PIX of Pix VPN easy - Almost there... Need help :(

I spent countless hours now implementing a VPN Pix Pix. I thought I would post this in the hope that someone could help me.

I can get my Pix 501 to open a tunnel to the 506th Pix.  These are both on different ISPS.

I can ping from the Pix to the Pix 501 console 506e inside the IP Interface.

I can ping from the console of the 506th Pix to the Pix 501 inside the IP Interface.

I cannot ping hosts either pix beyond the inside interface.

With the active 7 recording console, I have the following error when ping to the host 172.16.54.5 from the console on the Pix 501.

305005: any group not found for icmp src, dst outside translation: 100.1.1.10 inside: 172.16.54.5 (type 8, code 0)

For reasons of confidentiality, I changed the IP addresses and passwords.

PIX506e outside (isps1): 200.1.1.10
Isps1 Gateway: 200.1.1.1

PIX501 outdoors (PSI): 100.1.1.10
ISP2 Gateway: 100.1.1.1

Here is my configuration:

506th PIX (server)
----------------------------------------------
6.3 (5) PIX version
interface ethernet0 car
Auto interface ethernet1
ethernet0 nameif outside security0
nameif ethernet1 inside the security100
activate the password * encrypted
passwd * encrypted
hostname VPNServer
mydomain.com domain name
clock timezone CST - 6
clock to summer time recurring CDT
fixup protocol dns-length maximum 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol 2000 skinny
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names of
access-list 101 permit icmp any one
IP 172.16.54.0 allow Access - list SHEEP 255.255.255.0 192.168.6.0 255.255.255.0
access-list ip 192.168.6.0 SHEEP allow 255.255.255.0 172.16.54.0 255.255.255.0
access-list 110 permit ip 172.16.54.0 255.255.255.0 192.168.6.0 255.255.255.0
access-list 110 permit ip 192.168.6.0 255.255.255.0 172.16.2.0 255.255.255.0
access-list 110 permit ip 100.1.1.10 host 172.16.2.0 255.255.255.0
pager lines 24
opening of session
Outside 1500 MTU
Within 1500 MTU
IP outdoor 200.1.1.10 255.255.255.128
IP address inside 172.16.54.5 255.255.255.0
alarm action IP verification of information
alarm action attack IP audit
IP local pool vpnpool 172.16.54.201 - 172.16.54.210
history of PDM activate
ARP timeout 14400
Global 1 interface (outside)
NAT (inside) 0 access-list SHEEP
NAT (inside) 1 0.0.0.0 0.0.0.0 0 0
Access-group 110 in the interface inside
Route outside 0.0.0.0 0.0.0.0 200.1.1.1 1
Route inside 172.16.2.0 255.255.255.0 172.16.54.254 1
Timeout xlate 0:05:00
Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225
H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00
Sip timeout - disconnect 0:02:00 prompt Protocol sip-0: 03:00
Timeout, uauth 0:05:00 absolute
GANYMEDE + Protocol Ganymede + AAA-server
AAA-server GANYMEDE + 3 max-failed-attempts
AAA-server GANYMEDE + deadtime 10
RADIUS Protocol RADIUS AAA server
AAA-server RADIUS 3 max-failed-attempts
AAA-RADIUS deadtime 10 Server
AAA-server local LOCAL Protocol
No snmp server location
No snmp Server contact
SNMP-Server Community public
No trap to activate snmp Server
enable floodguard
Permitted connection ipsec sysopt
Crypto ipsec transform-set esp-3des esp-md5-hmac RIGHT
Crypto-map dynamic dynmap 10 transform-set RIGHT
map mymap 10-isakmp ipsec crypto dynamic dynmap
client authentication card crypto LOCAL mymap
mymap outside crypto map interface
ISAKMP allows outside
ISAKMP identity address
ISAKMP nat-traversal 20
part of pre authentication ISAKMP policy 10
ISAKMP policy 10 3des encryption
ISAKMP policy 10 md5 hash
10 2 ISAKMP policy group
ISAKMP life duration strategy 10 86400
vpngroup address vpnpool pool mygroup
vpngroup mygroup 172.16.2.1 dns server
vpngroup mygroup by default-domain mydomain.com
vpngroup idle time 1800 mygroup
mygroup vpngroup password *.
vpngroup idle-idle time 1800
Telnet 0.0.0.0 0.0.0.0 inside
Telnet timeout 5
SSH 0.0.0.0 0.0.0.0 outdoors
SSH 0.0.0.0 0.0.0.0 inside
SSH timeout 5
management-access inside
Console timeout 0
VPDN username myuser password *.
VPDN allow outside
password username myuser * encrypted privilege 2
Terminal width 80
----------------------------------------------

PIX 501 (Client)
----------------------------------------------
6.3 (5) PIX version
interface ethernet0 car
interface ethernet1 100full
ethernet0 nameif outside security0
nameif ethernet1 inside the security100
activate the password * encrypted
passwd * encrypted
vpnclient hostname
mydomain.com domain name
fixup protocol dns-length maximum 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 17
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol 2000 skinny
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names of
access-list 100 permit icmp any one
pager lines 24
opening of session
monitor debug logging
Outside 1500 MTU
Within 1500 MTU
external IP 100.1.1.10 255.255.255.0
IP address inside 192.168.6.1 255.255.255.0
alarm action IP verification of information
alarm action attack IP audit
PDM logging 100 information
history of PDM activate
ARP timeout 14400
Global 1 interface (outside)
NAT (inside) 1 0.0.0.0 0.0.0.0 0 0
Access-group 100 in external interface
Route outside 0.0.0.0 0.0.0.0 100.1.1.1 1
Timeout xlate 0:05:00
Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225
H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00
Sip timeout - disconnect 0:02:00 prompt Protocol sip-0: 03:00
Timeout, uauth 0:05:00 absolute
GANYMEDE + Protocol Ganymede + AAA-server
AAA-server GANYMEDE + 3 max-failed-attempts
AAA-server GANYMEDE + deadtime 10
RADIUS Protocol RADIUS AAA server
AAA-server RADIUS 3 max-failed-attempts
AAA-RADIUS deadtime 10 Server
AAA-server local LOCAL Protocol
Enable http server
http 0.0.0.0 0.0.0.0 inside
No snmp server location
No snmp Server contact
SNMP-Server Community public
No trap to activate snmp Server
enable floodguard
Telnet 192.168.6.0 255.255.255.0 inside
Telnet timeout 30
SSH 0.0.0.0 0.0.0.0 outdoors
SSH 0.0.0.0 0.0.0.0 inside
SSH timeout 30
management-access inside
Console timeout 0
dhcpd address 192.168.6.20 - 192.168.6.200 inside
dhcpd dns 172.16.2.1 172.16.2.2
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd allow inside
vpnclient Server 200.1.1.10
vpnclient mode network-extension-mode
vpnclient mygroup vpngroup password *.
vpnclient username myuser password *.
vpnclient enable
Terminal width 80
----------------------------------------------

assuming that you want to send traffic between the subnet 172.16.54.0/24 and 192.168.6.0/24 in the tunnel.

1 ip local pool vpnpool 172.16.54.201 - 172.16.54.210< please="" use="" ip="" in="" a="" different="" subnet.="" current="" ip="" is="" in="" the="" same="" subnet="" as="" inside="">

' 2. you have not 'need' ip 192.168.6.0 allow access-list SHEEP 255.255.255.0 172.16.54.0 255.255.255.0.

3. do not 501 directly ping, ping from a host behind 501 in subnet 192.168.6.0/24

Tags: Cisco Security

Similar Questions

  • PIX 501 config probs - beginner needs help!

    Have a bit of a nightmare trying to set up external access to one of our servers through the pix. He is currently in its factory config.

    I tried assiginig an Acl to allow the remote desktop on port 4999 from outside, but it doesn't seem to work. I have attached the config in its current form - please help this is driving me crazy!

    1.) basically the NAT public IP address to a private IP address is on the right of ADSL router. Check that!

    ADSL Public IP TCP 4999 to PIX outside TCP 4999

    (2.) the config on the PIX should be good, as I posted it.

    Redirect port of PIX outside IP TCP 4999 inside private IP TCP 4999

    3.) make sure that your server meets the port TCP 4999 really!

    On windows or Unix =

    netstat - year

    You should see something like this:

    TCP 10.0.0.3:4999 0.0.0.0:0 LISTENING

    4.) another way of troubleshhot might be using "capture" on the PIX. This like tcpdump UNIX a sniffer that can show packets on an interface. I do not remember what version, this command was introduced, but you will need at least an OS PIX 6.3.x to have.

    Example:

    access-list 120 permit tcp any any eq 4999

    capture of 4999 interface 120 outdoor access list

    See Access Snapshot 4999 list 120 retail

    To use remove:

    no interface access-list 120 captures 4999 out

    No capture 4999

    Change inside interface:

    capture of 4999 interface 120 of inside access list

    See Access Snapshot 4999 list 120 retail

    sincerely

    Patrick

  • Hi there [need help to download the product]

    I bought adobe professional for students last year and it downloaded on my pc. I just changed my pc and I want to download adobe on the new professional. How can I do? can I use my original code (used the year last on my 1st pc)?

    Thanks a lot for your help.

    [Title edited for clarity... MOD]

    Hi Christine,

    You can download it from:

    Download Acrobat products | Standard, Pro | DC, XI, X

    Please let us know the code in private message.

    I hope this helps.

    Concerning

    Megha Rawat

  • With PAT on Cisco PIX VPN client

    Dear all,

    I have a PIX 515 to the main site with the IPSec security is enabled. Homepage user using 3.x VPN client connects to the PIX for VPN access. When user Home use real IP, I can ping to the local network of the main site. However, when the Home user using a router with PAT, the VPN can be established.

    Is there a setting I should put on PIX, VPN client or router?

    Thank you.

    Doug

    And if you still have problems, upgrade your pix, 6.3 and usage:

    ISAKMP nat-traversal

    But the first thing would be to check the IPSEC passthrough as Ade suggested. If the device is a linksys check the version of the firmware as well.

    Kind regards

  • Simple PIX PIX VPN issues

    I'm trying to implement a simple PIX PIX VPN using the simple PIX - PIX VPN documentation for the sample config page. I have a lot of VPN tunnels with other very happy other PIX devices so it's quite annoying. Anyway, on the source PIX config is as follows:-

    access-list 101 permit ip 172.18.138.0 255.255.255.0 172.18.133.0 255.255.255.0

    access-list 101 permit ip 172.18.133.0 255.255.255.0 172.18.138.0 255.255.255.0

    NAT (phoenix_private) 0-access list 101

    Permitted connection ipsec sysopt

    No sysopt route dnat

    Crypto ipsec transform-set esp - esp-md5-hmac chevelle

    ntlink 1 ipsec-isakmp crypto map

    1 ipsec-isakmp crypto map TransAm

    correspondence address 1 card crypto transam 101

    card crypto transam 1 set peer 172.18.126.233

    card crypto transam 1 transform-set chevelle

    interface inside crypto map transam

    ISAKMP allows inside

    ISAKMP key * address 172.18.126.233 netmask 255.255.255.255

    ISAKMP identity address

    part of pre authentication ISAKMP policy 1

    of ISAKMP policy 1 encryption

    ISAKMP policy 1 md5 hash

    1 1 ISAKMP policy group

    ISAKMP policy 1 lifetime 1000

    and if I generate the traffic logs show this: -.

    9 August 18:40:15 10.60.6.247% PIX-3-305005: no translation not found for icmp src phoenix_private:172.18.138.111 dst domestic group: 172.18.133.51 (type 8, code 0)

    9 August 18:40:17 10.60.6.247% PIX-3-305005: no translation not found for icmp src phoenix_private:172.18.138.111 dst domestic group: 172.18.133.51 (type 8, code 0)

    9 August 18:40:18 10.60.6.247% PIX-3-305005: no group of translation not found for udp src phoenix_private:172.18.138.111/3832 dst inside:172.18.133.51/53

    9 August 18:40:18 10.60.6.247% PIX-3-305005: no translation not found for icmp src phoenix_private:172.18.138.111 dst domestic group: 172.18.133.51 (type 8, code 0)

    9 August 18:40:19 10.60.6.247% PIX-3-305005: no group of translation not found for udp src phoenix_private:172.18.138.111/3832 dst inside:172.18.133.51/53

    No isakmp and ipsec debugging message appears, but you who wait that the PIX does not even link the traffic with the access list or a NAT.

    I do something obviously stupid, can someone tell me what it is, thank you.

    Jon.

    Hello

    1. you create a second access as list:

    outside_cryptomap ip 172.18.138.0 access list allow 255.255.255.0 172.18.133.0 255.255.255.0

    and

    2. instead of

    correspondence address 1 card crypto transam 101

    You must configure

    card crypto transam 1 match address outside_cryptomap

    the problem is that you configure an ACL for nat and crypto - that does not work

    concerning

    Alex

  • On Pix VPN tunnel to the same subnet

    I have a customer who want to set up a the PIX VPN tunnel located on each site. For some reason, each side has the same subnet number, for example. 10.10.10.x/32. I'm sure we must run NAT, but is it possible.

    This can help

    http://www.Cisco.com/en/us/Tech/tk583/TK372/technologies_configuration_example09186a00800949f1.shtml

  • 506th PIX VPN CAAN connect, but no LAN

    Heelo, we have a 506E with 6.3 (3). We want to use Cisco VPN clinet to connect and can do, but cannot ping on the local network or connect to servers... Need help wih configurations because we are novice maybe... Can someone look through the attached config. and see if we have forgotten something... Thank you

    Change your pool outside 192.168.2.0/24.

    IP local pool vpnpool 192.168.x.60 - 192.168.x.63

    Then add an acl of exemption nat for this network.

    access-list sheep permit ip 192.168.2.0 255.255.255.0 255.255.255.0 192.168.x.0

    NAT (inside) 0 access-list sheep

    Then, also change your acl of tunnel from split to reflect the new pool

    permit ip 192.168.2.0 access list SplitTunnel 255.255.255.0 255.255.255.0 192.168.x.0

  • Need help with configuration on cisco vpn client settings 1941

    Hey all,.

    I just bought a new router 1941 SRI and need help with the configuration of the parameters of the VPN client. Orders aspect a little different here, as I'm used to the configuration of ASA and PIX for vpn, routers not...

    If anyone can help with orders?

    I need the installation:

    user names, authentication group etc.

    Thank you!

    Take a peek inside has the below examples of config - everything you need: -.

    http://www.Cisco.com/en/us/products/ps5854/prod_configuration_examples_list.html

    HTH >

    Andrew.

  • The anyconnect vpn easy vpn Remote communication problem

    Hi team,

    I have a problem of communication of the anyconnect vpn easy vpn Remote I´ll explain better below and see the attachment
    topology:

    (1) VPN Tunnel between branch HQ - That´s OK
    (2) VPN Tunnel between Client AnyConnect to HQ - that s OK

    The idea is that the Anyconnect Client is reaching the local Branch Office network, but has not reached.
    Communication is established just when I begin a session (icmp or rdp) branch to the AnyConnect Client,.
    in this way, the communication is OK, but just for a few minutes.

    Could you help me?
    Below the IOS version and configurations

    ASA5505 Version 8.4 (7) 23 (Headquarters)
    ASA5505 Version 7.0000 23 (branch)

    Configuration of the server easy VPN (HQ) *.

    Crypto dynamic-map DYNAMIC - map 5 set transform-set ESP-AES-256-SHA ikev1
    Crypto card outside-link-2_map 1 ipsec-isakmp DYNAMIC-map Dynamics
    Crypto map link-outside-2_map-65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
    Crypto map interface outside-link-2_map outside-link-2

    ACL_EZVPN list standard access allowed 10.0.0.0 255.255.255.0
    ACL_EZVPN list standard access allowed 192.168.1.0 255.255.255.0
    ACL_EZVPN list standard access allowed 192.168.50.0 255.255.255.0
    ACL_EZVPN list standard access allowed 10.10.0.0 255.255.255.0

    internal EZVPN_GP group policy
    EZVPN_GP group policy attributes
    Split-tunnel-policy tunnelspecified
    value of Split-tunnel-network-list ACL_EZVPN
    allow to NEM
    type tunnel-group EZVPN_TG remote access
    attributes global-tunnel-group EZVPN_TG
    Group Policy - by default-EZVPN_GP
    IPSec-attributes tunnel-group EZVPN_TG
    IKEv1 pre-shared-key *.

    object-group network Obj_VPN_anyconnect-local
    object-network 192.168.1.0 255.255.255.0
    object-network 192.168.15.0 255.255.255.0
    object-group network Obj-VPN-anyconnect-remote
    object-network 192.168.50.0 255.255.255.0
    the NAT_EZVPN_Source object-group network
    object-network 192.168.1.0 255.255.255.0
    object-network 10.10.0.0 255.255.255.0
    the NAT_EZVPN_Destination object-group network
    object-network 10.0.0.0 255.255.255.0
     
    destination of Obj_VPN_anyconnect local Obj_VPN_anyconnect-local static NAT (inside, outside-link-2) Obj - VPN static source -.

    Remote AnyConnect VPN - Obj anyconnect-remote non-proxy-arp-search to itinerary
    destination NAT (inside, outside-link-2) static source NAT_EZVPN_Source NAT_EZVPN_Source NAT_EZVPN_Destination static

    NAT_EZVPN_Destination no-proxy-arp-search to itinerary
    NAT (outside-link-2, outside-link-2) static source Obj-VPN-anyconnect-remote Obj-VPN-anyconnect-remote static destination

    NAT_EZVPN_Destination NAT_EZVPN_Destination non-proxy-arp-search route

    Configuration VPN AnyConnect (HQ) *.

    WebVPN
    Select the outside link 2
    by default-idle-timeout 60
    AnyConnect essentials
    AnyConnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 1
    AnyConnect profiles Remote_Connection_for_TS_Users disk0: / remote_connection_for_ts_users.xml
    AnyConnect enable
    tunnel-group-list activate

    tunnel of splitting allowed access list standard 192.168.1.0 255.255.255.0
    tunnel of splitting allowed access list standard 192.168.15.0 255.255.255.0
    tunnel of splitting allowed access list standard 10.0.0.0 255.255.255.0

    internal clientgroup group policy
    attributes of the strategy of group clientgroup
    WINS server no
    value of server DNS 192.168.1.41
    client ssl-VPN-tunnel-Protocol
    Split-tunnel-policy tunnelspecified
    Split-tunnel-network-list value split tunnel
    ipconnection.com.br value by default-field
    WebVPN
    AnyConnect Dungeon-Installer installed
    time to generate a new key 30 AnyConnect ssl
    AnyConnect ssl generate a new method ssl key
    AnyConnect value Remote_Connection_for_TS_Users type user profiles
    AnyConnect ask flawless anyconnect

    type tunnel-group sslgroup remote access
    tunnel-group sslgroup General-attributes
    address vpnpool pool
    authentication-server-group DC03
    Group Policy - by default-clientgroup
    tunnel-group sslgroup webvpn-attributes
    enable IPConnection-vpn-anyconnect group-alias

    object-group network Obj_VPN_anyconnect-local
    object-network 192.168.1.0 255.255.255.0
    object-network 192.168.15.0 255.255.255.0
    object-group network Obj-VPN-anyconnect-remote
    object-network 192.168.50.0 255.255.255.0
    the NAT_EZVPN_Source object-group network
    object-network 192.168.1.0 255.255.255.0
    object-network 10.10.0.0 255.255.255.0
    the NAT_EZVPN_Destination object-group network
    object-network 10.0.0.0 255.255.255.0
     
    destination of Obj_VPN_anyconnect local Obj_VPN_anyconnect-local static NAT (inside, outside-link-2) Obj - VPN static source -.

    Remote AnyConnect VPN - Obj anyconnect-remote non-proxy-arp-search to itinerary
    destination NAT (inside, outside-link-2) static source NAT_EZVPN_Source NAT_EZVPN_Source NAT_EZVPN_Destination static

    NAT_EZVPN_Destination no-proxy-arp-search to itinerary
    NAT (outside-link-2, outside-link-2) static source Obj-VPN-anyconnect-remote Obj-VPN-anyconnect-remote static destination

    NAT_EZVPN_Destination NAT_EZVPN_Destination non-proxy-arp-search route

    Hello

    communication works when you send the traffic of easyvpn derivation because it froms the IPSEC SA to pool local subnet and anyconnect HQ. The SA formed only when the branch initiates the connection as it's dynamic peer connection to HQ ASA.

    When there no SA between branch and HQ for this traffic, HQ ASA has no idea on where to send the anyconnect to network traffic.

    I hope this explains the cause.

    Kind regards

    Averroès.

  • Hey, need help. I get this in my iPhone that 'there is a problem of billing with a previous purchase. Please update your payment method"in any way I can remove my visa card from iTunes

    Hey, need help. I get this in my iPhone that 'there is a problem of billing with a previous purchase. Please update your payment method"anyway I can remove my visa card from iTunes?

    You must pay your debt first.

  • My iPhone's screen is loose and it's almost fall! I need help!

    I need help! How can I do? I need help! How can I do? I need help! How can I do? I need help! The screen was pressed by my body, so the screen is loose. And the screen becomes softer and more flexible. But the screen can be used normally, the screen is loose and it's almost fall.

    Take your iPhone to an Apple Store or Service Center authorized Apple for an assessment and advice how to proceed.

  • I need help to connect my macbook pro to my TV high definition. I just installed the latest update for el capitan, and now all of a sudden not work there.  I use a hdmi cable that has worked for me before.  Any suggestions?

    I need help to connect my macbook pro to my TV high definition. I just installed the latest update for el capitan, and now all of a sudden not work there.  I use a hdmi cable that has worked for me before.  Any suggestions?

    OS X El Capitan: use your TV as a monitor

  • is there a phone number I can contact microsoft on. I need help and forum live gives me no answers

    is there someone I can actually talk about microsoft? my hotmail has been hacked and I need help to get it back! I tried windows live forum coming from running me around, no doubt, that there must be someone who can help me

    Hello

    Answers is a peer group supported and unfortunately has no real influence on Hotmail.

    HotMail has its own Forums, so you can ask your questions there.

    Windows Live Solution Center - HotMail - HotMail Forums Solutions
    http://windowslivehelp.com/

    Hotmail - Forums
    http://windowslivehelp.com/forums.aspx?ProductID=1

    Hotmail - Solutions
    http://windowslivehelp.com/solutions.aspx?ProductID=1

    How to contact Windows Live Hotmail Support
    http://email.about.com/od/hotmailtips/Qt/et_hotmail_supp.htm

    Windows Live Hotmail Top issues and Support information
    http://support.Microsoft.com/kb/316659/en-us

    Compromised account - access unauthorized account - how to recover your account
    http://windowslivehelp.com/solution.aspx?SolutionID=6ea0c7b3-1473-4176-b03f-145b951dcb41

    Hotmail hacked? Take these steps
    http://blogs.msdn.com/b/securitytipstalk/archive/2010/07/07/Hotmail-hacked-take-these-steps.aspx

    I hope this helps.

  • Hi there I need help with my laptop my code is 55385917 please help

    • Hi there, I need help wit my computer hp pavilion laptop it starts just to show enter them administration or turn on password after 3 times the disable password are 55385917 Please HELP ME because THAT ALL MY WORK IS IT ON please

    Groove

    Try: 40083339

    Concerning

    Visruth

  • Need help configuration IOS IPsec to enable communication between the VPN client

    Hi, I need help with the configuration of IPsec VPN router 2811. I want to allow communication between VPN clients, is that possible? I know that ASA, you can do this by using the command "permit same-security-traffic intra-interface".

    The fact is that each Client IP communicator installed, but when they tried to call each other, he failed. I guess that's because the connectivity between them is not permitted because of the VPN connection.

    Thanks in advance...

    Hello

    Try this: -.

    local pool IP 192.168.1.1 ippool 192.168.1.5

    access-list 1 permit host 192.168.1.2< vpn="" ip="" addr="" of="" client="">

    access-list 1 permit host 192.168.1.3< vpn="" ip="" addr="" of="" client="">

    access-list 1 permit 10.10.10.0 0.0.0.255

    < lan="" behind="" the="">

    ISAKMP crypto client configuration group vpnclient

    key cisco123

    ACL 1< binding="" the="" acl="">

    !

    --------Done-------------

    If you do NAT on the router then you might want to exempt your VPN traffic to be NAt had

    Assuming that the NAT of your router is

    overload of IP nat inside source list 111 interface FastEthernet1/0

    !

    ! - The access list is used to specify which traffic

    ! - must be translated to the outside Internet.

    access-list 111 deny ip 10.10.10.0 0.0.0.255 192.168.1.0 0.0.0.255

    access-list 111 deny ip 192.168.1.0 0.0.0.255 192.168.1.0 0.0.0.255

    Above two statements are exempt from nat traffic.

    access-list 111 allow ip 10.10.10.0 0.0.0.255 any<, permits="">

    I would like to know if it worked for you.

    Concerning

    M

Maybe you are looking for