So is permitting ICMP at the PIX even needed? The pix and 3000 are
connecting across the Internet. I do not own or have access to the
3000.
-----Original Message-----
From: nobody@xxxxxxxxxxxxxx [mailto:nobody@xxxxxxxxxxxxxx]
Sent: Thursday, February 12, 2004 10:43 AM
To: cisco@xxxxxxxxxxxxxx
Subject: RE: VPN3000 Problem [7:84204]
As Joe Brunner mentioned; this is normal behavior.
I have another question. Why have you chosen to put the VPN 3000 behind
the
PIX and not level with the PIX.
Have you thought of putting a LAN gateway behind the both the VPN and
the
PIX and an edge router in front?
+++++++++++++
+edge router+
+++++++++++++
Public IP
++++++++++++ ++++++++++++
+PIX 515 + +VPN 3005 +
++++++++++++ ++++++++++++
private IP
+++++++++++++
+LAN GATEWAY+
+++++++++++++
Lan gateway has static (more specific) routes to tunnel subnets and a
default route to PIX inside.
Joseph Brunner wrote:
>
> let me get this straight, whats behind the pix can't talk to
> the client until, the client tries to ping the networks behind
> this pix ?
>
> If this is case it is because
>
> 1. you're running "split tunneling" with the vpn clients,
> 2. you're clients don't learn the network via the vpn
> 3. until they try to ping first.
>
> This is normal behavior. VPN clients using a network list (with
> multiple subnets) will not "learn" their vpn routes until THEY
> try to hit that subnet first. I often tell my vpn users "ping
> my ip" from a dos prompt so they will learn my subnet as
> "reachable via their tunnel" and then they will subsequently
> come here for return traffic
>
> :)
**Please support GroupStudy by purchasing from the GroupStudy Store:
http://shop.groupstudy.com
FAQ, list archives, and subscription info:
http://www.groupstudy.com/list/cisco.html
Message Posted at:
http://www.groupstudy.com/form/read.php?f=7&i=84302&t=84204
--------------------------------------------------
**Please support GroupStudy by purchasing from the GroupStudy Store:
http://shop.groupstudy.com
FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html
