How to use different pre-shared keys for each site ?

[guillerm]

PIX 515, V6.3.3 at central site ;

LinkSys BEFVP41 routers at remote sites ;

all remote site LinkSys routers establish site-to-site VPN with the central PIX thru ADSL connections ;

all these remote sites have non-fixed IP address;

so, the only way to define the ISAKMP peer and the associated pre-shared key is done as follows :

isakmp key secret address 0.0.0.0 netmask 0.0.0.0

So, the preshared key is the same for all remote sites;

Question : How can I do to associate a different pre-shared key for each remote site ?

I have looked at the ISAKMP IDENTITY HOSTNAME command (defaulted on the PIX) and also at the ISAKMP IDENTITY IDENTITY KEY-ID ;

but, I don't understand how the HOSTNAME of the remote LinkSys peer can be declared on the PIX ;

on the LinkSys router, I can define a HOSTNAME but, I cannot know if this HOSTNAME is sent as the ISAKMP identity by this LinkSys router;

I can also define a USERNAME, but this seems to be used only when establishing a VPN from the LinkSys to a SonicWall firewall (to identify the IPSEC SA)

Any help would be appreciated

[crojas]

You could do that with an Cisco EZ VPN compatible device on the other end. Even though Linksys is now a Cisco product, I'm not sure it supports it yet.

The trick is the vpngroup command, which allows you to define multiple vpn groups, each associated with its own set of rules and settings, including its own pre-shared key.

Usage: vpngroup password

vpngroup address-pool

vpngroup dns-server []

vpngroup wins-server []

vpngroup default-domain

vpngroup split-tunnel

vpngroup split-dns domain_name1 [domain_name2 ... domain_name8]

vpngroup backup-server {{ [ ... ]} | clear-client-cfg}

vpngroup pfs

vpngroup idle-time

vpngroup max-time

vpngroup secure-unit-authentication

vpngroup authentication-server

vpngroup user-authentication

vpngroup user-idle-timeout

vpngroup device-pass-through

[guillerm]

Unfortunatly, the LinkSys BEFVP41 router does not support the Esay VPN features with VPNGROUP parameters ;

it is why I asked my question