VPN on router bypassing the Firewall

[Shobith K]

I have a scenario like this...

We have local lan 10.x.x.x connecting to internet through a pix firewall and A cisco router.

Router has vpn 3des software in it. I want to configure ROUTER as VPN server, for remote access users to connect to LAN using their vpn client

Configuration on the router is done. Users are able to connect to the vpn using their vpn client. BUT they are not able to access any local LAN resources since PIX comes between the router and LAN.

Can u tell me what i have to do on the firewall side to make this scenario work.

i am attatching the network diagram

[piseli]

You have to permit incomming traffic from the VPN pool network into the Local netwotk 10.x.x.x behind the PIX.

access-list acs-outside permit ip VPNPool-IPRange 255.255.255.0 PIX-Inside-IP-Range 255.255.255.0

access-group acl_outside in interface outside

route outside VPNPool-IPRange 255.255.255.0 VPN-Router

access-list NONAT permit ip PIX-Inside-IP-Range 255.255.255.0 VPNPool-IPRange 255.255.255.0

nat (inside) 0 access-list NONAT

should be something like this, but be aware that you opens a big security hole in your PIX as you permit all VPN Clients to connect behind the firewall.

Be sure that you have a tight access-list on your VPN Router.

sincerly

Patrick