topic PIX 515 in Network Security

PIX 515

p.holley — Fri, 21 Feb 2020 07:47:03 GMT

Hi,

I have a customer that wants to use a Nortel VPN client sitting behind a cisco PIX, to VPN into the inside network. This is the scenario

Nortel vpnclient --->Cisco pix515-->Internt--->Nortel Firewall---->Inside Network.

What ports do I need to open for the PIX to allow the Nortel vpn client to establish vpn connection to the nortel firewall?

Thanks

Re: PIX 515

Patrick Iseli — Thu, 02 Dec 2004 19:58:45 GMT

sysopt connection permit-ipsec

ISAKMP UDP 500

Protocol ESP, AH

Do you use PAT or NAT for inside users ?

"PAT for ESP". The 6.3.4 code has a new command - 'fixup protocol esp-ike' which will allow 1 (and only 1) IPSec connection through a PIX configured with PAT.

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/cmdref/df.htm#wp1067379

sincerely

Patrick

Re: PIX 515

p.holley — Thu, 02 Dec 2004 20:16:41 GMT

Thanks Patrick,

We are using PAT for inside users. So all I have to do is enter the following commands on the PIX FW:

sysopt connection permit-ipsec

fixup protocol esp-ike

Re: PIX 515

Patrick Iseli — Thu, 02 Dec 2004 21:47:30 GMT

YES

Re: PIX 515

frrosale — Fri, 03 Dec 2004 18:13:56 GMT

One thing to bear in mind is that if you use the FIXUP-PROTOCOL ESP/IKE command, the PIX will loose its IPSEC capabilities.

What the fixup does is to relay the PIX's IPSEC capábilities to the first user that tries to build an IPSEC session through the firewall.

If your firewall already receives IPSEC connections I wouldn't suggest you to use the fixup protocol.

Re: PIX 515

p.holley — Fri, 03 Dec 2004 18:36:54 GMT

The PIX fw already receives IPSEC connection from Cisco vpn clients. Any idea how I get this to work. Thanks