Pix 501 vpn problem

Question

I can connect but don't see any network resources.
The Vpn Client, ver:5.0.01, is running on an xp machine.
The network it is connecting to is behind a pix501- Ver. 6.3(5).
When the connection is made the remote client gets an assigned address from the vpn pool 192.168.2.10- 192.168.2.25:
The vpn client log shows:
Line:45 18:07:27.898 08/12/09 Sev=Info/4 CM/0x63100034
The Virtual Adapter was enabled:
IP=192.168.2.10/255.255.255.0
DNS=0.0.0.0,0.0.0.0
WINS=0.0.0.0,0.0.0.0
Domain=
Split DNS Names=
This is followed by these lines:
46 18:07:27.968 08/12/09 Sev=Warning/2 CVPND/0xE3400013
AddRoute failed to add a route: code 87
Destination 192.168.1.255
Netmask 255.255.255.255
Gateway 192.168.2.1
Interface 192.168.2.10
47 18:07:27.968 08/12/09 Sev=Warning/2 CM/0xA3100024
Unable to add route. Network: c0a801ff, Netmask: ffffffff, Interface: c0a8020a, Gateway: c0a80201.
48 18:07:28.178 08/12/09 Sev=Info/4 CM/0x63100038
Successfully saved route changes to file.
49 18:07:28.198 08/12/09 Sev=Info/6 CM/0x63100036
The routing table was updated for the Virtual Adapter
50 18:07:29.760 08/12/09 Sev=Info/4 CM/0x6310001A
One secure connection established
I can ping, from the remote client, to an inside ip behind the pix even
when I get the "add route failure" shown above, but i can't ping the computer name.
I enabled NAT traversal using the PDM, But when I connect with this option I get the error that the "Remote end is NOT behind a NAT device This end IS behind a NAT device" and ping fails.
Behind the pix are a few computers with no central server so I'm not passing a WINS server to the remote client.
I set up the vpn with the wizard.
Attached is the config file.
Any suggestions would be appreciated.
Regards,
Hugh

Answer 1

Hugh, sure you can rate based on the overall of the conversation but you are not obligated to do so but certainly would be nice to provide ratings.
To summarized the overall narrowing down possible issues, the main goal was to ensure RA VPN configuration on the PIX501 was corrected.
1- We enabled NAT-T on the firewall - even though this was not the issue but it is required to have it there should you RA VPN from other locations - NAT travseral makes the firewall aware of NAT devices from other ends - here is some good information on NAT-T for reference in future
http://www.microsoft.com/technet/community/columns/cableguy/cg0802.mspx
2-We corrected the VPN POOL network /28 as well as the nonat access list and crypto acl to be consistant.
Here is a link for future reference with numerous PIX configuration scenarios
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/prod_configuration_examples_list.html
lastly - your only remaining issue we can say is purely isolated with MAC machine and vpn client software.
You could perhaps try different version of the client in the MAC, or also look into release notes open caveats to rule out cisco cleint versioning and MAC versioning if there is any issues.
http://www.cisco.com/en/US/products/sw/secursw/ps2308/prod_release_notes_list.html
Regards