VPN and wan

In article , wrote: :on a cisco pix 515e, when users connect to VPN, they cannot get to the :internet.. any simple method of allowing them to browse the web while :connected to VPN ?

Two possible answers:

a) Use a split-tunnel on the vpn group definition. The split-tunnel ACL should define the traffic that *will* go through the VPN. It should be written from the point of view of the PIX, sending packets -out- to the VPN clients. Anything that is not "permit" in the split-tunnel will not go through the VPN tunnel, and will instead go directly from the user's LAN to the internet.

b) If the user traffic must go over the VPN to your site before going to the internet, then upgrade to 7.0, which has an option to do what you want.

There are also two possible solutions that involve additional public IP ranges (or subnetting your existing public iP range.)

so according to what you suggest here, i need to give VPN users diferent ip range from what is used in my LAN, correct ? currently, my network is 192.168.0.0, my DHCP (PIX) gives LAN users address between

can that work, or is the only way to assign VPN users a diferent range (like 192.168.1.x) and then tell pix :

access-list 80 permit ip 192.168.1.0 255.255.255.0 192.168.0.0

will that route traffic from those users to 192.168.0.0 and allow them to see their WAN at the same time ?

In article , Tal wrote: :so according to what you suggest here, i need to give VPN users :diferent ip range from what is used in my LAN, correct ?

Right.

:currently, my network is 192.168.0.0, my DHCP (PIX) gives LAN users :address between :192.168.0.50-100, and VPN users get between 192.168.0.100-150.

:can that work,

Sorry, No. Nearly everything on the PIX works by routing, and any destination must be on a different interface than the source [at least in 6.x.] If your VPN users are in the same subnet as the inside interface, then when a packet destined for a VPN user reached the inside interface, the PIX would route, see that that IP range belonged to the inside interface, and would then drop the packet.

In theory you might be able to get something going by using a bunch of host routes for the VPN IPs out the outside interface, but that would probably lead to problems.

:or is the only way to assign VPN users a diferent range :(like 192.168.1.x)

That's certainly the easiest and most reliable approach.

and then tell pix :

:access-list 80 permit ip 192.168.1.0 255.255.255.0 192.168.0.0 255.255.255.0

:will that route traffic from those users to 192.168.0.0 and allow them :to see their WAN at the same time ?

You would want two ACLs:

access-list no_nat_acl permit ip 192.168.0.0 255.255.255.0 192.168.1.0

Yes, in this instance the two ACLs have the same content, but do not try to use the same ACL name!