Error - View Single Post - Cisco Client VPN not able to Access Servers on the Remote Side of LAN-LAN IPsec VPN

**ps3cheats** · 25-Mar-2007, 11:42 PM

Sounds like a routing problem - most likely the VPN Concentrator is not advertising routes in the dialup profile to the client for the servers subnet. If you can provide some network diagrams it would help to answer your question, but I'll try to describe the problem. If your servers are on a private subnet inside the PIX, say 10.20.30.x, the VPN client will have to receive a route to 10.20.30.x. Assuming these are windows clients, get a command prompt and do "route print". If you do not see a route to your servers subnet, there is your problem.

The route must first be advertised through the PIX (or else you are doing NAT at the PIX into one of the subnets visible to the outside of the PIX) making the route visible to the concentrator (if it is running a dynamic routing protocol) or have static routes in the concentrator.

If your VPN configuration is setup for split tunnelling, you absolutely must have routes visible at the client end. If your are not doing split tunnel, the route must be visible to the concentrator.

25-Mar-2007, 11:42 PM	#2 (permalink)
ps3cheats Fixed Error! Posts: 1,497 Join Date: Mar 2007 Rep Power: 3 IM:	Re: Cisco Client VPN not able to Access Servers on the Remote Side of LAN-LAN IPsec V Sounds like a routing problem - most likely the VPN Concentrator is not advertising routes in the dialup profile to the client for the servers subnet. If you can provide some network diagrams it would help to answer your question, but I'll try to describe the problem. If your servers are on a private subnet inside the PIX, say 10.20.30.x, the VPN client will have to receive a route to 10.20.30.x. Assuming these are windows clients, get a command prompt and do "route print". If you do not see a route to your servers subnet, there is your problem. The route must first be advertised through the PIX (or else you are doing NAT at the PIX into one of the subnets visible to the outside of the PIX) making the route visible to the concentrator (if it is running a dynamic routing protocol) or have static routes in the concentrator. If your VPN configuration is setup for split tunnelling, you absolutely must have routes visible at the client end. If your are not doing split tunnel, the route must be visible to the concentrator.