topic Re: VPN issue in Network Security

VPN issue

vinoth.kumar — Mon, 11 Mar 2019 16:14:17 GMT

HI,

we have using PIX 515E and connected a site to site vpn between headoffice and branch office

In our PIX we used three interface

O/S - X.X.80.5

I/S - 10.195.21.X -------Vlan 5 in core switch

I/S 2 - 10.195.1.X ------vlan 6 in core switch

the VPN are working between I/S 2 and remote office but when i ping 10.195.21.X its not pinging

interface Ethernet1

nameif inside

security-level 100

ip address 10.195.21.X 255.255.255.0

interface Ethernet2

nameif inside2

security-level 80

ip address 10.195.1.X 255.255.255.0

the config is

access-list 101 extended permit ip 10.195.0.0 255.255.0.0 192.168.14.0 255.255.255.0

access-list 124 extended permit ip 10.195.0.0 255.255.0.0 192.168.14.0 255.255.255.0

global (outside) 1 interface

nat (inside) 1 0.0.0.0 0.0.0.0

nat (inside2) 0 access-list 101

nat (inside2) 1 0.0.0.0 0.0.0.0

whether it will work if i add no nat for inside also

or need to some ACL to allow remote network to access inside network

Re: VPN issue

acomiskey — Thu, 10 Sep 2009 15:50:29 GMT

Looks like you also need a nat 0 for inside.

access-list 102 extended permit 10.195.21.0 255.255.255.0 192.168.14.0 255.255.255.0

nat (inside) 0 access-list 102

then fix the net and mask for your other acl...

access-list 101 extended permit ip 10.195.1.0 255.255.255.0 192.168.14.0 255.255.255.0

nat (inside2) 0 access-list 101

Re: VPN issue

vinoth.kumar — Thu, 10 Sep 2009 16:13:15 GMT

can i use the same access-list 101 for inside also

like nat (inside) 0 access-list 101

is any problem using this

Re: VPN issue

acomiskey — Thu, 10 Sep 2009 16:17:56 GMT

Like this?

access-list 101 extended permit ip 10.195.0.0 255.255.0.0 192.168.14.0 255.255.255.0

nat (inside) 0 access-list 101

nat (inside2) 0 access-list 101

Yes you can, it should work that way, but it is better to separate them in my opinion.

Re: VPN issue

vinoth.kumar — Thu, 10 Sep 2009 16:26:37 GMT

is there any specfic reason for seperating the access-list

Re: VPN issue

acomiskey — Thu, 10 Sep 2009 16:30:05 GMT

It looks nicer!