topic Re: PIX and default route for VPN clients? in Network Security

PIX and default route for VPN clients?

fsmontenegro — Mon, 11 Mar 2019 16:38:58 GMT

Hi everyone!

Weird problem on a PIX515 with 7.2.4: adding the "route inside 0.0.0.0 0.0.0.0 <gw> tunneled" fails.

See below:

PIX-1# sh run | inc route

route outside 0.0.0.0 0.0.0.0 x.x.x.x

route inside InternalNets 255.0.0.0 10.255.x.1 1

route inside 192.168.0.0 255.255.0.0 10.255.x.1 1

PIX-1# conf t

PIX-1(config)# route inside 0.0.0.0 0.0.0.0 10.255.x.1 tunneled

ERROR: Cannot add route entry, conflict with existing routes

Any ideas?

Thanks!

Re: PIX and default route for VPN clients?

vikram_anumukonda — Wed, 11 Nov 2009 15:52:32 GMT

it's because you are using a inside interface in the tunneled route and outside interface for the default route.

Check this link:

http://www.cisco.com/en/US/docs/security/asa/asa71/configuration/guide/ip.html#wp1047900

Re: PIX and default route for VPN clients?

acomiskey — Wed, 11 Nov 2009 16:03:19 GMT

What is he doing should work just fine. I use it on a few ASA's myself.

Re: PIX and default route for VPN clients?

fsmontenegro — Wed, 11 Nov 2009 16:05:47 GMT

Hi Vikram,

I'm doing the same thing in an ASA:

route outside 0.0.0.0 0.0.0.0 y.y.y.y 1

route inside 10.0.0.0 255.0.0.0 10.5.x.x 1

route inside 0.0.0.0 0.0.0.0 10.5.x.x tunneled

Could it be a PIX/ASA difference? Something else? Same thing happens with 8.0.4 code as well.

Thanks!

Re: PIX and default route for VPN clients?

acomiskey — Wed, 11 Nov 2009 16:08:16 GMT

Does it complain if you try adding the inside tunneled route first, then the outside route?

Re: PIX and default route for VPN clients?

vikram_anumukonda — Wed, 11 Nov 2009 16:11:18 GMT

are you saying it's working in ASA, if yes then we are only left with PIX/ASA difference.

what version are you running by the way.

Re: PIX and default route for VPN clients?

fsmontenegro — Wed, 11 Nov 2009 16:12:22 GMT

Hi,

Haven't tried that as we were accessing the PIX remotely via outside...

Will try to get someone to test it on-site for us.

Re: PIX and default route for VPN clients?

fsmontenegro — Wed, 11 Nov 2009 16:13:37 GMT

Hi, I have a separate ASA5520 pair running 8.0.4 that is working fine with that configuration.

This particular scenario is another VPN headend, a single PIX515 running 7.2.x (same thing happened with 8.0.x code).

Re: PIX and default route for VPN clients?

vikram_anumukonda — Wed, 11 Nov 2009 17:09:53 GMT

tried to lookup if there are any bugs, but no luck.

strange issue.

Not sure if a reboot would help.

Re: PIX and default route for VPN clients?

vikram_anumukonda — Mon, 16 Nov 2009 07:00:11 GMT

would like to know if you managed to fix this issue.