On Tue, 2009-06-30 at 16:56 -0700, Jared Gillis wrote: > So my "inside" network is 192.168.0.0/24, and the vpnclients will get > addressed into 192.168.1.0/24 (correct?), and there will be no NAT on > communication between them.
Correct, your "nat (inside) 0 acccess-list nonatvpn" > My question is, are my vpn clients in the same broadcast domain as > my "inside" interface, or will they be required to unicast to > 192.168.0.x addresses? Is there a way to influence how they can > communicate? No, they're not in the same broadcast domain. The PIX sort of "terminates" the clients on the "outside" interface. Ex: assigned IP addresses must be routed to the outside. With the "sysopt connection permit-ipsec" you implicitly allow all traffic from VPN users. Alternatively you open up your "outside" ACL to permit relevant traffic. PIX/ASA v7 and newer have the "vpn-filter" feature for fine grained control of what VPN users can and cannot reach. > I've been looking all over Cisco's website and can find plenty of > configuration examples, but nothing explaining how communication > between the inside and vpn clients is handled. "Product support" lists some configuration examples that might be of interest: http://www.cisco.com/en/US/customer/products/hw/vpndevc/ps2030/prod_configuration_examples_list.html Regards, Peter _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
