The VPN user cannot browse the internet

Similar Questions

• ASA 5520: Remote VPN Clients cannot ping LAN, Internet

  I've set up a few of them in my time, but I am confused with this one.  Can I establish connect via VPN tunnel but I can't ping or go on the internet.  I searched the forum for similar and found a little issues, but none of the fixes seem to match.  I noticed a strange thing is when I run ipconfig/all of the vpn client, the IP address that has been leased over the Pool of the VPN is also the default gateway!

  I have attached the config.  Help, please.

  Thank you!

  Exemption of NAT ACL has not yet been applied.

  NAT (inside) 0-list of access Inside_nat0_outbound

  In addition, you have not split tunnel, not sure you were using internet ASA for the vpn client internet browsing.

  You can also enable icmp inspection if you test in scathing:

  Policy-map global_policy
  class inspection_default

  inspect the icmp

  Hope that helps.

• Remote VPN users cannot reach OSPF Inter networks

  Hi all

  Area0 & Grenier1. Grenier1 ASA has remote VPN configuration where users also use split tunneling. When the VPN plug-in users, accessing all respurces successfully in the area euro1, but unable to reach Area0 resources.

  But Area0 PCs can 'ping' on addresses IP VPN component software plug-in. I tried 'debug icmp trace', but not poping up even one message upwards all to initiate the 'ping' of the computer laptop VPN users.

  FYI... Grenier1 N/w: 10.251.0.0/16 and 10.251.40.0/24 has been used for VPN DHCP users. Everything works well except for the Area0 accessibility.

  Any suggestions... ?

  Thank you

  MS

  access-list extended sheep ip SiteA 255.255.0.0 255.255.255.0 SiteAVPN allow

  access-list extended sheep ip SiteB 255.255.0.0 255.255.255.0 SiteAVPN allow

• AnyConnect VPN users cannot access remote subnets?

  I googled this until blue in the face without result.  I don't understand why Cisco this so difficult?  When clients connect to the anyconnect vpn, they can access the local subnet, but cannot access the resources in remote offices.  What should I do to allow my anyconnect vpn clients access to my remote sites?

  Cisco 5510 8.4

  Hello

  What are remote sites using as Internet gateway? Their default route here leads to the ASA or have their own Internet gateway? If they use this ASA for their Internet connection while they should already have a default route that leads traffic to the VPN to the pool, even if they had no specific route for the VPN itself pool. If they use their own local Internet gateway and the default route is not directed to this ASA then you would naturally have a route on the remote site (and anything in between) indicating the remote site where to join the pool of 10.10.224.0/24 VPN network.

  In addition to routing, you must have configured for each remote site and the VPN pool NAT0

  Just a simple example of NAT0 configuration for 4 networks behind the ASA and simple VPN field might look like this

  object-group network to REMOTE SITES

  object-network 10.10.10.0 255.255.255.0

  object-network 10.10.20.0 255.255.255.0

  object-network 10.10.30.0 255.255.255.0

  object-network 10.10.40.0 255.255.255.0

  network of the VPN-POOL object

  10.10.224.0 subnet 255.255.255.0

  NAT static destination DISTANCE-SITES SITES source (indoor, outdoor) REMOTE static VPN-VPN-POOL

  The above of course assumes that the remote site are located behind the interface 'inside' (although some networks, MPLS) and naturally also the remote site networks are made for the sake of examples.

  Since you are using Full Tunnel VPN should be no problem to the user VPN transfer traffic to this ASA in question.

  My first things to check would be configuring NAT0 on the ASA and routing between remote sites and this ASA (regarding to reach the VPN pool, not the ASA network IP address)

  Are you sure that the configuration above is related to this? Its my understanding that AnyConnect uses only IKEv2 and the foregoing is strictly defined for IKEv1?

  -Jouni

• Urgent issue: remote vpn users cannot reach server dmz

  Hi all

  I have an asa5510 firewall in which remote vpn client users can connect but they cannot ping or access the dmz (192.168.3.5) Server

  They also can't ping the out interface (192.168.2.10), below is the show run, please help.

  SH run

  ASA5510 (config) # sh run
  : Saved
  :
  : Serial number: JMX1243L2BE
  : Material: ASA5510, 256 MB RAM, Pentium 4 Celeron 1599 MHz processor
  :
  ASA 5,0000 Version 55
  !
  Majed hostname
  activate the encrypted password of UFWSxxKWdnx8am8f
  2KFQnbNIdI.2KYOU encrypted passwd
  names of
  DNS-guard
  !
  interface Ethernet0/0
  nameif outside
  security-level 0
  IP 192.168.2.10 255.255.255.0
  !
  interface Ethernet0/1
  nameif inside
  security-level 100
  192.168.1.10 IP address 255.255.255.0
  !
  interface Ethernet0/2
  nameif servers
  security-level 90
  192.168.3.10 IP address 255.255.255.0
  !
  interface Ethernet0/3
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface Management0/0
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  boot system Disk0: / asa825-55 - k8.bin
  passive FTP mode
  permit same-security-traffic inter-interface
  permit same-security-traffic intra-interface
  acl_outside to access extended list ip 192.168.5.0 allow 255.255.255.0 192.168.1.0 255.255.255.0
  acl_outside list extended access allow icmp 192.168.5.0 255.255.255.0 192.168.1.0 255.255.255.0
  acl_outside of access allowed any ip an extended list
  acl_outside list extended access permit icmp any one
  acl_inside list extended access allowed host ip 192.168.1.150 192.168.5.0 255.255.255.0
  acl_inside list extended access allowed host icmp 192.168.1.150 192.168.5.0 255.255.255.0
  acl_inside list extended access allowed host ip 192.168.1.200 192.168.5.0 255.255.255.0
  acl_inside list extended access allowed host icmp 192.168.1.200 192.168.5.0 255.255.255.0
  acl_inside list extended access allowed host ip 192.168.1.13 192.168.5.0 255.255.255.0
  acl_inside list extended access allowed host icmp 192.168.1.13 192.168.5.0 255.255.255.0
  acl_inside to access ip 192.168.1.0 scope list allow 255.255.255.0 host 192.168.3.5
  acl_inside list extended access allow icmp 192.168.1.0 255.255.255.0 host 192.168.3.5
  acl_inside list extended access deny ip 192.168.1.0 255.255.255.0 192.168.5.0 255.255.255.0
  acl_inside list extended access deny icmp 192.168.1.0 255.255.255.0 192.168.5.0 255.255.255.0
  acl_inside of access allowed any ip an extended list
  acl_inside list extended access permit icmp any one
  acl_server of access allowed any ip an extended list
  acl_server list extended access permit icmp any one
  Local_LAN_Access list standard access allowed 10.0.0.0 255.0.0.0
  Local_LAN_Access list standard access allowed 172.16.0.0 255.240.0.0
  Local_LAN_Access list standard access allowed 192.168.0.0 255.255.0.0
  access-list nat0 extended ip 192.168.0.0 allow 255.255.0.0 192.168.0.0 255.255.0.0
  allow acl_servers to access extensive ip list a whole
  acl_servers list extended access allow icmp a whole
  pager lines 24
  Outside 1500 MTU
  Within 1500 MTU
  MTU 1500 servers
  IP local pool 192.168.5.1 - 192.168.5.100 mask 255.255.255.0 vpnpool
  ICMP unreachable rate-limit 1 burst-size 1
  ASDM image disk0: / asdm - 621.bin
  don't allow no asdm history
  ARP timeout 14400
  Global 1 interface (outside)
  interface of global (servers) 1
  NAT (inside) 0 access-list nat0
  NAT (inside) 1 192.168.1.4 255.255.255.255
  NAT (inside) 1 192.168.1.9 255.255.255.255
  NAT (inside) 1 192.168.1.27 255.255.255.255
  NAT (inside) 1 192.168.1.56 255.255.255.255
  NAT (inside) 1 192.168.1.150 255.255.255.255
  NAT (inside) 1 192.168.1.200 255.255.255.255
  NAT (inside) 1 192.168.2.5 255.255.255.255
  NAT (inside) 1 192.168.1.0 255.255.255.0
  NAT (inside) 1 192.168.1.96 192.168.1.96
  NAT (servers) - access list 0 nat0
  NAT (servers) 1 192.168.3.5 255.255.255.255
  static (inside, servers) 192.168.1.0 192.168.1.0 netmask 255.255.255.0
  static (servers, inside) 192.168.3.5 192.168.3.5 netmask 255.255.255.255
  Access-group acl_outside in interface outside
  Access-group acl_servers in the servers of the interface
  Route outside 0.0.0.0 0.0.0.0 192.168.2.15 1
  Timeout xlate 03:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  Floating conn timeout 0:00:00
  dynamic-access-policy-registration DfltAccessPolicy
  Enable http server
  http 192.168.1.0 255.255.255.0 inside
  http 192.168.3.5 255.255.255.255 servers
  No snmp server location
  No snmp Server contact
  Server enable SNMP traps snmp authentication linkup, linkdown cold start
  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
  life crypto ipsec security association seconds 28800
  Crypto ipsec kilobytes of life - safety 4608000 association
  Crypto-map dynamic outside_dyn_map 10 the value transform-set ESP-3DES-SHA
  Crypto-map dynamic outside_dyn_map 10 set security-association life seconds288000
  Crypto-map dynamic outside_dyn_map 10 kilobytes of life together - the association of safety 4608000
  Crypto-map dynamic outside_dyn_map 10 the value reverse-road
  map Outside_map 10-isakmp ipsec crypto dynamic outside_dyn_map
  Outside_map interface card crypto outside
  ISAKMP crypto identity hostname
  crypto ISAKMP allow outside
  crypto ISAKMP policy 10
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  crypto ISAKMP policy 65535
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  No encryption isakmp nat-traversal
  Telnet 192.168.2.0 255.255.255.0 outside
  Telnet 192.168.1.0 255.255.255.0 inside
  Telnet 192.168.3.0 255.255.255.0 servers
  Telnet 192.168.38.0 255.255.255.0 servers
  Telnet timeout 5
  SSH timeout 5
  Console timeout 0
  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  WebVPN
  internal vpn group policy
  attributes of vpn group policy
  Protocol-tunnel-VPN IPSec
  Split-tunnel-policy tunnelspecified
  value of Split-tunnel-network-list Local_LAN_Access
  allow to NEM
  password encrypted qaedah Ipsf4W9G6cGueuSu user name
  password encrypted moneef FLlCyoJakDnWMxSQ user name
  chayma X7ESmrqNBIo5eQO9 username encrypted password
  sanaa2 zHa8FdVVTkIgfomY encrypted password username
  sanaa x5fVXsDxboIhq68A encrypted password username
  sanaa1 x5fVXsDxboIhq68A encrypted password username
  bajel encrypted DygNLmMkXoZQ3.DX privilege 15 password username
  daris BgGTY7d1Rfi8P2zH username encrypted password
  taiz Ip3HNgc.pYhYGaQT username encrypted password
  damt gz1OUfAq9Ro2NJoR encrypted privilege 15 password username
  aden MDmCEhcRe64OxrQv username encrypted password
  username hodaidah encrypted password of IYcjP/rqPitKHgyc
  username yareem encrypted password ctC9wXl2EwdhH2XY
  AMMD ZwYsE3.Hs2/vAChB username encrypted password
  haja Q25wF61GjmyJRkjS username encrypted password
  cisco 3USUcOPFUiMCO4Jk encrypted password username
  ibbmr CNnADp0CvQzcjBY5 username encrypted password
  IBBR oJNIDNCT0fBV3OSi encrypted password username
  ibbr 2Mx3uA4acAbE8UOp encrypted password username
  ibbr1 wiq4lRSHUb3geBaN encrypted password username
  password username: TORBA C0eUqr.qWxsD5WNj encrypted
  username, password shibam xJaTjWRZyXM34ou. encrypted
  ibbreef 2Mx3uA4acAbE8UOp encrypted password username
  username torbah encrypted password r3IGnotSy1cddNer
  thamar 1JatoqUxf3q9ivcu encrypted password username
  dhamar pJdo55.oSunKSvIO encrypted password username
  main jsQQRH/5GU772TkF encrypted password username
  main1 ef7y88xzPo6o9m1E encrypted password username
  password username Moussa encrypted OYXnAYHuV80bB0TH
  majed 7I3uhzgJNvIwi2qS encrypted password username
  lahj qOAZDON5RwD6GbnI encrypted password username
  vpn tunnel-group type remote access
  VPN tunnel-group general attributes
  address vpnpool pool
  Group Policy - by default-vpn
  Tunnel vpn ipsec-attributes group
  pre-shared key *.
  !
  class-map inspection_default
  match default-inspection-traffic
  !

  Hello brother Mohammed.

  "my asa5510 to work easy as Server & client vpn at the same time.?

  Yes, it can work as a client and a server at the same time.

  I have never seen anyone do it but many years of my understanding, I have no reason to think why it may be because the two configurations (client/server) are independent of each other.

  Your ASA function as server uses the "DefaultL2LGroup" or it uses standard group policy and tunnel-group are mapped to the remote clients ASA?

  Thank you

• VPN users cannot access Tunnel

  Hi all

  I have a problem, I have 2 sites both with ASA 5520, they are both connected via a site to site VPN.

  It works very well all users in site A can access resources in site B and vice versa.

  The problem comes when a user connects to a remote user VPN site has they cannot access or anything in site B same ping if the FW them delivers an ip address in the range for the site.

  Im sure there is something simple that I missed.

  Thank you

  If the VPN Client pool is in the same subnet as the site of A LAN, then you are probably missing just the following:

  (1) check if you have divided political tunnel, and site-B LAN is included in the ACL split tunnel.

  (2) configure 'same-security-traffic permit intra-interface' on the site A ASA.

  If the above has been configured, please share configuration the two ASA to further check where it is.

• Remote VPN users cannot access tunnel from site to site

  Cisco ASA5505.

  I have a tunnel of site-to-site set up from our office to our Amazon AWS VPC.  I'm not a network engineer and have spent way too much time just to get to this point.

  It works very well since within the office, but users remote VPN can not access the tunnel from site to site.  All other remote access looks very good.

  The current configuration is here: https://gist.github.com/pmac72/f483ea8c7c8c8c254626

  Any help or advice would be greatly appreciated.  It is probably super simple for someone who knows what they're doing to see the question.

  Hi Paul.

  Looking at your configuration:

  Remote access:

  internal RA_GROUP group policy
  RA_GROUP group policy attributes
  value of server DNS 8.8.8.8 8.8.4.4
  Protocol-tunnel-VPN IPSec
  value of Split-tunnel-network-list Split_Tunnel_List

  permit same-security-traffic intra-interface
   
  type tunnel-group RA_GROUP remote access
  attributes global-tunnel-group RA_GROUP
  address RA_VPN_POOL pool
  Group Policy - by default-RA_GROUP
  IPSec-attributes tunnel-group RA_GROUP
  pre-shared key *.
   
  local pool RA_VPN_POOL 10.0.0.10 - 255.255.255.0 IP 10.0.0.50 mask

  Site to site:

  card crypto outside_map 1 match address acl-amzn
  card crypto outside_map 1 set pfs
  peer set card crypto outside_map 1 AWS_TUNNEL_1_IP AWS_TUNNEL_2_IP
  card crypto outside_map 1 set of transformation transformation-amzn
   
   
  I recommend you to use a local IP address pool with a different IP address that deals with the inside interface uses, now you are missing NAT are removed from the IP local pool to the destination of the site to site:
   
  NAT_EXEMPT list of ip 10.0.0.0 access allow 255.255.255.0 172.17.0.0 255.255.0.0
   
  NAT (outside) 0-list of access NAT_EXEMPT
   
  Now, there's a dynamically a NAT exempt allowing traffic to go out and are not translated.
   
  I would like to know how it works!
   
  Please don't forget to rate and score as correct the helpful post!
   
  Kind regards
   
  David Castro,
   
   

• VPN users cannot access all resources

  User is able to connect, get's assigned an IP, we can see them connected
  
      via ASDM, they can't access anything in our network.
  
      

  Hello

  Check the following:

  When you try to send the traffic check the output of "sh cry ips her" to make sure packages encrypted/decrypted by slices.

  If it isn't...

  May be that NAT - T is not configured.

  Check the configuration of:

  ISAKMP crypto nat - t

  SH run all sysopt--> should show sysopt connection permit VPN

  Test:

  Add the command

  management-access inside

  And try to PING IP address of the VPN client ASA inside.

  We will consider here...

  Federico.

• ASA VPN connection cannot see all subnets

  I'm new to the ASA and I have a problem with our remote users. When people access vpn, they don't see a couple subnets on the network. I looked at the ASA and he can see and communicate with subnets, but when you vpn in them is not reachable. All these connections are connections from admin to admin privlages. Anyone know why the ASA can see subnets, but the admin vpn users cannot?

  You compare your ACL split tunnel and your table routing, but only for networks that are relevant to you and you must have access to and are not outside the old configuration. You should also ensure that these networks can route traffic from the pool of vpn.

• Error message: Windows cannot access the specified device path and the second user cannot access the internet

  Original title: I have two users on Vista. We get to the top with windows can not access the specified device path.etc. The other has no problem

  The second user cannot access the internet. Can't access window appears. The other user is not problems.

  Hi Rickravel,

  1. what type of account you use?

  2. This only happens when you access Internet?

  3. when the problem started?

  4. you remember to make changes to the computer before this problem?

  Step 1:

  You can start in safe mode with network and see if the problem occurs in the account.

  You can see the following link to start in safe mode with network.

  Start your computer in safe mode

  Note: Restart the computer to boot into normal mode.

  Step 2:

  If you use Internet explorer, then you can try to disable add ons and check if it helps:

  Run Internet explorer with no Add - ons. Steps to open Internet with no mode of modules:

  a. click on start

  (b) in the search box, type in Internet explore

  c. Select Internet (no add-on mode)

  If you were able to access the Web site without any problems, then the module may cause the error.

  You can read the following article and try the steps to activate the modules individually determine which Add - ons may be the cause of the problem.

  How the modules of the browser affect my computer?

  Hope this information is useful.

• Unable to browse the internet for the VPN (ASA5505 running 8.3)

  We have improved our ASA 5505 to 8.3 firmware image (2) and we have a working VPN configuration (customer VPN in Windows can connect and browse the network of the company as well as their local networks [split tunnel seems to work in this regard]).  However, some time connected they are unable to also browse the internet.  In our configuration of 8.2 (1) we have done 'something' to allow remote users to browse the internet at the same time, but apparently this is not transferred in the upgrade.

  I'm sure it's a simple nat our order routing, but it can't know.  I've gotta hit the road now but will post our config this afternoon if no one knows the "secret" to do.  Ideally, internet traffic to remote users out of their internet connection and not be achieved through the office.  We understand the risks associated with it.

  Hi Scott,.

  To the best of my knowledge, I don't think that l2tp over IPSec supports split tunneling. If you use the Cisco VPN client, you should be able to get this working.

  What we can do in this case is to set up turn on the SAA for these vpn clients. Please add the commands to run below:

  permit same-security-traffic intra-interface

  network of the NETWORK_OBJ_10.0.0.0_27 object

  dynamic NAT interface (outdoors, outdoor)

  Let me know if it helps!

  See you soon,.

  Assia

• Unable to browse the internet while connected to the VPN

  Hi all..

  It was working fine until yesterday morning... Since then, I am not able to browse the internet it I am connected to the VPN... I get a "Page cannot be displayed" error message... the second that I disconnect VPN, I am able to browse internet... I did not change/facilities to do... help please...

  Thank you...

  Check to see if you can ping by IP address (make sure that the DNS information are properly learnt). Also try setting MTU interface to 1300 in case there is a change within the network of your ISP. What is mode NAT or NAT device not compatible?

• the administrator cannot connect to the internet, but other users?

  the administrator cannot access internet, but other users on the same computor? all ideas

  Hi David,

  ·         What happens when the administrator tries to access the internet?

  ·         You receive an error?

  ·         Since when are you facing this problem?

  Respond with more information so we can help you best.

• When you try to upload a document in Word from the Internet Windows error: "Windows cannot find"C:\Users\jma1... ". »

  Whenever I try to upload a document in word from the internet, I get a msg of error "Windows cannot find"C:\Users\jma1\AppData\Local\Temp\Low... ". "It will not download every word on the internet documents. How can I fix? Please give me instructions step by step. Thank you!

  Need help

  Hello

  1. doesn't this problem occurs only with download of word or other files?

  2. what version of internet explore do you use?

  I suggest that you try to upload to another location and check.

  Method 01:

  I suggest also allows you to check in SafeMode with network.

  Advanced, including safe mode startup options

  http://Windows.Microsoft.com/en-us/Windows7/advanced-startup-options-including-safe-mode

  I suggest you to follow the methods and check.

  Method 02:

  How to remove the contents of the temporary Internet files folder

  http://support.Microsoft.com/kb/260897

  Method 03:

  I suggest you to follow the steps and check.

  Run the command to reset the low integrity level on the low folder

  (a) click the start Pearl, click on "All programs" and click on "Accessories".

  (b) right-click "Command Prompt" and click "Run as Administrator".

  (c) in the window "Administrator: command prompt", copy and paste (without the quotes)

  (d) "ICACLS"% userprofile%\AppData\Local\Temp\Low"/setintegritylevel (OI) (CI) low.

  (e) press ENTER.

  (f) restart the computer and test the issue.

• PIX501 VPN PPTP: I have to browse the internet side remote via my VPN server

  Hello

  IM using PPTP for remote access to my server VPN, its power remotely connect to LAN, but I did not have Internet access on the remote side is that I need...

  IM using windows PPTP client and he has to select the "use default gateway on remote network": but still does not.

  Could you help me, thanks in advance

  Rolando

  6.3 (5) PIX version
  interface ethernet0 car
  interface ethernet1 100full
  ethernet0 nameif outside security0
  nameif ethernet1 inside the security100
  fixup protocol dns-length maximum 512
  fixup protocol ftp 21
  fixup protocol h323 h225 1720
  fixup protocol h323 ras 1718-1719
  fixup protocol http 80
  fixup protocol rsh 514
  fixup protocol rtsp 554
  fixup protocol sip 5060
  fixup protocol sip udp 5060
  fixup protocol 2000 skinny
  fixup protocol smtp 25
  fixup protocol sqlnet 1521
  fixup protocol tftp 69
  !
  inside_access_in ip access list allow a whole
  Note outside_access_in list of outdoor access
  access-list outside_access_in allow icmp a whole
  inside_outbound_nat0_acl ip access list allow any 192.168.1.200 255.255.255.248
  pager lines 24
  the history of logging alerts
  ICMP allow all outside
  Outside 1500 MTU
  Within 1500 MTU
  IP address outside of *. *. *. * 255.255.255.248
  IP address inside 192.168.1.1 255.255.255.0
  alarm action IP verification of information
  alarm action attack IP audit
  IP pool local remote_users 192.168.1.200 - 192.168.1.205
  !
  PDM logging 100 information
  history of PDM activate
  ARP timeout 14400
  Global 1 interface (outside)
  NAT (inside) 0-list of access inside_outbound_nat0_acl
  NAT (inside) 1 0.0.0.0 0.0.0.0 0 0
  Access-group outside_access_in in interface outside
  inside_access_in access to the interface inside group
  Route outside 0.0.0.0 0.0.0.0 *. *. *. *
  Timeout xlate 0:05:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225
  H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00
  Sip timeout - disconnect 0:02:00 prompt Protocol sip-0: 03:00
  Timeout, uauth 0:05:00 absolute
  GANYMEDE + Protocol Ganymede + AAA-server
  AAA-server GANYMEDE + 3 max-failed-attempts
  AAA-server GANYMEDE + deadtime 10
  RADIUS Protocol RADIUS AAA server
  AAA-server RADIUS 3 max-failed-attempts
  AAA-RADIUS deadtime 10 Server
  AAA-server local LOCAL Protocol
  Enable http server
  enable floodguard
  Sysopt connection permit-pptp
  Telnet timeout 5
  SSH timeout 5
  Console timeout 0
  VPDN PPTP-VPDN-group accept dialin pptp
  VPDN group PPTP-VPDN-GROUP ppp mschap authentication
  VPDN group PPTP-VPDN-GROUP ppp encryption mppe auto
  VPDN group configuration client PPTP-VPDN-GROUP address local remote_users
  VPDN group VPDN GROUP-PPTP client configuration dns 200.57.2.108 200.57.7.61
  VPDN group VPDN GROUP-PPTP pptp echo 60
  VPDN group VPDN GROUP-PPTP client for local authentication
  VPDN username * password *.
  VPDN allow outside
  VPDN allow inside
  dhcpd address 192.168.1.100 - 192.168.1.199 inside
  dhcpd dns 200.57.2.108 200.57.7.61
  dhcpd lease 3600
  dhcpd ping_timeout 750
  dhcpd outside auto_config
  dhcpd allow inside

  The PIX cannot re - route traffic to the Internet because it's a feature supported on version 7.x and higher. You cannot execute code on PIX501 7.x.

  You can send all traffic through the tunnel (for the PIX) and have the PIX route this traffic to a router internal (on the head), then rewritten the PIX to the Internet.

  Federico.