Site to Site VPN between PIX 6.3(3) and PIX 7.0(1)

[snowvalley]

Hi All,

I'm trying to configure a site to site VPN between my office and a new site. This is my first time doing an actual site to site VPN, in the past we've always just used MS PPTP VPN's.

My office firewall is a PIX 506e running 6.3(3), and unfortunately this cannot be upgraded to 7.0.

My new site has a pair of PIX 525's in a failover configuration, running version 7.0(1).

The only documentation I've been able to find on this subject is this one http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a0080094761.shtml, which corresponds to an even older version of the firewall software (though the commands seemed valid on the 6.3 software).

I ran through the VPN wizard in the ASDM on the new sites firewall, and the output produced in the firewall rules didn't really match what I expected. Commands like "ISAKMP key" have been depreciated and replaced with "tunnel-group".

What i'm really after a pointer in the right direction to some documentation that covers this sort of scenario, I can't be the only one trying to link different versions of PIX together.

[shijogeorge]

Hi,

Check if this link helps.

http://www.cisco.com/en/US/partner/products/hw/vpndevc/ps2030/products_configuration_example09186a00804675ac.shtml

Regards,

Shijo George.

[snowvalley]

Unfortunately my Cisco account doesn't appear to have access to that document, and my reseller is being slow in registering the 525's support contract.

Are you allowed to post the contents of that document?

[shijogeorge]

Please try this link (same doc)

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00804675ac.shtml

Regards,

Shijo George.

[scheikhnajib · Accepted solution]

Hi M8,

In quick words, most of the config is still the same (Transform Sets, ISAKMP policies, Crypto Maps and Crypto ACLs).

The only thing that is changed is the:

isakmp key ***** Address x.x.x.x

and it's replaced by the tunnel-group command:

tunnel-group x.x.x.x type ipsec-l2l

tunnel-group x.x.x.x ipsec-attributes

pre-shared-key *

you will put the peer IP address as the tunnel name and as you can see, you will write down the key in the ipsec-attributes sub-mode.

I would see it straight forward and I think u will find it easy once you get used to the tunnel-group issue.

Hope that helps.

Salem.

[snowvalley]

Thanks guys, I actually got it working in the end (the crytp map on the 6.3 PIX was incorrect, syntax looked fine according to the docs I saw but the PDM said it was wrong, recreated it using the PDM and bob's a relative of yours).

The thing thats screwing me up now is restricting the VPN further than "extended permit IP".

What I'd like to setup is the VPN only accepting RDP traffic (TCP:3389) from the old firewall (internal:10.10.0.0/16) to the new firewall (internal:192.168.0.0/16 & DMZ:172.16.0.0/16).

At the moment with the following rules:

New Firewall:

access-list outside_cryptomap_10 extended permit ip 192.168.0.0 255.255.0.0 10.10.0.0 255.255.0.0

Old Firewall:

access-list outside_cryptomap_10 permit ip 10.10.0.0 255.255.0.0 192.168.0.0 255.255.0.0

These rules allow me to send any traffic I like between the two. However when I try and restrict this traffic to just RDP (i'd settle for bi-directional RDP atm) the firewalls complain that the sets don't match.

I've tried changing it so its source=TCP:>1024 and destination TCP:3389 on the old firewall, and putting the same rule in the new firewall with no joy, I've tried switiching around the orders of the various components with no luck either.

The only thing I can see is an error on the new firewall stating it doesn't have a crypt map for source 10.10.0.0 dest 192.168.0.0, but I can't add this to the firewall as the source network is on the wrong firewall interface.

I think I've missed something obvious here, I'll go look at the docs you guys have already posted in the meantime. hopefully someone can put me out of my misery here :)

[snowvalley]

Fixed it,

The key was disabling "Bypass access check for all IPSec traffic" and then defining which IPSec traffic I wanted to allow on the firewalls outside interface.

Thanks for everybodys help with this. :)