Adding an extra VPN tunnel to a PIX515

[jamescork]

Hi,

I've already built a VPN connection between my head office and our first branch office between two PIX 515s.

I assumed adding another would mean little more than repeating the set up of my first tunnel but with new identifiers for the isakmp policy, access-list and crypto map.

Consequently, I issue these commands:

isakmp policy 9 authentication pre-share

isakmp policy 9 encrypt des

crypto isakmp key cisco1234 address some.public.ip.address

crypto ipsec transform-set strong esp-des esp-sha-hmac

access-list crossvpn permit ip 192.168.0.0 255.255.255.0 10.0.0.0 255.255.255.0

nat 0 access-list crossvpn

crypto map tootherpix 20 ipsec-isakmp

crypto map tootherpix 20 match address crossvpn

crypto map tootherpix 20 set transform-set strong

crypto map tootherpix 20 set peer some.public.ip.address

And all is fine, however, the moment I issue:

crypto map tootherpix interface outside

The original tunnel drops and the running-config shows the line:

crypto map originallink interface outside

Has disappeared, which I assume is the reason.

How can I get multiple end points on one PIX?

[mostiguy · Accepted solution]

You can only have one map per interface.

What you want:

1. A unified ACL for all no natting - must have lines for all sites for which there are tunnels

2. Unique ACLs for each site for crypto ACL purposes, aka access-list siteA, access-list siteB, etc.

3.

crypto map xxxxx 5 match address siteA

crypto map xxxxx 5 set peer site.a.ip.here

crypto map xxxxx 10 match address siteB

crypto map xxxxx 10 set peer site.b.ip.here

crypto map xxxxx interface outside

isakmp key ***** address site.a.ip.here netmask 255.255.255.255

isakmp key ***** address site.b.ip.here netmask 255.255.255.255

[jamescork]

Thanks for that, seems blindingly obvious in hindsite.

The tunnel is up and whilst I can ping hosts on either side - I can't seem to get any other traffic through. My nonat ACL and crossvpn ACL are active otherwise I assume I would not be able to ping over the tunnel and they both specify "ip" as the data type.

Any thoughts on what could be missing?

[jamescork]

Sorted, so busy looking at the tunnel...I forgot to add the change required to my inside_in ACL!

Thanks for your help!