You can't assign a netmask to this. The VPN client will automatically assign a classful mask depending on what class the IP address is in. For example, it will assign 255.0.0.0 for a 10.0.0.0 address, 255.255.0.0 for a class B address and so on. This is the same functionality whether you connect to a PIX, a router or a VPN3000.