Can a remote client (Network C) VPN intothrough router a Pix (Network A) and access Network B

Posted on 2010-01-04
Last Modified: 2012-05-08
Can a remote client (Network C) VPN into a Pix (Network A) and access network b

Network A = Local LAN
Network B  Remote LAN
Networks A and B connected by 1700 routers
Have a PIX 501 on network A for internet

I can ping network B from the Pix inside interface (network A)
I can NOT access anything from network B when connected to the VPN (Network C)
Internet and Network A access works with the default gateway being the router through the VPN

Heres the configs

1700 Router

interface FastEthernet0
 description XXXXXXX - XXXXXX
 ip address
 ip broadcast-address
 ip helper-address
 no ip mroute-cache
 speed 100
interface Serial0
 description To XXXXXXXXX
 bandwidth 56
 ip address
 no ip mroute-cache
router eigrp 100
 no eigrp log-neighbor-changes
no ip classless
no ip forward-protocol udp nameserver
no ip forward-protocol udp domain
no ip forward-protocol udp time
no ip forward-protocol udp netbios-ns
no ip forward-protocol udp netbios-dgm
no ip forward-protocol udp tacacs
ip route
no ip http server
access-list 1 permit
access-list 1 deny   any
snmp-server community reymon RO


fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol pptp 1723
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
access-list inside_outbound_nat0_acl permit ip
access-list outside_cryptomap_dyn_20 permit ip any
access-list outside_cryptomap_dyn_40 permit ip any
access-list 101 permit ip
ip local pool RemoteVPN
pdm location inside
pdm location inside
global (outside) 1 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0 0
route outside XX.XX.XX.XX 1
route inside 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map client authentication LOCAL
crypto map outside_map interface outside
isakmp enable outside
isakmp nat-traversal 20
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup VPNClient address-pool RemoteVPN
vpngroup VPNClient dns-server
vpngroup VPNClient split-tunnel 101
vpngroup VPNClient idle-time 1800
Question by:williaj2
    LVL 22

    Accepted Solution

    Unfortunately, this isn't going to work on the PIX.  What you're trying to do is have the device route traffic from a VPN tunnel out across another VPN tunnel on the same interface.  The PIX 501 just doesn't have this capability.  If you reversed the roles and had the 1700 as your hub, this wouldn't be a problem though.  The 1700 is a router and can handle this sort of thing where the PIX can't.
    LVL 13

    Expert Comment

    Just a quick question here as i am coming to the same conclusion as Jody but I figured it would be easier to ask a couple of questions.

    Network setup:

    Network B (1700) ----> Network A (1700)--->(ASA)---> Internet (VPN) ---> Network C (1700)

    What type of connection is between the 1700 at network connection A and the 1700 at Network B? Alos if this drawing is inaccurate please update it.



    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    PRTG Network Monitor: Intuitive Network Monitoring

    Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

    When I upgraded my ASA 8.2 to 8.3, I realized that my nonat statement was failing!   The log showed the following error:     %ASA-5-305013: Asymmetric NAT rules matched for forward and reverse flows It was caused by the config upgrade, because t…
    I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
    This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor ( If you're looking for how to monitor bandwidth using netflow or packet s…
    Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

    779 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    9 Experts available now in Live!

    Get 1:1 Help Now