Cisco PIX 501 vpngroup user need to be assigned a static IP

Feb 05, 2007 3 Replies
A

Can someone help me? I would like to configure the individual user to obtain a static IP via VPN, this is necessary so I can map to the local printers at the client machine.



The internal network is using 192.168.0.x address, and the VPN IPs are assigned 10.11.11.x address, a DHCP for the VPN is setup from



10.11.13.1-10.11.13.100, but i would like to assign this testuser account using 10.11.13.101 is this possible? Can someone enlighten me with the commands? Thanks much!

access-list vpn_in permit ip 192.168.0.0 255.255.255.0 10.11.11.0



255.255.255.0 ip local pool vpnclient 10.11.11.1-10.11.11.100 vpngroup testuser address-pool vpnclient vpngroup testuser split-tunnel vpn_in vpngroup testuser idle-time 1800 vpngroup testuser password ********
Vote
Twitter Facebook LinkedIn
W

Give them an address-pool that consists only of the one address. Note that this requires that they be in a distinct vpngroup. I don't believe there is any way to assign an IP address from RADIUS for example (and I have no clue whether that kind of thing becomes possible in PIX 7.x .)

Vote
Twitter Facebook LinkedIn
A

Walter,

Thank you so much for responding to my post; howeve, i am still unsure what I needed to do command wise.

if i am using the config below, how do i assign a static IP for each user/group? in otherwords, how do i assign a specific IP address to be used for each VPN group?

access-list vpn_in permit ip 192.168.0.0 255.255.255.0 10.11.11.0

255.255.255.0 ip local pool vpnclient 10.11.11.1-10.11.11.100 vpngroup testuser address-pool vpnclient vpngroup testuser split-tunnel vpn_in vpngroup testuser idle-time 1800 vpngroup testuser password ******** vpngroup testuser2 address-pool vpnclient vpngroup testuser2 split-tunnel vpn_in vpngroup testuser2 idle-time 1800 vpngroup testuser2 password ********
Vote
Twitter Facebook LinkedIn

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required