How can i use a site-to-site tunnel through another PIX?

Thanks for taking the time to read my request for a little help. We
currently have a site-to-site vpn tunnel connected from the
branch-office to another pix at the main-office. The pix in the
main-office have another site-to-site tunnel to a vpn 3000 concentrator.

From here on i'll be refering to each location by a single character:
* [A] - Branch office (PIX 501)
* - Main office (PIX 501)
* [C] - Off site (VPN 3000 Concentrator)

What i want is to be able to connect to an IBM iSeries Server running
on the inside of [C] from [A]. But without creating a new vpn-tunnel
from [A] to [C]. In other words i want to use the tunnel from [A] to
in order to reach server on [C]. How can this be done? or can it be done
at all? If something is not clear please post so that i may clarify the
situation.

Before i forget, if somone knows a good resource for information
regarding securing a pix (pref. including model 501) please post below.


Thanks in advance, John

 

I think you need to add in the "protect rules" the net behind C in the A conf and obviously
viceversa. Add rules to forward packet in b from A to C and viceversa. If you post your config files
I should help you better.

IMHO, Alex.

 

:We
:currently have a site-to-site vpn tunnel connected from the
:branch-office to another pix at the main-office. The pix in the
:main-office have another site-to-site tunnel to a vpn 3000 concentrator.

:What i want is to be able to connect to an IBM iSeries Server running
n the inside of [C] from [A]. But without creating a new vpn-tunnel
:from [A] to [C]. In other words i want to use the tunnel from [A] to
:in order to reach server on [C]. How can this be done? or can it be done
:at all?

[At least until 7.0] the PIX will never forward a packet out the
same [logical] interface it came in on, even if two different
tunnels are involved.

:Main office (PIX 501)

Unfortunately the PIX 501 does not support logical interfaces,
just physical interfaces, so there is no way to do what you want
without adding more hardware or changing the hardware.

If you were using any other 500 series PIX device (other than the 510)
and had sufficiently new software, you could handle this by
creating a logical interface on the outside of the PIX and assigning
it into a different subnet; then you would have the tunnel A<->B
terminate on a different logical interface than the tunnel B<->C did
and you would then not be in violation of the forwarding rules.
A logical interface receives traffic with an IEEE 802.1Q VLAN tag,
so your WAN router would need to have 802.1Q support for that approach
to work.

PIX version 7.0 has been officially announced with software due out
soon, and it does not have this restriction -- but the initial 7.0
release supports only the 515/515E, 525, and 535. I would -expect- that
eventually it will support the 501 and 506/506E (7.1 I suspect),
but not yet.

 

Thanks for the reply with a good explaination of the matter. The easiest
thing todo atm. would then be to contact the company who has the vpn
concentrator and make them setup a configuration for another tunnel.
Hopefully Cisco will release PIX 7.0 for the 501 models aswell.

Thanks, John

 

I supposed his tunnels terminated on different interface. Sorry for the mistakes! I haven't read his
article well enough!

Alex.

 

....

You can't do this.