I have a PIX 515e that used to only be used for VPN remote access. Now I would like to allow web browsing out as well. This works fine with no access list. But I need to add an ACL to only allow certain address to go out. Ever time I apply the acl the person VPN'ed in can't get anywhere - ping, etc, because its blocked by the ACL. The strange this is that the debug says its blocking something that's allowed specifically in the ACL. Any help would be greatly appreciated. Config below:
object-group network GRP_BRP
description All BRP network
network-object 10.0.0.0 255.0.0.0
network-object 172.16.0.0 255.240.0.0
network-object host 198.212.157.65
network-object 130.1.0.0 255.255.0.0
network-object 193.46.0.0 255.255.0.0
access-list inside_outbound_nat0_acl permit ip any 10.15.0.0 255.255.255.192
access-list outside_cryptomap_dyn_20 permit ip any 10.15.0.0 255.255.255.192
access-list Inside_access_in permit icmp object-group GRP_BRP any echo log 7
access-list Inside_access_in permit tcp any any eq citrix-ica
access-list Inside_access_in permit tcp any any eq 3389
access-list Inside_access_in permit tcp any any eq ftp
access-list Inside_access_in permit tcp any any eq ftp-data
access-list Inside_access_in permit tcp any any eq 3456
access-list Inside_access_in permit tcp any any eq 3026
access-list Inside_access_in permit tcp any any eq 3320
access-list Inside_access_in permit tcp any any eq 6962
access-list Inside_access_in permit tcp any any eq ssh
access-list Inside_access_in permit tcp object-group GRP_BRP Nurun 255.255.255.0 eq www
access-list Inside_access_in permit tcp object-group GRP_BRP Nurun 255.255.255.0 eq https
access-list Inside_access_in permit tcp object-group GRP_BRP remote.transfreight.com 255.255.255.0 eq https
access-list Inside_access_in permit tcp object-group GRP_BRP remote.transfreight.com 255.255.255.0 eq www
access-list Inside_access_in permit tcp object-group GRP_BRP host Upstaging eq www
access-list Inside_access_in permit tcp object-group GRP_BRP host Upstaging eq https
access-list Inside_access_in permit tcp host AWS-Server any eq www
access-list Inside_access_in permit tcp host AWS-Server any eq https
access-list Inside_access_in permit ip host 10.52.106.1 any
ip address outside 195.165.229.162 255.255.255.240
ip address inside 10.15.3.240 255.255.252.0
ip local pool vpnpool 10.15.0.1-10.15.0.50
global (outside) 1 195.165.229.163
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 10.15.0.0 255.255.0.0 0 0
route outside 0.0.0.0 0.0.0.0 195.165.229.161 1
route inside 10.0.0.0 255.0.0.0 10.15.3.254 1
route outside 10.101.0.0 255.255.0.0 195.165.229.162 1
route inside 172.16.0.0 255.255.0.0 10.15.3.254 1
route inside 193.46.0.0 255.255.0.0 10.15.3.254 1
route inside 194.137.0.0 255.255.0.0 10.15.3.254 1
route outside R3G 255.255.255.0 195.165.229.162 1
no floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map client authentication RADIUS LOCAL
crypto map outside_map interface outside
isakmp enable outside
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup VPNUsers address-pool vpnpool
vpngroup VPNUsers dns-server FIRNDC01
vpngroup VPNUsers idle-time 1800
vpngroup VPNUsers password ********
