VPN to VPN

[ddicky]

I'm a remote VPN users which are connecting to a PIX A firewall VPN server.My PIX A is doing VPN tunnel to tunnel to PIX B which my main email server is sitting behind.My question is can I access my email server thru the remote vpn connection to PIX A and tunneling to PIX B as I don't have PIX B configured to accept remote VPN access.Or advise on any other Cisco device which can do it.

[aacole]

No you will not be able to do this using a PIX. PIX will not allow the same packet to enter and then leave by the same interface. However a router will alllow this when configured for VPN access.

So, either set up PIX B as a VPN server, or swap PIX A for a router with VPN and firewall support. My preference would be to retain the PIX's as I consider them to be more secure than the router option.

[ddicky]

thks,How about replacing PIX A with VPN concentrator as a termination point?Can the VPN concentrator etc 3020 do the job?

[satish77]

yes replacing the PIX with a concentrator will definetly work or have a perimeter router in front of the B PIX and thsi will work as well, PIX will not allow you traffic two ways on one interface.

[MHNaveen]

• Enable Traffic Forwarding on PIX A: Configure PIX A to allow traffic from the remote VPN users to be forwarded through the VPN tunnel to PIX B. This often involves creating an access list on PIX A to permit traffic from the VPN pool towards the IP range of devices behind PIX B.

• Configure NAT Exemptions: Ensure that traffic between the remote VPN users and resources on PIX B is exempt from NAT if necessary. This is done by setting up NAT exemption rules for VPN traffic.

• Check Security Policies and Routing: Ensure that both firewalls have proper security policies and routing in place. PIX B should have routes that direct return traffic for remote users back to PIX A through the tunnel.

[georgehenry6672]

Yes, you can access your email server behind PIX B through your remote VPN connection to PIX A, as long as PIX A is configured to route traffic through the tunnel to PIX B. Here’s how to make it work:

1. Configure Split Tunneling: Ensure PIX A’s VPN setup allows split tunneling so that traffic destined for the network behind PIX B routes through the VPN tunnel.

2. Set Up Routing on PIX A: On PIX A, configure a route to send traffic destined for the email server’s network (behind PIX B) through the existing tunnel to PIX B.

3. Access Control: Ensure that appropriate access lists on PIX A and PIX B allow VPN traffic between the remote client and the email server’s IP range.