cisco PIX vpn connectivity woes

[xyyz]

i'm pretty new to the pix world. i'm trying to learn a few things using various tutorials i've found on the net.

i have a pix 501 that i'm trying to use as a VPN endpoint. i have a winxp machine running vpn client 4.0.

here's the setup:

(internet)-----[cisco 831]-----[pix 501]-----(internal network)

i can connect to the pix and am assigned an IP address, but beyond this nothing happens.

i cannot look inside the internal network, and i cannot pass through the VPN to connect to the outside world either (browsing, etc).

here's my pix configuration. maybe someone can find something in here that will help.

i read someplace about something to do with a "split scope." while i wasn't really able to understand fully what that means, i gathered it had something to do with the pix dealing with two separate networks. is there some specific command that i need to implement? also, can someone give me the layperson's explanation of what this "split scope" does if it is the source of the problem?

PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password xxxxxxx encrypted
passwd xxxxxxxxxxx encrypted
hostname phobos
domain-name solhome
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list 101 permit ip 192.168.100.240 255.255.255.240 10.10.100.8 255.255.255.252
access-list 101 permit ip 10.10.100.0 255.255.255.248 10.10.10.8 255.255.255.252
access-list 102 permit ip 192.168.100.240 255.255.255.240 10.10.100.8 255.255.255.252
access-list 102 permit ip 10.10.100.0 255.255.255.248 10.10.10.8 255.255.255.252
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 10.10.100.3 255.255.255.248
ip address inside 192.168.100.242 255.255.255.240
ip audit info action alarm
ip audit attack action alarm
ip local pool vpnpool 10.10.100.9-10.10.100.14
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list 102
nat (inside) 1 192.168.100.240 255.255.255.240 0 0
conduit permit ip host 10.10.100.9 any
conduit permit ip host 10.10.100.10 any
route inside 0.0.0.0 0.0.0.0 192.168.100.241 1
route outside 0.0.0.0 0.0.0.0 10.10.100.1 255
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set trmset esp-aes-256 esp-sha-hmac
crypto dynamic-map map2 10 set transform-set trmset
crypto map map1 10 ipsec-isakmp dynamic map2
crypto map map1 interface outside
isakmp enable outside
isakmp identity address
isakmp client configuration address-pool local vpnpool outside
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption aes-256
isakmp policy 10 hash sha
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
vpngroup vpnclients address-pool vpnpool
vpngroup vpnclients dns-server 192.168.100.252
vpngroup vpnclients wins-server 192.168.100.253
vpngroup vpnclients default-domain solhome
vpngroup vpnclients split-tunnel 101
vpngroup vpnclients idle-time 1800
vpngroup vpnclients password ********
telnet timeout 5
ssh 10.10.100.6 255.255.255.255 outside
ssh 192.168.100.254 255.255.255.255 inside
ssh 192.168.100.253 255.255.255.255 inside
ssh 192.168.100.252 255.255.255.255 inside
ssh 192.168.100.243 255.255.255.255 inside
ssh timeout 5
console timeout 0
terminal width 80

 

[Minue]

Hello
Try posting in the Pix forum.If you don't get a reply I will send you a working basic config.
Regards

 

[ignet]

Hi,

'Split scope' is also known as 'split tunnel communications'. An example use of this is to enable a single device e.g. a PIX, to access both the Internet and be an endpoint for a VPN tunnel. An ACL is used to define which traffic goes through the tunnel and which traffic heads for the Internet. The permit statements identify the traffic to forward through the VPN tunnel and deny statements identify which traffic to forward outside the VPN tunnel to the next hop.

Joe
Igneous Networks
Cisco VPN and Remote Access

 

[burtsbees]

Also, try this...
mtu outside 1492
mtu inside 1492

Burt