Re: Pix 501: VPN client connects but Internet doesen't work
Bookmark this page:
 Yahoo!
 Google
 Windows Live
 del.icio.us
 digg
 Netscape
|
|
||||||||||
|
Posted by Jyri Korhonen on August 5, 2008, 6:33 am
Please log in for more thread options vpngroup split-tunnel access-list http://www.cisco.com/en/US/docs/security/pix/pix63/command/reference/tz.html#wp1099471 "Use the vpngroup split-tunnel command to enable split tunneling on the PIX Firewall. Split tunneling allows a remote VPN client or Easy VPN Remote device simultaneous encrypted access to the corporate network and clear access to the Internet. Using the vpngroup split-tunnel command, specify the access list name to which to associate the split tunnelling of traffic. With split tunnelling enabled, the PIX Firewall downloads its local network IP address and netmask specified within the associated access list to the VPN client or Easy VPN Remote device as part of the policy push to the client. In turn, the VPN client or Easy VPN Remote device sends the traffic destined to the specified local PIX Firewall network via an IPSec tunnel and all other traffic in the clear. The PIX Firewall receives the IPSec-protected packet on its outside interface, decrypts it, and then sends it to its specified local network. If you do not enable split tunneling, all traffic between the VPN client or Easy VPN Remote device and the PIX Firewall is sent through an IPSec tunnel. All traffic originating from the VPN client or Easy VPN Remote device is sent to the PIX Firewall's outside interface through a tunnel, and the client's access to the Internet from its remote site is denied." | ||||||||||
> ping the office machines. But internet doesen't work.
>
> vpngroup orbit address-pool v10
> vpngroup orbit dns-server 172.16.1.9
> vpngroup orbit wins-server 172.16.1.11
> vpngroup orbit default-domain orbit
> vpngroup orbit idle-time 1800
> vpngroup orbit password ********