VPN client can't access different internal subnet

[1qaz2wsx1qaz]

Hi All,

I am using pix 7.0 and vpn client 4.8

When I connect with the vpn client I can see the subnet behind the pix (10.61.1.0)

However there is a router on this subnet that connects to two other sites (10.61.2.0 and 10.72.2.0)

I can ping from the pix command line to these subnets.

When I connect using the vpn client I can only see the subnet behind the pix and not the other two subnets?

I have a route command 10.0.0.0 255.0.0.0 10.61.1.250 (router ip address)on the pix but this does not seem to help?

The response from a ping is request timed out to either or the other subnets.

Any suggestions on what route I need to add or is there an ACL that needs to be added?

Current routes and acls are:

0.0.0.0 0.0.0. ISP router address

10.0.0.0 255.0.0.0 10.61.1.250

access-list Outside_access_in extended permit icmp any any

access-list inside_nat0 extended permit ip 10.61.1.0 255.255.255.0 10.61.1.224 255.255.255.240

nat (inside) 0 access-list inside_nat0

nat (inside) 10 0.0.0.0 0.0.0.0

access-group Outside_access_in in interface Outside

All responses appreciated.

[aashish.c]

Hi

You need to check the following :

1) crypto ACL on the PIX. ACL should include 10.61.2.0 and 10.72.2.0.

2) On router, there should be routes to reach back to VPN client. whatever pool is assigned to VPN clients, router should be able to reach them.

3) In your NAT0 acl also, mention those 2 subnets.

I hope after checking the above mentioned, this issue would be resolved.

regards

aashish C

[1qaz2wsx1qaz]

Thanks for the tips aashish,

Still not working, I thought to make it easier to troubleshoot I would only work on one other subnet.

I have configured the VPN pool to use ip's from the 10.61.1.0 subnet so as eliminate any routing problems from the router.

Current settings are

Current routes and acls are:

0.0.0.0 0.0.0. ISP router address

10.0.0.0 255.0.0.0 10.61.1.250

access-list Outside_access_in extended permit icmp any any

access-list inside_nat0 extended permit ip 10.61.1.0 255.255.255.0 10.61.1.224 255.255.255.240

access-list inside_nat0 extended permit ip any 10.0.0.0 255.0.0.0

nat (inside) 0 access-list inside_nat0

nat (inside) 10 0.0.0.0 0.0.0.0

access-group Outside_access_in in interface Outside

access-list Outside_cryptomap_dyn_20 extended permit ip any 10.61.1.224 255.255.255.240

access-list Outside_cryptomap_dyn_20 extended permit ip any 10.0.0.0 255.0.0.0

Am I still missing something?

Regards

Ty

[jackko · Accepted solution]

firstly, and most importantly, the vpn client pool should not be overlapped with the asa inside subnet, or any connected subnet.

internet <--> asa <--> (10.61.1.250) router <--> 10.61.2.0 and 10.72.2.0

access-list inside_nat0 extended permit ip 10.61.1.0 255.255.255.0

access-list inside_nat0 extended permit ip 10.61.2.0 255.255.255.0

access-list inside_nat0 extended permit ip 10.72.2.0 255.255.255.0

access-list Outside_cryptomap_dyn_20 extended permit ip 10.61.1.0 255.255.255.0

access-list Outside_cryptomap_dyn_20 extended permit ip 10.61.2.0 255.255.255.0

access-list Outside_cryptomap_dyn_20 extended permit ip 10.72.2.0 255.255.255.0

further, a static route needs to be configured on the 10.61.1.250 router:

ip route <

[1qaz2wsx1qaz]

Hi Jacko,

Thanks for the help, everything is working fine.

Regards

ty

[yana]

If vpn client initiate a session to 10.61.2.0,pix can create a xlate for this,so static route to vpn client pool on 10.61.1.250router is not necessary，is it true？

[rico_hao40]

You need that static route on router. xlate created by pix only for pix checking the back packets and bypassing inside ACL. router still need that static route to send packets back to pix.