 10.2.0.144 255.255.255.240
pager lines 24
logging on
logging timestamp
logging console debugging
logging trap errors
icmp permit any outside
icmp permit any inside
mtu outside 1500
mtu inside 1500
ip address outside xx.xx.xx.xx 255.255.255.248
ip address inside 10.2.0.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool ahsaa-pool 10.2.0.151-10.2.0.160 mask 255.255.255.0
pdm location 10.2.0.5 255.255.255.255 inside
pdm location ASD 255.255.255.192 outside
pdm location ASD-External 255.255.255.255 outside
pdm location 10.2.0.20 255.255.255.255 inside
pdm location MEHS-1 255.255.255.0 outside
pdm location MEHS-2 255.255.255.255 outside
pdm location MEHS-3 255.255.255.255 outside
pdm location MEHS-4 255.255.255.0 outside
pdm location MEHS-5 255.255.255.192 outside
pdm location MEHS-6 255.255.255.255 outside
pdm location MEHS-7 255.255.255.192 outside
pdm location MEHS-8 255.255.255.0 outside
pdm location MEHS-9 255.255.255.0 outside
pdm location MEHS-10 255.255.255.0 outside
pdm location MEHS-11 255.255.255.0 outside
pdm location MEHS-12 255.255.255.0 outside
pdm location AHSAA-DB 255.255.255.255 outside
pdm location 10.2.0.118 255.255.255.255 inside
pdm location 10.2.0.11 255.255.255.255 inside
pdm location MEHS-13 255.255.255.0 outside
pdm location 10.2.0.144 255.255.255.240 outside
pdm group MEHS outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list nonat
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) xx.xx.xx.xx 10.2.0.5 netmask 255.255.255.255 0 0
static (inside,outside) xx.xx.xx.xx 10.2.0.118 netmask 255.255.255.255 0 0
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 xx.xx.xx.xx 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 0.0.0.0 0.0.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
sysopt connection permit-pptp
sysopt connection permit-l2tp
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
isakmp enable outside
isakmp nat-traversal 20
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
vpngroup AHSAA-VPN dns-server 10.2.0.10 10.2.0.5
vpngroup AHSAA-VPN wins-server 10.2.0.10
vpngroup AHSAA-VPN default-domain ahsaa.net
vpngroup AHSAA-VPN idle-time 1800
vpngroup AHSAA-VPN password ********
vpngroup AHSAA address-pool ahsaa-pool
vpngroup AHSAA dns-server 10.2.0.10 10.2.0.5
vpngroup AHSAA wins-server 10.2.0.10
vpngroup AHSAA default-domain ahsaa.net
vpngroup AHSAA idle-time 1800
vpngroup AHSAA password ********
vpngroup ASHAA split-tunnel SplitTunnelAcl
vpngroup ASHAA idle-time 1800
vpngroup ASHAA-VPN split-tunnel SplitTunnelAcl
vpngroup ASHAA-VPN idle-time 1800
telnet 0.0.0.0 0.0.0.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
username ahsaa password YNzHJGzoM380G46q encrypted privilege 5
username AHSAA-VPN password xB3qFhMTE.FRmpi9 encrypted privilege 5
username ahsaa-admin password GmGTAXHrAy8bfgx5 encrypted privilege 5
terminal width 80
Cryptochecksum:d6ce049618a3ce02d2ed76c6aa5f1999
: end
[OK]

Rebooted server and pix and now i can ping my exchange server but still no local internet when connected to vpn. Not sure what to check from here.

Hm, the vpngroup statements still look a bit odd.. there's still reuse of the same acl, and idle-time appears twice for both.  I won't ask you to clear it all again, as it sounds like you had problems with that but maybe clear just what stings the eyes :)

I assume you are using the group AHSAA and not AHSAA-VPN, since only the former have address-pool.
Then please also remove the split-tunnel from AHSAA-VPN, so that it's only used once.

no vpngroup ASHAA-VPN split-tunnel SplitTunnelAcl

And see if you can get rid of the double appearance of idle-time:
no vpngroup ASHAA idle-time 1800
---
Other than that did you try to upgrade the VPN client?
Have you tried from some client not running Vista maybe?