Velocity Reviews - Computer Hardware Reviews

Velocity Reviews > Newsgroups > Computing > Cisco > VPN Question on a PIX515E

Reply
Thread Tools

VPN Question on a PIX515E

 
 
K
Guest
Posts: n/a
 
      02-23-2005
This question isn't necessarily Cisco specific, but because my PIX will be
in charge of the VPN I will post here.

I have two LANs on different sites and use a PIX 515E at each site to form a
WAN over always-up VPN.

I want to add some client machines to one of the LANs so they can VPN in. I
DO NOT want these clients on my servers and ideally don't want them on my
internal IP range.

If I put a 2nd NIC in each of these extra PCs (as they would already have
one for their own LAN connection to a LAN I would not control) and give it
an IP not on my range (effectively a 3rd LAN) can my PIX allow VPN to my own
network and this new 'virtual' network?


 
Reply With Quote
 
 
 
 
Walter Roberson
Guest
Posts: n/a
 
      02-23-2005
In article <421c6f19$0$67640$(E-Mail Removed)>,
K <@.> wrote:
:I have two LANs on different sites and use a PIX 515E at each site to form a
:WAN over always-up VPN.

:I want to add some client machines to one of the LANs so they can VPN in. I
O NOT want these clients on my servers and ideally don't want them on my
:internal IP range.

:If I put a 2nd NIC in each of these extra PCs (as they would already have
ne for their own LAN connection to a LAN I would not control) and give it
:an IP not on my range (effectively a 3rd LAN) can my PIX allow VPN to my own
:network and this new 'virtual' network?

Yes, but you have the usual routing problems. You have to put a "route"
statement in pointing the new IP range towards the correct interface,
and you have to find some way for those extra PCs to be able to contact
the single fixed inside IP of the PIX. But of course if the PCs can do that,
they can also contact other local machines.

If you do not have 802.1Q aware switches then the easiest way to handle
this is to add another interface to the 515E (the restricted license
will handle 3 physical interfaces.) If you have 802.1Q aware switches
then you can handle it by creating a new "logical" interface on the inside;
"logical" interfaces get traffic that is 802.1Q tagged. You do not need
to reconfigure your present inside interface when you do this: 802.1Q
specifies that no tag is transmitted for the "native" vlan, so all you need
to do is configure the switch port as a trunk, add vlan 1 and the new vlan
to the trunk, and configure up the appropriate logical interface.
--
The image data is transmitted back to Earth at the speed of light
and usually at 12 bits per pixel.
 
Reply With Quote
 
 
 
Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Odd Site to Site VPN Problem - pix515e Please help! dempsey.bill@gmail.com Cisco 0 07-07-2005 05:25 PM
Cisco PIX515E and VPN gigi Cisco 2 06-27-2005 07:19 PM
how to config more than one site-to-site VPN in my PIX515E Benson Cisco 3 04-23-2005 02:00 PM
PIX515E configuration for VPN & Internet access Benson Cisco 3 10-21-2004 03:23 PM
PIX515E VPN IPSec Local User Authentication Matt Cisco 2 04-15-2004 12:05 PM



Advertisments