Velocity Reviews - Computer Hardware Reviews

Velocity Reviews > Newsgroups > Computing > Cisco > PIX 501 VPN client to VPN client connections

Reply
Thread Tools

PIX 501 VPN client to VPN client connections

 
 
Nick
Guest
Posts: n/a
 
      12-08-2005
Hi,

I'm new to the PIX world but I'm wondering if you can help me with a
problem.

Setup:

Cisco client ver: 4.6
Pix 501 6.3(5) PDM 3.0(4)
Internal LAN subnet: 192.168.1.0
VPN Subnet: 192.168.2.0

I would like to be able to have the VPN clients be able to connect to
eachother through the PIX VPN.

VPN ------ PIX ----- VPN

Is this possible? If yes, could you please give me a few pointers.

The VPN clients can ping anything on the 192.168.1.0 subnet and the LAN can
ping anything on the 192.168.2.0 subnet.

Here's a copy of my running config.

: Saved
: Written by enable_15 at 19:40:22.219 EST Wed Dec 7 2005
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password lTIBC2cOqX6oQlEW encrypted
passwd lTIBC9cOqX5oQlEW encrypted
hostname pix
domain-name none.com
clock timezone EST -5
clock summer-time EDT recurring
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
object-group service MSN tcp
port-object range 6891 6901
port-object range 1863 1863
object-group service Half-Life tcp-udp
port-object range 27000 27039
object-group service Bittorrent tcp-udp
port-object range 6981 6981
object-group service Shareaza tcp
port-object range 6346 6346
access-list outside_access_in permit tcp any any object-group Bittorrent
access-list outside_access_in permit tcp any any object-group Half-Life
access-list outside_access_in permit tcp any any object-group MSN
access-list outside_access_in permit tcp any any object-group Shareaza
access-list MooCows_splitTunnelAcl permit ip 192.168.1.0 255.255.255.0 any
access-list MooCows_splitTunnelAcl permit ip 192.168.2.0 255.255.255.0 any
access-list inside_outbound_nat0_acl permit ip 192.168.1.0 255.255.255.0
192.168.2.0 255.255.255.240
access-list inside_outbound_nat0_acl permit ip 192.168.2.0 255.255.255.240
any
access-list outside_cryptomap_dyn_20 permit ip any 192.168.2.0
255.255.255.240
access-list outside_cryptomap_dyn_20 deny ip 192.168.2.0 255.255.255.240 any
pager lines 24
icmp deny any echo-reply outside
mtu outside 1500
mtu inside 1500
ip address outside dhcp setroute retry 4
ip address inside 192.168.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool MooCows 192.168.2.5-192.168.2.10
pdm location 192.168.1.2 255.255.255.255 inside
pdm location 192.168.1.0 255.255.255.255 inside
pdm location 192.168.2.0 255.255.255.0 outside
pdm location 192.168.2.0 255.255.255.240 outside
pdm location 192.168.2.0 255.255.255.240 inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp interface 6981 192.168.1.2 6981 netmask
255.255.255.255 0 0
static (inside,outside) udp interface 6981 192.168.1.2 6981 netmask
255.255.255.255 0 0
static (inside,outside) tcp interface 6346 192.168.1.2 6346 netmask
255.255.255.255 0 0
access-group outside_access_in in interface outside
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225
1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
ntp server 216.234.161.11 source outside prefer
ntp server 216.252.70.172 source outside
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
isakmp enable outside
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup MooCows address-pool MooCows
vpngroup MooCows split-tunnel MooCows_splitTunnelAcl
vpngroup MooCows idle-time 1800
vpngroup MooCows password *********
telnet 192.168.1.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 5
dhcpd address 192.168.1.6-192.168.1.100 inside
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd domain none.com
dhcpd auto_config outside
dhcpd enable inside
terminal width 80
Cryptochecksum:2427d72ff421741dac646b60392be028
: end

Thanks,

Nick




 
Reply With Quote
 
 
 
 
Walter Roberson
Guest
Posts: n/a
 
      12-09-2005
In article <(E-Mail Removed)>,
Nick <(E-Mail Removed)> wrote:
>I'm new to the PIX world but I'm wondering if you can help me with a
>problem.


>Setup:


>Cisco client ver: 4.6
>Pix 501 6.3(5) PDM 3.0(4)


>I would like to be able to have the VPN clients be able to connect to
>eachother through the PIX VPN.


That is not possible on the PIX 501.

On the PIX 506/506E it is possible (I think), but requires an additional
public IP subnet and a router that supports 802.1Q VLANs.

On all the larger PIX, it is possible by adding physical interface
and an additional public IP subnet... but only the clients that happen
to be connecting to different subnets would be able to communicate.

On the PIX 515/515E, 525, and 535, you could install PIX 7.0 software,
which does offer that facility without additional hardware
(if I understand correctly.)
--
"It is important to remember that when it comes to law, computers
never make copies, only human beings make copies. Computers are given
commands, not permission. Only people can be given permission."
-- Brad Templeton
 
Reply With Quote
 
 
 
 
John
Guest
Posts: n/a
 
      12-14-2005
You are correct. PIX 7.0 allows for this on the 515E.

 
Reply With Quote
 
 
 
Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
VPN PIX-_static PIX ; PIX-dynamic_PIX ; VPN Client Svenn Cisco 3 03-13-2006 09:25 AM
Pix 501 and Concurrent VPN Connections jaylucasaustin.rr.com Cisco 3 01-29-2006 10:29 PM
PIX 501 <-> PIX 501 - Problem contating private networks on the inside Andre Cisco 7 02-20-2005 07:02 PM
PIX to PIX VPN and VPN Client to PIX Config Example? GVB Cisco 1 02-06-2004 07:44 PM
Cant establish a VPN tunnel between PIX 501 and Cisco VPN Client Martin Nowles Cisco 0 11-10-2003 03:46 PM



Advertisments