Can login to VPN session but can't access network.

[mcoxtstna]

I have been having this problem for about a month now. We are using a PIX 515E as our VPN device. This has been in place for years but last month something must have changed that won't allow me to access the network from a VPN connection.

I can login to the VPN from a remote location, however I cannot ping anything on the local network or access any devices. Our local network IP scheme is 10.6.x.x. The IP address given from the PIX for a VPN session is the in the 10.6.5.x range. Our subnet is 255.255.0.0.

Can anyone give me help as to what to look at to fix it? I haven't worked with a VPN or PIX before.

[mcoxtstna]

The DHCP from the VPN are from the 255.255.255.0 subnet.

The access statement I have found is this: access-list nonat extended permit ip 10.6.0.0 255.255.0.0 10.6.5.0 255.255.255.0

[ajay chauhan]

HI Matt,

/16 is big range and 10.6.5.0/24 will be covered under that. Please change the IP range for VPN pool and this will solve your issue. Inside range and VPN pool should not be in same range.

Thanks

Ajay

[mcoxtstna]

Thanks for the answer. So what should I change the IP range to?

[ajay chauhan]

Hi Matt,

It can be any range for ex. 192.168.10.0/24 but should not fall same as LAN network configured on ASA.

Thanks

Ajay

[rizwanr74]

Please make sure this accee-list is still applied for no-nat as follows...

nat (inside) 0 access-list nonat

Also please make sure, there is a static route on your local network forwarding the (VPN DHCP scope) traffic to firewall inside interface.

let me know the results.

thanks

Rizwan Rafeek

[mcoxtstna]

The PIX is directly connected to the network. Does it still need a route fowarding the VPN traffic?

[ajay chauhan]

Hi Matt,

I do not understand route forwarding you are relating with. However if you mean any route then not required. You just need to take care of VPN pool and NAT exempt .

Thanks

Ajay

[rizwanr74]

VPN traffic is located at the PIX itself (therefore you need a static route on the local inside network to push VPN traffic toward inside PIX's ip address), however if your internal network segment is only segment connected to inside interface of PIX on subnet 10.6.0.0 255.255.0.0, then you do not need a static route on the PIX to push internal traffic toward inside the network, i.e. assuming you have only segment connected to inside pix interface is on: 10.6.0.0 255.255.0.0

If you have network 10.6.0.0 255.255.0.0 is segmented in the local network (i.e. more than one subnet), then it is wise to have a static route on PIX to push all internal local segments to peering ip address of the inside interface. i.e. not the IP address on the PIX but rather peering IP address appears on the switch.

For ease of trouble shooting please post your config on the forum.

Thanks

Rizwan Rafeek