General discussion

Locked

Local Lan Access doesn't work on Pix515e

By wansiril ·
i use VPN client connect to Pix515e is fine. however, once vpn client connected all my internet connection, network drive and network printer are disconnected.

i read some article on web about set up "local lan access" on client and set some split tunnel on firwall server. however, i have no clue to make it works on Pix 515e. Please help!!

This conversation is currently closed to new comments.

3 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

by Dumphrey In reply to Local Lan Access doesn't ...

The PIX firewall does not like U-Turn traffic, ie when you are going into the firewall and then wanting to go back out without leaving. Example: Internet acccess while on a VPN connection. The PIX configuration is basicly (depending on IOS version): vpngroup <name of vpngroup> split-tunnel. Thi si of course entered on the PIX at the conf-t prompt. If your buisness has a PIX, you may have a service contract and can call Cisco and have them do it for you if your not comfortable at the command line.

Collapse -

by mshavrov In reply to Local Lan Access doesn't ...

It's normal behavior for most VPN clients. If you connect to VPN site, it becomes your ONLY route, and it cuts you off all local resources. In most cases it's made to tie up security - if your PC is compromised, you may provide access for intruder to corporate resources (for example, if you have Admin account without the password, some one else can map your remote network drive, or get Terminal connection to corp network). However it's possible to make a "split tunnel" for your VPN connection. In this case you will have all your local connections, plus you will get your "remote connection" over the VPN. But again, it could create a security breach in your corporate perimeter.

I don't know what is your version of PIX software, and if it allows you to do a split tunnel. I know for sure that versiuon 7.x allows you to do it.

Good luck,

Mike
CCNP, CCDP, CCSP, CCVP, MCSE W2K, Security+, etc.
http://www.ciscoheadsetadapter.com

Collapse -

by -Q-240248 In reply to Local Lan Access doesn't ...

Either your VPN software (on your PeeCee) supports split tunneling or it doesn't, but check there first.

Back to Security Forum
3 total posts (Page 1 of 1)  

Related Discussions

Related Forums