VPN Client Cannot Access LAN

Apr 11, 2005 2 Replies

All,



I have tried to solve this but cannot, any help would be appreciated.



Network is:



|------PIX-----Internet Router------Remote VPN Client | LAN| | ------Router (Default Gateway for LAN Hosts) Upto now the VPN clients have been logging in successfully to the PIX and accessing resources on the LAN. The DHCP scope handed out by the PIX though was in the same range as the LAN.



LAN is 10.0.0.0 255.255.255.0



VPN CLients via DHCP with old range: 10.0.0.225 to 10.0.0.238 with SM of



255.255.255.240

We have decided to change DHCP pool of clients to 10.0.50.0



255.255.255.0 and changed the nonat statement on the PIX to reflect the new range. NB My colleague who did this didn't remove the old no-nat statememt to 10.0.0.224 255.255.255.240 and I was concerned this may have been one issue when we tested the config.

The LAN router has an IP of 10.0.0.254 /24. It has a default route to the PIX 10.0.0.179 /24.



My problem: When the VPN isers log in they get an IP in the range of



10.0.50.X but they cannot ping or connect to anything on the LAN. The LAN router is running RIP Version 2 (network 10.0.0.0).

Any ideas



Regards


Darren


Darren,

Have you debug'd the PIX..'logging trap debugging' and watched the connection attempts. Don't do this to the buffer if this is a busy box, hence the trap/logging server. (option#2 "logging buffered debugging")

another note: Debug ip packet on the router - router(confg)#int fa0/0 (whatever interface) router(config-if)# no ip route-cache

router(config)#access-list 101 permit ip source (etc..) destination(etc..)

router#debug ip packet 101 det

  1. See if you are getting through the pix
  2. See if the packet is hitting the router
  3. See if the packets are returning...etc..

let us know /mike

Have the exact same issue with one of my users, and I've discovered that the issue lays in the fact that the router doesn't allow L2TP and PPP passthru'

You might want to take a look at that !!!

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required