1. Home
  2. Cisco Systems
  3. 2 VPN's Interface Issues

2 VPN's Interface Issues

Hi folks,

I have a PIX 501 with public IP on the outside interface. I want to setup 2 VPNs on 2 other companies VPN devices or using cisco vpn client, both would connect to the outside interface. If I do this will clients on both the companies VPNs be able to talk to each other? I'm thinking of the rule "pix can't route traffic back through the same interface it came in on" or does this rule not apply when were talking about VPN's?

Company1 Company2 | / Public IP PIX

If it did apply then could I have 2 PIX 501's, one pix (pix1) with the outside interface mapped to a public IP and another pix (pix2) with the outside interface mapped to an internal IP but NAT'd to a public IP (nating would be done by pix1) one of my vpn's could terminate at pix1 and the other at pix2. This would ensure traffic travelled over both interfaces of pix1.

Company1 | Public IP Pix1 Internal IP | Internal IP (nat'd to public IP) - Company 2 Pix2

surely there would be an easier way to do this? If you can recommend any other way or any other devicae rather than a pix then let me know. Also don't worry about security between company 1 and 2, I'm just using these as easy to follow examples.

Any help would be gratefully received.

cheers Dave

Reply to
Dave
Loading thread data ...

Hi,

You're right, the VPN's will NOT be able to communicate with eachother. The rule "pix can't route traffic back through the same interface it came in on" still applies for the PIX501. This issue has been "fixed" in PIX OS 7.0, wich is currently not available for the PIX 501.

Erik

Reply to
Erik Tamminga

Thankyou Erik,

It looks like our best option, but looks like we'll have to spend some cash on a 515 or similar. I now have another question which posted separatly.

Dave

Reply to
Dave

In article , Dave wrote: :It looks like our best option, but looks like we'll have to spend some :cash on a 515 or similar.

If you have more than one public IP address and can spare one, then you can add a second PIX 501 to your network. One party would VPN to one of them, the other party would VPN to the other, and because the packets would not be going out the -same- interface they came in on, the PIX would be perfectly happy. (This kind of configuration does work -- we've done effectively that here.)

Reply to
Walter Roberson

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.