Remote Access And Site To Site VPN

Discussion in 'Cisco' started by steviebee_uk, Nov 15, 2006.

  1. steviebee_uk

    steviebee_uk

    Joined:
    Oct 26, 2006
    Messages:
    2
    Likes Received:
    0
    Hello,
    Can someone help please - I have successfuly configured a Site-To-Site VPN between 2 sites however when I try and add a Remote access VPN onto the same PIX it brings down the Site to Site vpn. I am not great with VPN' s and created the Site-To-Site and remote access VPN's with the wizard.

    Config below.

    PIX Version 6.3(1)
    interface ethernet0 auto
    interface ethernet1 auto
    interface ethernet2 auto
    interface ethernet3 100full
    interface ethernet4 auto
    interface ethernet5 auto
    nameif ethernet0 outside security0
    nameif ethernet1 inside security100
    nameif ethernet2 intf2 security60
    nameif ethernet3 intf3 security5
    nameif ethernet4 intf4 security80
    nameif ethernet5 interconnect security10
    enable password xb9n6y9ZRqJ3/fXv encrypted
    passwd xb9n6y9ZRqJ3/fXv encrypted
    hostname DirectDPIX
    domain-name DFAS.co.uk
    fixup protocol ftp 21
    fixup protocol h323 h225 1720
    fixup protocol h323 ras 1718-1719
    fixup protocol http 80
    fixup protocol ils 389
    fixup protocol rsh 514
    fixup protocol rtsp 554
    fixup protocol sip 5060
    fixup protocol sip udp 5060
    fixup protocol skinny 2000
    no fixup protocol smtp 25
    fixup protocol sqlnet 1521
    names
    name 172.16.0.0 DDDearne
    access-list inside_outbound_nat0_acl permit ip 172.18.0.0 255.255.0.0 DDDearne 255.255.0.0
    access-list inside_outbound_nat0_acl permit ip 172.18.0.0 255.255.0.0 172.10.1.0 255.255.255.240
    access-list intf2_cryptomap_20 permit ip 172.18.0.0 255.255.0.0 DDDearne 255.255.0.0
    access-list intf2_cryptomap_dyn_20 permit ip any 172.10.1.0 255.255.255.240
    pager lines 24
    logging monitor debugging
    logging buffered debugging
    mtu outside 1500
    mtu inside 1500
    mtu intf2 1500
    mtu intf3 1500
    mtu intf4 1500
    mtu interconnect 1500
    ip address outside x.x.x.x 255.255.255.240
    ip address inside 172.18.2.252 255.255.0.0
    ip address intf2 192.168.2.3 255.255.255.0
    no ip address intf3
    no ip address intf4
    ip address interconnect 192.168.253.5 255.255.255.252
    ip audit info action alarm
    ip audit attack action alarm
    ip local pool DDRemotePool 172.10.1.1-172.10.1.10
    failover
    failover timeout 0:00:00
    failover poll 15
    failover ip address outside x.x.x.x
    failover ip address inside 172.18.2.251
    no failover ip address intf2
    no failover ip address intf3
    no failover ip address intf4
    failover ip address interconnect 192.168.253.6
    failover link interconnect
    pdm location 172.18.0.0 255.255.0.0 inside
    pdm location 192.168.52.0 255.255.255.0 inside
    pdm location DDDearne 255.255.0.0 outside
    pdm location DDDearne 255.255.0.0 intf2
    pdm location 81.149.163.96 255.255.255.255 intf2
    pdm history enable
    arp timeout 14400
    global (outside) 1 213.52.162.100
    nat (inside) 0 access-list inside_outbound_nat0_acl
    nat (inside) 1 0.0.0.0 0.0.0.0 0 0
    route outside 0.0.0.0 0.0.0.0 213.52.162.97 1
    route intf2 81.149.163.96 255.255.255.255 192.168.2.1 1
    route inside 192.168.52.0 255.255.255.0 172.18.1.252 1
    timeout xlate 3:00:00
    timeout conn 24:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
    timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout uauth 0:05:00 absolute
    aaa-server TACACS+ protocol tacacs+
    aaa-server RADIUS protocol radius
    aaa-server LOCAL protocol local
    aaa-server partnerauth protocol radius
    http server enable
    http 172.18.0.0 255.255.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    no snmp-server enable traps
    floodguard enable
    sysopt connection permit-ipsec
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto dynamic-map intf2_dyn_map 20 match address intf2_cryptomap_dyn_20
    crypto dynamic-map intf2_dyn_map 20 set transform-set ESP-3DES-SHA
    crypto map intf2_map 20 ipsec-isakmp
    crypto map intf2_map 20 match address intf2_cryptomap_20
    crypto map intf2_map 20 set peer 0.0.0.0.
    crypto map intf2_map 20 set transform-set ESP-3DES-SHA
    crypto map intf2_map 65535 ipsec-isakmp dynamic intf2_dyn_map
    crypto map intf2_map interface intf2
    isakmp enable intf2
    isakmp key ******** address 0.0.0.0 netmask 255.255.255.255 no-xauth no-config-mode
    isakmp policy 20 authentication pre-share
    isakmp policy 20 encryption 3des
    isakmp policy 20 hash sha
    isakmp policy 20 group 2
    isakmp policy 20 lifetime 86400
    vpngroup DDRemoteGroup address-pool DDRemotePool
    vpngroup DDRemoteGroup dns-server 172.18.1.1 172.18.1.2
    vpngroup DDRemoteGroup idle-time 1800
    vpngroup DDRemoteGroup password ********
    telnet 172.18.0.0 255.255.0.0 inside
    telnet 192.168.52.0 255.255.255.0 inside
    telnet timeout 60
    ssh timeout 5
    console timeout 0
    terminal width 80
    Cryptochecksum:4150563adcc7eab8de9357edb0a58e85



    Thanks

    Stephen
     
    Last edited: Nov 15, 2006
    steviebee_uk, Nov 15, 2006
    #1

    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.
Similar Threads

  1. PIX - Site-to-Site VPN and VPN Client access

  2. site-to-site VPN tunnel with remote VPN clients

  3. Vpn site to site + vpn cisco client access list problem.

  4. PIX 501 Site-to-Site VPN and Remote Access VPN

  5. Site-to-Site VPN and VPN Client access

  6. VPN site to site & Remote access VPN ( vpn client) over the same interface

  7. Trying to access the PDM of a Cisco pix over a Remote Access VPN withCisco VPN Client

  8. Cisco VPN with Site to Site and Remote Access

Loading...