Comments on: Cisco PIX 506 Config

By: layer9

layer9 — Thu, 03 Nov 2005 19:17:51 +0000

You will also want to rememeber to do a no NAT to for each subnet to the VPN clients virtual IP block for each subnet you want to be able to traverse from the VPN client subnet.

Chris Weber
Layer9corp.com

By: delebute2004

delebute2004 — Thu, 03 Nov 2005 08:12:27 +0000

the ACL’s and your NAT traversals should be in place.
If you do not already have it here is an example of the ACL and NAT statements (substitute your own subnets):

access-list 101 permit ip 192.168.1.0 255.255.255.0 192.168.11.0 255.255.255.0
access-list 102 permit ip 192.168.1.0 255.255.255.0 192.168.11.0 255.255.255.0
nat (inside) 0 access-list 101
isakmp nat-traversal 20

If you have any questions or further problems, you can contact me offline to troubleshoot.

By: mohul123

mohul123 — Thu, 03 Nov 2005 05:45:29 +0000

Hi,

Besides routing i think you should check your ACL that belong to the VPN. The ACL must have “permit” action for both of your subnets.

aner sagi
CISSP