VPN Client to VPN Client through single PIX

[scottcraig]

I'm trying to find out if it is possible for two VPN clients tunneled to the same PIX can talk directly. I am aware that in version 7 code they added a new command to allow IPSEC traffic to both enter and leave the same interface. However, all the examples show this between PIX's with different subnets behind them. What if we're talking about two clients that essentially sit on the same IP subnet? Will it still push the traffic through?

Any documentation or experience would be greatly helpful. Thanks!

[jackko]

i am thinking if you configure two different vpn groups as well as the vpn client pools, then it may work by following the guide "enhanced spoke-to-client vpn configuration example for pix security appliance version 7.0".

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a008046f307.shtml

e.g.

vpn client group 1 (192.168.100.0) <--> pix v7 outside interface

vpn client group 2 (192.168.101.0) <--> pix v7 outside interface

[scottcraig]

Thanks for the reply. This would still require two different groups - and for two individuals to use this feature they would have to know to sign into differing groups. Definitely not an ideal situation. My hope is that it will work for a single subnet,