PIX 506e not adding local access LAN's to clients vpn connection?

I had about 3 weeks now of hunting, and hunting, and well hunting for someone to get an anwser. so i took it upon myself and do some testing. this is what i really need done, ASAP.

ive post a question with no anwser, but

I need to be able and see 3 computers on my biz network, 2 are servers (i can see and browse those) and one is a client comp, that i cant see at all, no matter what i use to see it, i.e., \\clientPC or by ip \\ nor can i ping the computer but  i can access the 2 servers fine with \\server1 or \\server2

behind pix
local ip is
remote vpn
vpn client is

all are static routes but remote which is a pool of about 7 ip of

what is there a man to do but ask for help, please help!

i have no local routes on the client side of the VPN only secured routes
MutogiIT ManagerAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

When you vpn connect you can access both servers but not the workstation PC is this correct?

Have you checked that file and print sharing is enabled on this pc and there is no firewalls turned on (windows, symantec etc..)?
MutogiIT ManagerAuthor Commented:
when i connect to the pix via VPN i can access all files and folders plus join a domain and exchange emails, with ease.  

the pc in question can in fact be accessed inside the network with no problems, i can even access without being on the domain.
Do the workstations use the LAN interface of this PIX as their default gateway, or is that a routing switch and they're pointing there?  

Do you have split tunneling enabled on the PIX?  If so, have you verified that the split tunnel access-list does not have a typo in the subnet mask?  Depending on the server IPs vs the WS IPs, this could cause this very symptom.  --TX
Become an IT Security Management Expert

In today’s fast-paced, digitally transformed world of business, the need to protect network data and ensure cloud privacy has never been greater. With a B.S. in Network Operations and Security, you can get the credentials it takes to become an IT security management expert.

MutogiIT ManagerAuthor Commented:
hope this helps


fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol pptp 1723
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
access-list 100 permit ip
access-list 100 permit ip
access-list 100 permit ip
access-list 101 permit ip any
access-list nonat permit ip
access-list nonat permit ip
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 65.121.xxx.xxx
ip address inside
ip audit info action alarm
ip audit attack action alarm
ip local pool vpnpool
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list 100
nat (inside) 1 0 0
alias (inside) 67.133.xxx.xxx
static (inside,outside) 65.121.xxx.xxx dns netmask
 0 0
static (inside,outside) 65.121.xxx.xxx netmask 0 0

static (inside,outside) 65.121.xxx.xxx dns netmask
 0 0
static (inside,outside) 67.133.xxx.xxx dns netmask
 0 0
conduit permit tcp host 65.121.xxx.xxx eq smtp any

OMITED data but will sanitize if needed

conduit permit tcp host 67.133.xxx.xxx eq 5900 any
route outside 65.121.xxx.xxx 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
sysopt connection permit-pptp
crypto ipsec transform-set myset esp-3des esp-sha-hmac
crypto dynamic-map dynmap 50 set transform-set myset
crypto map pix 99 ipsec-isakmp dynamic dynmap
crypto map pix client configuration address initiate
crypto map pix client configuration address respond
crypto map pix interface outside
isakmp enable outside
isakmp identity address
isakmp nat-traversal 20
isakmp policy 99 authentication pre-share
isakmp policy 99 encryption 3des
isakmp policy 99 hash md5
isakmp policy 99 group 2
isakmp policy 99 lifetime 86400
vpngroup pix address-pool vpnpool
vpngroup pix dns-server
vpngroup pix wins-server
vpngroup pix default-domain local.domain
vpngroup pix split-tunnel 101
vpngroup pix idle-time 3600
vpngroup pix password ********
telnet inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd lease 3600
dhcpd ping_timeout 750
terminal width 80
What is 192.168.150.x/24?  You've got that in your nat0 ACL, but it's not listed anywhere else in your config - just curious - that's not a vlan where your servers are sitting, is it?  --TX
MutogiIT ManagerAuthor Commented:
no i looked around and i dont have any comps with that address?

is that a problem?
No, no problem - just curious what it was doing there.  I thought maybe your servers were on a vlan and we were looking in the wrong place, is all.  

Your problem with not being able to hit hosts from within vpn doesn't appear to be a problem with your pix config.  In fact, I think you're hitting the hosts, but then they can't find their way back to you.  

Have you enabled syslogging to the buffer, logged into vpn, tried pinging hosts, and then watch the buffer log in real time to see what it says?  I bet that traffic is hitting the hosts, and then not coming back from there.


(1) Do the servers and clients all use the same default gateway?  The servers I'm sure are static, so they have their default gateway manually configured.  The clients are probably dhcp, so their default gateway is given to them.  Are those two values the same?

(2) Are they all using the same DNS server(s)?

(3) Are you using WINS in your network?  
If you need to enable logging on that pix, issue these commands:

logging on
logging buffered warnings

Then set a terminal ping from a vpn connected client, and while that's running, issue the "show log" command to see what the log says.  You can spacebar through the log file to view more, and you just keep entering "show log" to view more traffic.  When the log is full of crap, you can enter "clear log", and it'll erase everything and start over.  Won't hurt a thing.  --TX
Also, I see you have a "conduit" statement on your PIX.  The "conduit" command is deprecated, and there are numerous issues with having both conduit and access-list commands on a PIX, it never was supported by Cisco, even when conduits were still used often.  

I recommend changing that conduit command to an access-list, and then use the access-group command to apply the list to the wan interface, just as another thing to check.  If nothing else, it's a best practice to do anyway.  --TX

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
MutogiIT ManagerAuthor Commented:
im not too bright on the conduit to access-list to access-group conversion, i guess i need to know how that is done first and formost.

(1) Do the servers and clients all use the same default gateway?  The servers I'm sure are static, so they have their default gateway manually configured.  The clients are probably dhcp, so their default gateway is given to them.  Are those two values the same?

all w/s and servers are static routes, with the same gateway pointing to the PIX.

(2) Are they all using the same DNS server(s)?

all static routes are pointing to the same place with
DNS2: 63.252.xxx.xxx
DNS3: 63.252.xxx.xxx
in that order

(3) Are you using WINS in your network?  

all WINS are pointing to
MutogiIT ManagerAuthor Commented:
NOTE: PIX has no DNS records in the config, because we have 19 IP address in 3 different blocks.

but the VPN comps all have the same WIN, DNS, and Gateway info
MutogiIT ManagerAuthor Commented:
Is there a way that i can filter internet requests with this PIX??
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Hardware Firewalls

From novice to tech pro — start learning today.