If you're connecting through a natted host to the VPN you might try adding crypto isakmp nat-traversal 30
I have a fairly similar setup to yours which works just fine. BR, Sibbi III On 3.2.2009 14:33, "Eimantas Zdanevičius" <[email protected]> wrote: > Engelhard Labiro wrote: >>> hostname(config)# ip local pool testpool 192.168.0.10-192.168.0.15 >>> >> >> I guess this is a routing problem, since you assign 192.168.0.x to vpn >> client which is located on different segment with PIX's own interface. >> The pix must response to arp request for 192.168.0.10 to 15 on behalf >> of the vpn client. This is can be done with proxy arp setting on the >> inside interface of the PIX... I forgot the command. >> Or if you have a router in PIX's inside I/F, just create a route to >> 192.168.0.x pointing back >> to your PIX's inside I/F. >> >> HTH >> Engel >> > When client connects to the asa, asa automaticaly adds a route: > S 192.168.0.10 255.255.255.255 [1/0] via default_gw, outside > > Eimantas > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
