VPN Client 3.5x behind 803 with NAT to PIX 515

[bkisters]

The home office router 803 connects call-by-call to the Internet.

Is it possible to run a VPN Client on the ethernet of the router against the PIX?

Are there special things to configure on that router?

A direct connection from the Client, it dials direct to the internet, works together with PIX.

[vijkrish]

Yes, it is possible. No config is needed on the router (other than NAT).

See notes below from URL:

http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122relnt/800/rn800xi.htm

IP Security Through Network Address Translation Support

Cisco IOS Release 12.2(2)XI IP Security (IPSec) supports clients that do not use TCP wrapping or UDP wrapping. On Cisco 80-804 routers and Cisco 806 routers, this feature allows clients

that have wrapping disabled, or clients that do not support wrapping, to use IPSec. Each client creates an IPSec tunnel, and NAT translates the private IP addresses of these packets to public

IP addresses.

On the Cisco 801, 802, 803 or 804 routers, you must enter the following global configuration mode command for this feature to work:

ip nat inside source list number interface bri number overload

In this command, number refers to the source list number, and the basic rate interface number, respectively. The document at the following URL contains an example configuration:

[bkisters]

Hi,

thanks for the good anwser to my question.

The URL for the example is missing.

bernd

[vijkrish]

You are welcome. I am able to view the entire posting and the URL is indeed there. Try viewing entire posting and if still problem, let me know and I will send the posting via

email.

Best Regards.

[bkisters]

Ok, one last question to that problem. I am using ios rel. 12.0.7-t and does really not work.

Do I need the release to mentioned in your first answer?

much thanks and best regards

bernd

[vijkrish]

Yes, if you want this feature, then you need to use that IOS. Also keep in mind that T train (images with T in their name - technology train) and XB (limited life time) are used for new feature introductions and with every new feature there could be some minor issues. Best bet is to run a mainline IOS image or

to use an interim or limited life time based image.