Need Site to Site VPN Help. How to route to a network not directly connected through VPN

You'll need a router behind the PIX on the internal network and point the routes on the PIX to the router on the inside.

Chuck

Yes. The traffic that leaves the ESAFE Proxy is 192.168.100.3 so that is the IP address that will be trying to access 10.4.1/24 .

You won't need any "route" statement for what you have described.

However, your diagram indicates that you need full access from 10.1/16 to 10.4.1/24 . To me, that implies that you want 10.1/16 to go -directly- to 10.4.1/24 instead of having all the activity proxied through the ESafe Proxy at 192.168.100.3.

If you want to somehow bypass the ESAFE Proxy when going to 10.4.1/24 then you will need a LAN router to cross-connect the PIX and the PCs without going through ESAFE, or else you will need to configure ESAFE to pass those particular packets on unchanged; either way, you -would- want a route inside statement on the PIX that pointed 10.1/16 destination traffic through the router (first case) or ESAFE box (second case).