PIX 501 -> VPN Client 4.0.x

[RadioX]

I have a cisco pix 501 that is connected to two other pix 501's via a pix to pix scenario. Now I am trying to add in the capability of users logging in with Cisco VPN Client Software. The users can login and get an IP address but they connat reach any of my other address on the network. Here is a copy of my config. Can anyone let me know what is going on. Thanks

PIX Version 6.2(2)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
access-list inside_nat0_outbound permit ip host xx.xx.xx.xx 192.168.5.0 255.255.255.0
access-list inside_nat0_outbound permit ip 192.168.1.0 255.255.255.0 192.168.5.0 255.255.255.0
access-list inside_nat0_outbound permit ip host xx.xx.xx.xx 192.168.115.0 255.255.255.0
access-list inside_nat0_outbound permit ip 192.168.1.0 255.255.255.0 192.168.115.0 255.255.255.0
access-list inside_nat0_outbound permit ip 192.168.1.0 255.255.255.0 10.1.1.0 255.255.255.0
access-list inside_nat0_outbound permit ip any 10.1.1.0 255.255.255.0
access-list 101 permit ip 192.168.1.0 255.255.255.0 192.168.5.0 255.255.255.0
access-list 101 permit ip host xx.xx.xx.xx host xx.xx.xx.xx
access-list 102 permit ip 192.168.1.0 255.255.255.0 192.168.115.0 255.255.255.0
access-list 102 permit ip host xx.xx.xx.xx host xx.xx.xx.xx
access-list 103 permit ip any 10.1.1.0 255.255.255.0
pager lines 24
interface ethernet0 10baset
interface ethernet1 10full
icmp permit any echo outside
icmp permit any echo-reply outside
icmp permit any outside
icmp permit any echo inside
icmp permit any echo-reply inside
icmp permit any inside
mtu outside 1500
mtu inside 1500
ip address outside xx.xx.xx.xx 255.255.255.240
ip address inside 192.168.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool pptp-pool 10.1.1.1-10.1.1.10
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
route outside 0.0.0.0 0.0.0.0 xx.xx.xx.xx 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
no snmp-server location
no snmp-server contact
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
sysopt connection permit-pptp
no sysopt route dnat
crypto ipsec transform-set JJOffice esp-3des esp-sha-hmac
crypto ipsec transform-set office esp-3des esp-md5-hmac
crypto ipsec transform-set asp esp-3des esp-md5-hmac
crypto dynamic-map dynmap 20 match address 103
crypto dynamic-map dynmap 20 set transform-set office
crypto map transam 1 ipsec-isakmp
crypto map transam 1 match address 101
crypto map transam 1 set peer xx.xx.xx.xx
crypto map transam 1 set transform-set office
crypto map transam 2 ipsec-isakmp
crypto map transam 2 match address 102
crypto map transam 2 set peer xx.xx.xx.xx
crypto map transam 2 set transform-set asp
crypto map transam 65535 ipsec-isakmp dynamic dynmap
crypto map transam interface outside
isakmp enable outside
isakmp key ******** address xx.xx.xx.xx netmask 255.255.255.255
isakmp key ******** address xx.xx.xx.xx netmask 255.255.255.255
isakmp identity address
isakmp policy 1 authentication pre-share
isakmp policy 1 encryption 3des
isakmp policy 1 hash md5
isakmp policy 1 group 2
isakmp policy 1 lifetime 86400
vpngroup gastro address-pool pptp-pool
vpngroup gastro dns-server 66.225.72.2 66.225.80.2
vpngroup gastro idle-time 1800
vpngroup gastro password ********
telnet 192.168.1.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
vpdn enable outside
dhcpd address 192.168.1.100-192.168.1.200 inside
dhcpd dns 198.6.1.122 66.225.72.2
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
dhcpd enable inside

 

[themut]

Take a look at "Intranet VPN" thread posted earlier today it is the same issue.

 

[tek777]

dumb question, but all all of your servers having the same gateway as the inside of the PIX?