pix 501 vpn in passive mode

[kevin.felts]

I need to set up a site to site vpn, but the 501 has to be in a passive mode. It can NOT iniate the vpn. Everyone I talk to says it can not be done. Well, the device is in passive with software vpn clients, why can that not apply to a site to site?? Main site has a T1 501 is on dsl with pppoe.

[maraz]

Hello,

Well, you could use the 501 as an Easy VPN client in "client mode" not network extension mode. The tunnel will not be established as long there is no "interesting" trafik. What do you mean by passive mode? Do you still want users to authenticate before going to central site? Then you must complement with IUA = individual user authentication. Also you can enable SUA = secure unit authentication.

If this does not help then please clarify what you are trying to accomplish.

Best Regards

Robert Maras

[kevin.felts]

I need the 501 to be "waiting" for a device to connect to it to form a site to site vpn. The other gateway to a Linksys RV042.

[maraz]

Hello,

Sorry, but you must be more specific about how you want the whole scenario to be. I can not guess what you are trying to do.

Best Regards

Robert Maras

[kevin.felts]

The goal is to create a site to site vpn, that stays connected, with a split tunnel. So users can log into a windows domain from the remote sites via vpn, share printers across vpn, but all web traffic does not cross the vpn. The 501 can NOT iniate the connection, that has to be done from the home office. Two remote offices with pix 501's and home office with Linksys rv042. Once the tunnel is up, it stays connected. One person I spoke with said the 501 has to be able to iniate the connection if that network needs resoures from the main office. It can not work that way, once connected it stays connected, if the vpn is lost, the 501 waits for the main office to reconnect.

[maraz]

Hello,

Then Easy VPN-client with NE network extension mode should do it for you. Since you are doing split-tunnel on the PIX you need the "vpnclient ne-st-autoconnect". Your tunnel will always be up and resources on the home office will be able to reach the remote-office without them initiating the connection.

Best Regards

Robert Maras