default gateways for vpn

I have set up my pix 506e (ver. 6.3) to allow locally authenticated, encrypted vpn connections

formatting link
the vpn clients are not able to access any networks other than my internal network when they are connected. No browsing the internet or other such things.

I'm sure there must be a simple solution to this. I tried setting the pool to the same network as my inside interface, but then the vpn doesn't work. Any help is appreciated.

Here are the commands I added to set up the vpn:

access-list 101 permit ip 192.168.1.0 255.255.255.0 192.168.2.0

255.255.255.0 ip local pool vpnpool 192.168.2.1-192.168.2.50 nat (inside) 0 access-list 101 sysopt connection permit-pptp vpdn group 1 accept dialin pptp vpdn group 1 ppp authentication pap vpdn group 1 ppp authentication chap vpdn group 1 ppp authentication mschap vpdn group 1 ppp encryption mppe auto vpdn group 1 client configuration address local vpnpool vpdn group 1 client configuration dns 192.168.1.4 vpdn group 1 pptp echo 60 vpdn group 1 client authentication local vpdn username ******* password ********* vpdn enable outside
Reply to
John Schleigh
Loading thread data ...

In article , John Schleigh wrote: :I have set up my pix 506e (ver. 6.3) to allow locally authenticated, :encrypted vpn connections

:However, the vpn clients are not able to access any networks other than my :internal network when they are connected. No browsing the internet or :other such things.

:I'm sure there must be a simple solution to this.

No, the PIX was designed not to allow that.

If you have 6.3(4) on your 506E, and you can subnet your outside IP range, and your WAN switch or router can handle 802.1Q VLANs and your WAN router can route to VLANs... if -all- of those are true, then you can create a "logical interface" (802.1Q vlan) on the outside interface, assign it a fraction of your address space, and then have your VPN clients connect to one of the logical interfaces whilst your main internet connection is to the other. [I'm not sure if you will be able to PPTP to a logical interface; PPTP might have to go to the underlying physical interface.]

Reply to
Walter Roberson

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.