pix site to site - is spoke to spoke possible ?

chang-michael · ‎07-20-2003

Hello,

we're trying to set up over 30 site to site vpns in a hub-and-spoke and model where both the hub and spoke boxes are pix. I know usually spoke to spoke communication is not allowed throught the hub pix. Is there any workaround or do we have to move a 3000 for the hub ?

Tks

gfullage · ‎07-20-2003

Spoke to spoke communication is only possible if the spokes terminate on different interfaces in the PIX. With over 30 spokes that's not going to be possible.

Your best bet is to use a 3000 for this, put it in parallel with the PIX or behind it (with a static translation through the PIX for it) and use it for all your VPN traffic, and use the PIX for all your outgoing Internet traffic.