Losing internet connection when VPN connected!!!

[vargas71]

Hi,


when I'm connected to my VPN client, I can't no longer access the Internet...it's that normal???

Once I'm disconnected from the VPN I can surf the web...

What could be wrong in the PIX or/and VPN configuration ???

Can you help me with that???

 

[netbum]

Are using a hardware VPN or a Pix with the VPN function enabled. If it is the Pix type then you would have to enable split tunneling. Cisco states it something like "the Pix will not send packets out the same interface it received them on" or something like that.

 

[vargas71]

I'm using a Cisco PIX 506E...


And yes the split-tunnel fonction is enable in my VPN configuration...

When I'm connected to the VPN, I can't go anymore on the Internet...

Is it a problem with my vpn config???

Here's my VPN config

crypto ipsec transform-set myset esp-des esp-md5-hmac
crypto dynamic-map dynmap 10 set transform-set myset
crypto map mymap 10 ipsec-isakmp dynamic dynmap
crypto map mymap interface outside
isakmp enable outside
isakmp identity address
isakmp client configuration address-pool local test outside
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
vpngroup toto address-pool test
vpngroup toto dns-server 172.16.244.3
vpngroup toto wins-server 172.16.244.3
vpngroup toto default-domain toto.com
vpngroup toto split-tunnel 101
vpngroup toto split-dns test02.toto.com test01.toto.com test03.toto.com test04.toto.com
vpngroup toto idle-time 1800
vpngroup toto password ********
telnet timeout 5
ssh timeout 5
vpdn group test accept dialin pptp
vpdn group test ppp authentication pap
vpdn group test ppp authentication chap
vpdn group test ppp authentication mschap
vpdn group test ppp encryption mppe 40
vpdn group test client configuration address local test
vpdn group test client configuration dns 172.16.244.3
vpdn group test client configuration wins 172.16.244.3
vpdn group test pptp echo 60
vpdn group test client authentication local
vpdn username testvpn password *********
vpdn enable outside

 

[yizhar]

HI.

> vpngroup toto split-tunnel 101
Post your access-list 101.

> vpdn group test accept dialin pptp
So are you using the Cisco IPSec VPN client or PPTP?
What is the pix and what is the VPN client version?


Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[vargas71]

HI,


I'll do one better..I will give you all my config ;op

I'm using a Cisco Pix 506E firewall with the Cisco VPN Client 3.6.5 the 3.x series for IPSEC...

Here's the config on my pix:

PIX Version 6.2(2)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password ******** encrypted
passwd ******** encrypted
hostname pixfirewall
domain-name toto.com
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rt
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
fixup protocol domain 53
names
access-list 101 permit ip any any
pager lines 24
logging buffered debugging
logging trap debugging
interface ethernet0 auto
interface ethernet1 auto
mtu outside 1500
mtu inside 1500
ip address outside 216.x.x.30 255.255.255.0
ip address inside 172.16.244.10 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool test 172.16.244.100-172.16.244.130
pdm history enable
arp timeout 14400
nat (inside) 0 access-list 101
route outside 0.0.0.0 0.0.0.0 216.x.x.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 si
p 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enab
floodguard enable
sysopt connection permit-ipsec
sysopt connection permit-pptp
no sysopt route dnat
crypto ipsec transform-set myset esp-des esp-md5-hmac
crypto dynamic-map dynmap 10 set transform-set myset
crypto map mymap 10 ipsec-isakmp dynamic dynmap
crypto map mymap interface outside
isakmp enable outside
isakmp identity address
isakmp client configuration address-pool local test outside
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group
isakmp policy 10 lifetime 86400
vpngroup toto address-pool test
vpngroup toto dns-server 172.16.244.3
vpngroup toto wins-server 172.16.244.3
vpngroup toto default-domain toto.com
vpngroup toto split-tunnel 101
vpngroup toto split-dns test02.toto.com test01.toto.com test03.
toto.com test04.toto.com
vpngroup toto idle-time 1800
vpngroup toto password ********
telnet timeout 5
ssh timeout 5
vpdn group test accept dialin pptp
vpdn group test ppp authentication pap
vpdn group test ppp authentication chap
vpdn group test ppp authentication mschap
vpdn group test ppp encryption mppe 40
vpdn group test client configuration address local test
vpdn group test client configuration dns 172.16.244.3
vpdn group test client configuration wins 172.16.244.3
vpdn group test pptp echo 60
vpdn group test client authentication local
vpdn username testvpn password *********
vpdn enable outside

Thanks a lot for your Help!!!

 

[yizhar]

HI.

> ip local pool test 172.16.244.100-172.16.244.130
Change it to something else, like:
ip local pool test 192.168.111.1-192.168.111.30

> access-list 101 permit ip any any
This is the problem.
Change it to something like:
access-list 101 permit ip 172.16.244.0 255.255.255.0 192.168.111.0 255.255.255.0

You can then verify the split-tunnel by double clicking the yellow icon at the remote vpn client, and checking the "statistics" tab.


Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[vargas71]

Ok, I gonna try that...


but why can't I keep the 172.16.244.x in my ip local pool???

because this is the intern network...does it really affect if I keep that???


Thanks a lot for your help!!!

 

[vargas71]

Great it works!!!

It was an access-list problem ;o)

Thanks a lot!!!

Now, I just have to solve my Exchange Server problem with the VPN Connection ;op