PIX 515 split tunnel

nicholash101 — Fri, 21 Feb 2020 09:18:58 GMT

I just figured this out yesterday and figured I'd share it because I've seen similar problems posted before.

I'm using a PIX515E with OS 6.3(4) and VPN client 4.6 to connect to our corporate site via dynamic VPN.

The problem was that even though I added the split-tunnel to the vpngroup, it still didn't work.

Assume the VPN ip pool is 192.168.0.0/24 and you have two networks on the inside: 192.168.1.0/24 and 192.168.2.0/24. Additionally, you have access-list NoNat nailed to nat 0 inside.

If the access-list is defined thus:

access-list NoNat permit ip any 192.168.0.0 255.255.255.0

and you enable split tunnel in the vpngroup, it won't work.

However, if you redefine the access list like so:

access-list NoNat permit ip 192.168.1.0 255.255.255.0 192.168.0.0 255.255.255.0

access-list NoNat permit ip 192.168.2.0 255.255.255.0 192.168.0.0 255.255.255.0

and add

vpngroup GROUPNAME split-tunnel NoNat

the split tunnel will work.

Evidently the internal networks need to be explicitly defined for split tunnel to work.

topic Re: PIX 515 split tunnel in Network Security

PIX 515 split tunnel

Re: PIX 515 split tunnel