Security

Ask something
Discussion Locked

Local Lan Access doesn't work on Pix515e

0 helpful
3 replies

by wansiril

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

i use VPN client connect to Pix515e is fine. however, once vpn client connected all my internet connection, network drive and network printer are disconnected.

i read some article on web about set up "local lan access" on client and set some split tunnel on firwall server. however, i have no clue to make it works on Pix 515e. Please help!!

3 replies

by dumphrey

The PIX firewall does not like U-Turn traffic, ie when you are going into the firewall and then wanting to go back out without leaving. Example: Internet acccess while on a VPN connection. The PIX configuration is basicly (depending on IOS version): vpngroup split-tunnel. Thi si of course entered on the PIX at the conf-t prompt. If your buisness has a PIX, you may have a service contract and can call Cisco and have them do it for you if your not comfortable at the command line.

by mshavrov

It's normal behavior for most VPN clients. If you connect to VPN site, it becomes your ONLY route, and it cuts you off all local resources. In most cases it's made to tie up security - if your PC is compromised, you may provide access for intruder to corporate resources (for example, if you have Admin account without the password, some one else can map your remote network drive, or get Terminal connection to corp network). However it's possible to make a "split tunnel" for your VPN connection. In this case you will have all your local connections, plus you will get your "remote connection" over the VPN. But again, it could create a security breach in your corporate perimeter.

I don't know what is your version of PIX software, and if it allows you to do a split tunnel. I know for sure that versiuon 7.x allows you to do it.

Good luck,

Mike
CCNP, CCDP, CCSP, CCVP, MCSE W2K, Security+, etc.
http://www.ciscoheadsetadapter.com

by Former member

Either your VPN software (on your PeeCee) supports split tunneling or it doesn't, but check there first.

This discussion is closed to new replies.