Solved: Re: VPN through Pix 515

rok.tisler · ‎09-24-2004

Hello to forum, i have one question please reply if someone knows the answer..

Here is my scenario:

Central location Pix515 (192.168.0.0/24)

Location 1: (192.168.1.0/24)

Location 2: (192.168.2.0/24)

Location 3: (192.168.3.0/24) local pool for vpn clients

IPSEC from 192.168.0.0/24 to 192.168.1.0/24 lan-lan

IPSEC from 192.168.0.0/24 to 192.168.2.0/24 lan-lan

IPSEC from 192.168.0.0/24 to 192.168.3.0/24 ezvpn

Question:

Is it posible to connect Location1 and Location2 through Pix, or Location1 and Location3 ?

On the encryption acl on each location trafic destined for other location is included for encryption process.

for example location1 acl:

access 100 per 192.168.1.0 255.255.255.0 192.168.0.0 255.255.255.0

access 100 per 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0

access 100 per 192.168.1.0 255.255.255.0 192.168.3.0 255.255.255.0

other locations have similar acl-s

There is no problem for locations accessing 192.168.0.0/24, but trafic between locations does not work.

I think that pix wont encrypt packets ariving from outside.

I know, that this is posible on IOS with IPSEC over GRE tunnels with some routing, but PIX ??

Rok

pcomeaux · ‎09-24-2004

Hi Rok -

Permitting traffic between VPN sites does not currently work with Pix OS 6.3.4 and earlier. Pix 7.0 code, which will be released later this year, will permit traffic between same security level VPN interfaces. This will allow spoke to spoke communication. I configured this last week with Pix 7.0 beta code, so I know it is a new feature and it will work.

IOS does not have this limitation with IPSec. GRE is not required by IOS to make spoke to spoke communication work, though it could be used.

Hopefully this helps you understand what's happening.

Please let us know what follow up questions you have.

thanks!

peter

ps. pls be sure to rate the posts so others will know if we have provided you the information you need!

View solution in original post

pcomeaux · ‎09-24-2004