PIX 506e Access VPN and Lan2Lan VPN

Discussion in 'Cisco' started by Laurent, Feb 28, 2008.

  1. Laurent

    Laurent Guest

    Hi all,

    I have a question about PIX 506e running 6.3(5).

    The PIX is configured for L2L VPN and also Access VPN using CISCO VPN
    Client.

    Inside LAN is 192.168.2.0/24
    Remote site is 10.9.3.0/24

    As far as i remember there is no way to access the 10.9.3.0/24 while
    using the Access VPN at least in 6.3?

    Could anyone please confirm this point? And is it possible in 7.2 (after
    changing PIX506e by an ASA55xx)?


    Just in case here is the config.

    Thanks in advance.

    Regards.

    ______

    : Saved
    :
    PIX Version 6.3(5)
    interface ethernet0 auto
    interface ethernet1 auto
    nameif ethernet0 outside security0
    nameif ethernet1 inside security100
    enable password **** encrypted
    passwd *** encrypted
    hostname jupiter
    domain-name 192.168.0.0
    fixup protocol dns maximum-length 512
    fixup protocol ftp 21
    fixup protocol h323 h225 1720
    fixup protocol h323 ras 1718-1719
    fixup protocol http 80
    fixup protocol rsh 514
    fixup protocol rtsp 554
    fixup protocol sip 5060
    fixup protocol sip udp 5060
    fixup protocol skinny 2000
    fixup protocol smtp 25
    fixup protocol sqlnet 1521
    fixup protocol tftp 69
    names
    name 192.168.11.171 XXXAPP1
    name 192.168.11.172 XXXAPP2
    name 10.9.3.0 XXXPROD
    name 10.9.3.1 YYYAPP1
    name 10.9.3.2 YYYAPP2
    access-list no-nat-inside permit ip 192.168.2.0 255.255.255.0 host
    XXXAPP1
    access-list no-nat-inside permit ip 192.168.2.0 255.255.255.0 host
    XXXAPP2
    access-list no-nat-inside permit ip 192.168.2.0 255.255.255.0 host
    YYYAPP1
    access-list no-nat-inside permit ip 192.168.2.0 255.255.255.0 host
    YYYAPP2
    access-list no-nat-inside permit ip 192.168.2.0 255.255.255.0
    192.168.2.0 255.255.255.0
    access-list vpn-lusis permit ip 192.168.2.0 255.255.255.0 host XXXAPP1
    access-list vpn-lusis permit ip 192.168.2.0 255.255.255.0 host XXXAPP2
    access-list vpn-XXXPROD permit ip 192.168.2.0 255.255.255.0 host YYYAPP1
    access-list vpn-XXXPROD permit ip 192.168.2.0 255.255.255.0 host YYYAPP2
    access-list in_outside permit icmp any any
    access-list splitunnel permit ip 192.168.2.0 255.255.255.0 192.168.2.0
    255.255.255.0
    access-list splitunnel permit ip XXXPROD 255.255.255.0 192.168.2.0
    255.255.255.0
    access-list splitunnel permit ip host XXXAPP1 192.168.2.0 255.255.255.0
    access-list splitunnel permit ip host XXXAPP2 192.168.2.0 255.255.255.0
    no pager
    icmp permit any outside
    mtu outside 1500
    mtu inside 1500
    ip address outside 193.0.0.25 255.255.255.252
    ip address inside 192.168.2.1 255.255.255.0
    ip audit info action alarm
    ip audit attack action alarm
    ip local pool vpnclientpool 192.168.2.130-192.168.2.139 mask
    255.255.255.0
    pdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list no-nat-inside
    nat (inside) 1 0.0.0.0 0.0.0.0 0 0
    access-group in_outside in interface outside
    route outside 0.0.0.0 0.0.0.0 81.252.66.26 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225
    1:00:00
    timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout sip-disconnect 0:02:00 sip-invite 0:03:00
    timeout uauth 0:05:00 absolute
    aaa-server TACACS+ protocol tacacs+
    aaa-server TACACS+ max-failed-attempts 3
    aaa-server TACACS+ deadtime 10
    aaa-server RADIUS protocol radius
    aaa-server RADIUS max-failed-attempts 3
    aaa-server RADIUS deadtime 10
    aaa-server LOCAL protocol local
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    no snmp-server enable traps
    floodguard enable
    sysopt connection permit-ipsec
    crypto ipsec transform-set esp3dessha esp-3des esp-sha-hmac
    crypto ipsec transform-set vpnclientset esp-3des esp-md5-hmac
    crypto dynamic-map vpnclientmap 1000 set transform-set vpnclientset
    crypto map map_outside 10 ipsec-isakmp
    crypto map map_outside 10 match address vpn-lusis
    crypto map map_outside 10 set pfs group5
    crypto map map_outside 10 set peer 193.0.0.66
    crypto map map_outside 10 set transform-set esp3dessha
    crypto map map_outside 20 ipsec-isakmp
    crypto map map_outside 20 match address vpn-XXXPROD
    crypto map map_outside 20 set pfs group5
    crypto map map_outside 20 set peer 194.0.0.114
    crypto map map_outside 20 set transform-set esp3dessha
    crypto map map_outside 1000 ipsec-isakmp dynamic vpnclientmap
    crypto map map_outside client authentication LOCAL
    crypto map map_outside interface outside
    isakmp enable outside
    isakmp key ******** address 194.0.0.114 netmask 255.255.255.255 no-xauth
    no-config-mode
    isakmp key ******** address 193.0.0.66 netmask 255.255.255.255 no-xauth
    no-config-mode
    isakmp policy 10 authentication pre-share
    isakmp policy 10 encryption 3des
    isakmp policy 10 hash sha
    isakmp policy 10 group 5
    isakmp policy 10 lifetime 86400
    isakmp policy 20 authentication pre-share
    isakmp policy 20 encryption 3des
    isakmp policy 20 hash sha
    isakmp policy 20 group 2
    isakmp policy 20 lifetime 86400
    vpngroup vpnclientgroupaltergaz address-pool vpnclientpool
    vpngroup vpnclientgroupaltergaz split-tunnel splitunnel
    vpngroup vpnclientgroupaltergaz pfs
    vpngroup vpnclientgroupaltergaz idle-time 1800
    vpngroup vpnclientgroupaltergaz password ********
    telnet YYYAPP1 255.255.255.255 inside
    telnet timeout 5
    ssh 195.0.0.152 255.255.255.248 outside
    ssh 0.0.0.0 0.0.0.0 inside
    ssh timeout 5
    console timeout 0
    dhcpd address 192.168.2.151-192.168.2.240 inside
    dhcpd dns 194.2.0.20 194.2.0.50
    dhcpd lease 86400
    dhcpd ping_timeout 750
    dhcpd enable inside
    username xxxx password xxxx encrypted privilege 2
    terminal width 80
     
    Laurent, Feb 28, 2008
    #1
    1. Advertising

  2. In article <Xns9A52834B6170bintriplezeronet@212.27.60.37>,
    Laurent <> wrote:

    >I have a question about PIX 506e running 6.3(5).


    >The PIX is configured for L2L VPN and also Access VPN using CISCO VPN
    >Client.


    >As far as i remember there is no way to access the 10.9.3.0/24 while
    >using the Access VPN at least in 6.3?


    Correct.

    >And is it possible in 7.2 (after
    >changing PIX506e by an ASA55xx)?


    In the context of your configuration, Yes.

    When you wrote "Access VPN" there was a possibility that you
    meant a "management VPN"; I don't know if management VPNs can
    access the other VPNs in 7.2. But you aren't using a management
    VPN so it is not an issue for you.
     
    Walter Roberson, Feb 28, 2008
    #2
    1. Advertising

  3. Laurent

    Laurent Guest

    Hello Walter;

    Thanks for your reply.

    By "Access VPN" I mean a VPN using Cisco Client VPN.

    I will try in 7.2 to setup one of our devices operatinf in 7.2 before
    having our customer buy an ASA55xx

    Laurent.
     
    Laurent, Mar 1, 2008
    #3
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Frank Fegert

    LAN2LAN and Client VPN to PIX

    Frank Fegert, Sep 2, 2004, in forum: Cisco
    Replies:
    0
    Views:
    532
    Frank Fegert
    Sep 2, 2004
  2. Robert Hass

    PIX 506E and Internet Access via VPN

    Robert Hass, Jun 3, 2006, in forum: Cisco
    Replies:
    1
    Views:
    1,639
    Walter Roberson
    Jun 4, 2006
  3. Thomas
    Replies:
    4
    Views:
    382
    Thomas
    Dec 14, 2006
  4. bumblefoot

    Cisco Remote client access to LAN2LAN

    bumblefoot, Feb 13, 2010, in forum: General Computer Support
    Replies:
    0
    Views:
    2,038
    bumblefoot
    Feb 13, 2010
  5. m0bilitee
    Replies:
    0
    Views:
    1,178
    m0bilitee
    Sep 19, 2011
Loading...

Share This Page