topic Cannot Ping inside network in Network Security https://community.cisco.com/t5/network-security/cannot-ping-inside-network/m-p/1135720#M962926 <P>Hi,</P><P></P><P>I need help with a PIX 501 configuration. Problem is i cannot ping inside network using client VPN.Client VPN version that i am using is 5.0. Attached file is my configuration.Thanks in advance.</P><P></P><P>Regards,</P><P>Christian</P><P></P><P></P><P> </P><P></P> Fri, 21 Feb 2020 11:05:25 GMT cempuerto 2020-02-21T11:05:25Z Cannot Ping inside network https://community.cisco.com/t5/network-security/cannot-ping-inside-network/m-p/1135720#M962926 <P>Hi,</P><P></P><P>I need help with a PIX 501 configuration. Problem is i cannot ping inside network using client VPN.Client VPN version that i am using is 5.0. Attached file is my configuration.Thanks in advance.</P><P></P><P>Regards,</P><P>Christian</P><P></P><P></P><P> </P><P></P> Fri, 21 Feb 2020 11:05:25 GMT https://community.cisco.com/t5/network-security/cannot-ping-inside-network/m-p/1135720#M962926 cempuerto 2020-02-21T11:05:25Z Re: Cannot Ping inside network https://community.cisco.com/t5/network-security/cannot-ping-inside-network/m-p/1135721#M962927 <HTML><HEAD></HEAD><BODY><P>no access-list test permit ip 10.1.1.0 255.255.255.0 192.168.11.0 255.255.255.0</P><P>isakmp nat-traversal</P><P></P></BODY></HTML> Mon, 10 Nov 2008 16:04:44 GMT https://community.cisco.com/t5/network-security/cannot-ping-inside-network/m-p/1135721#M962927 acomiskey 2008-11-10T16:04:44Z Re: Cannot Ping inside network https://community.cisco.com/t5/network-security/cannot-ping-inside-network/m-p/1135722#M962928 <HTML><HEAD></HEAD><BODY><P>Hi Adam,</P><P></P><P>Just curious why the above access-list needs to be removed? Is it not the NAT 0 ACL for the L2L Traffic. </P><P></P><P>crypto map transam 1 ipsec-isakmp</P><P>crypto map transam 1 match address 101</P><P>crypto map transam 1 set peer x.x.x.x</P><P></P><P>access-list 101 permit ip 10.1.1.0 255.255.255.0 192.168.11.0 255.255.255.0</P><P></P><P>Regards,</P><P>Arul</P></BODY></HTML> Mon, 10 Nov 2008 18:20:23 GMT https://community.cisco.com/t5/network-security/cannot-ping-inside-network/m-p/1135722#M962928 ajagadee 2008-11-10T18:20:23Z Re: Cannot Ping inside network https://community.cisco.com/t5/network-security/cannot-ping-inside-network/m-p/1135723#M962929 <HTML><HEAD></HEAD><BODY><P>Oops, my mistake, I stand corrected.</P></BODY></HTML> Mon, 10 Nov 2008 18:22:40 GMT https://community.cisco.com/t5/network-security/cannot-ping-inside-network/m-p/1135723#M962929 acomiskey 2008-11-10T18:22:40Z Re: Cannot Ping inside network https://community.cisco.com/t5/network-security/cannot-ping-inside-network/m-p/1135724#M962931 <HTML><HEAD></HEAD><BODY><P>Hi Chris,</P><P></P><P>After you add this command "isakmp nat-traversal" as per Adam's suggestion and still have issues with connectivity from the VPN Client to the Pix Firewall, can you post the outputs of </P><P></P><P>Show cry is sa </P><P>Show cry ips sa</P><P></P><P>along with the Destination IP Address that you are trying to access. </P><P></P><P>Thanks,</P><P>Arul</P><P></P><P>*Pls rate if it helps*</P></BODY></HTML> Mon, 10 Nov 2008 19:32:57 GMT https://community.cisco.com/t5/network-security/cannot-ping-inside-network/m-p/1135724#M962931 ajagadee 2008-11-10T19:32:57Z Re: Cannot Ping inside network https://community.cisco.com/t5/network-security/cannot-ping-inside-network/m-p/1135725#M962933 <HTML><HEAD></HEAD><BODY><P>Thanks so much for your time. I have solve the problem. I added several commands.</P><P></P><P>name 10.1.2.0 client</P><P>access-list 101 permit ip 10.1.1.0 255.255.255.0 192.168.11.0 255.255.255.0</P><P>access-list NoNAT permit ip 10.1.1.0 255.255.255.0 192.168.11.0 255.255.255.0</P><P>access-list NoNAT permit ip 10.1.1.0 255.255.255.0 client 255.255.255.0</P><P>access-list in_outside permit icmp any any</P><P>access-list outside_cryptomap_dyn_20 permit ip any client 255.255.255.0</P><P></P><P>crypto ipsec transform-set CSB esp-des esp-md5-hmac</P><P>crypto ipsec transform-set myset esp-des esp-md5-hmac</P><P>crypto dynamic-map dynmap 10 match address outside_cryptomap_dyn_20</P><P>crypto dynamic-map dynmap 10 set transform-set myset</P><P>crypto map mymap 10 ipsec-isakmp dynamic dynmap</P><P>crypto map mymap interface outside</P><P></P><P></P><P></P></BODY></HTML> Tue, 11 Nov 2008 01:02:51 GMT https://community.cisco.com/t5/network-security/cannot-ping-inside-network/m-p/1135725#M962933 cempuerto 2008-11-11T01:02:51Z