Routing Issue in PIX 515E

Question

Hi all,
I have a routing problem here with routing in PIX515E version 6.35. I have some Client PCs located in the DMZ interface of the PIX515E, they connect to PIX using Cisco VPN Client (IPSEC VPN), after that these PCs can be routed to access Servers (static route) located behind Internal interfaces of PIX. I have some Servers located remotely having Internet Access, the gateway router remotely connect to PIX Outside Interface (Internet) using IPSEC VPN then routed to inside Interface (static route).
After establishing IPSEC VPN, the Client PCs behind the DMZ interfaces can access Servers located behind Internal Interface of PIX. So do the remote servers. However, the Client PCs cannot access the remote servers.
Just wondering if there is any restriction for the routing in PIX?
Thanks for the answer.

Answer 1

Hi Jorge,
Please see the config below;
Servers behind inside interface 172.16.0.0/16
Remote Server 172.16.0.199/32
RA_Client:172.16.45.129-172.16.45.254
dmz: 192.168.0.0/16
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security50
access-list from-outside remark
access-list from-outside permit icmp any any echo-reply
access-list from-outside remark
access-list nonat permit ip 172.16.0.0 255.255.0.0 host 172.16.0.199
access-list 101 permit ip 172.16.0.0 255.255.0.0 172.16.45.128 255.255.255.128
access-list Remote_Server permit ip 172.16.0.0 255.255.0.0 host 172.16.0.199
ip address outside x.x.x.70 255.255.255.248
ip address inside 172.16.58.20 255.255.255.0
ip address dmz 192.168.68.20 255.255.255.0
ip verify reverse-path interface outside
ip local pool RA_Client_pool 172.16.45.129-172.16.45.254
global (outside) 1 x.x.x.67 netmask 255.255.255.248
global (dmz) 1 192.168.68.129-192.168.68.254 netmask 255.255.255.128
nat (inside) 0 access-list nonat
nat (inside) 1 172.16.0.0 255.255.0.0 0 0
access-group from-outside in interface outside
route outside 0.0.0.0 0.0.0.0 x.x.x.65 1
route outside 172.16.0.199 255.255.255.255 x.x.x.65 1
route inside 172.16.0.0 255.255.0.0 172.16.58.1 1
route dmz 172.16.45.128 255.255.255.128 192.168.68.1 1
route dmz 192.168.0.0 255.255.0.0 192.168.68.1 1
crypto ipsec transform-set 3des-sha esp-3des esp-sha-hmac
crypto dynamic-map map2 40 set transform-set 3des-sha
crypto map IPSEC 40 ipsec-isakmp dynamic map2
crypto map IPSEC 50 ipsec-isakmp
crypto map IPSEC 50 match address Remote_Server
crypto map IPSEC 50 set peer y.y.y.y
crypto map IPSEC 50 set transform-set 3des-sha
crypto map IPSEC 50 set security-association lifetime seconds 900 kilobytes 4608000
crypto map IPSEC client authentication AuthInbound
crypto map IPSEC interface outside
crypto map IPSEC interface dmz
isakmp enable outside
isakmp enable dmz
vpngroup RA_Client address-pool RA_Client_pool
vpngroup RA_Client dns-server 172.16.9.5
vpngroup RA_Client wins-server 172.16.9.5
vpngroup RA_Client split-tunnel 101
vpngroup RA_Client idle-time 1800
vpngroup RA_Client password ********