Multiple ISPs and gateways with a PIX 525?

Yes, of course...do a simple host route for the VPN pointing to the second ISP and that specific interface. Your route statement is un-needed, the Pix will know automatically what interfaces are connected. You need a host route on the Pix for the VPN peer "route Eth4 host X.X.X.X 72.45.165.193" (The X.X's being the VPN peer). As long as it is a P2P tunnel and not for dynamic VPN's. Neither the Pix nor the ASA has policy rouing abilities

also bear in mind that you can only enable cryptomaps on one single interface ...

HTH Martin

Did it change with 7.x? I don't see any problems with creating more the one crypto map and applying it to different interfaces.

Dont think so, correct that you can have several map, but the enable command is only applied once.

Ypu can apply different maps on different interfaces or the same map on different interfaces but only one map per interface.

Regards

fw

"Frank Winkler" skrev i en meddelelse news: snipped-for-privacy@mid.individual.net...

Thx for clearing that for us, Frank.

Is it correct, that you refer to PIXOS 7.x and not 6.x ?

YRW!

No, I've neer seen PixOS 7 yet :( ...

Regards

fw

hmm - I am not sure If I agree with you or i am misunderstanding.

you can not have VPN tunnels terminating on several interface at the same time, different maps or the same. or can you ?

I think about the command: crypto map MAPNAME interface outside and isakmp enable outside

As theses commands disallow you from do that.

You can.

Yes, You can do: crypto map MAPFIRST interface outside isakmp enable outside crypto map MAPSECOND interface inside isakmp enable inside

Erm, disallow what?

You can even do

crypto map MAPFIRST interface inside

at the same time. This may not make too much sense in all cases but basically it works. I'm using it for testing VPN client setup from inside.

Regards

fw

ok - That concludes it then. Thanks to you both .

/Martin

Thanks for the reply, Brian.

So what you're saying is that I need a static route from Eth4 (i.e.

72.45.165.193) to the external interface of the other PIXes that I'm connecting to? That makes sense to me.

Chris

Micha=C5=82,

I'm a little confused by this discussion. I plan on having two sets of VPN traffic connecting to my PIX 525. Specifically, I would like clients using Cisco's software VPN Client to connect to the VPN through the Eth0 interface (64.223.x.9); and then site-to-site VPNs (using PIX 501s) connect to PIX 525 via the Eth4 interface (72.45.x.

194).

Could you please clarify for me whether or not this is possible?

Chris

Of course it is. Just configure two crypto maps, one for each interface, and apply it.

Okay, I just wanted to make sure. Thanks Micha=C5=82!

Chris

Do I need to add a "global" command? Once I had configured what I thought was necessary, the VPN tunnel came up (as evidenced by the LED on the front of the 501) but no traffic would pass through the link. "show logging" on the 525 indicated that there was no translation in place for the selected protocol...

Chris

Do I need to add a "global" command? Once I had configured what I thought was necessary, the VPN tunnel came up (as evidenced by the LED on the front of the 501) but no traffic would pass through the link. "show logging" on the 525 indicated that there was no translation in place for the selected protocol...

Chris

Most likley a nat 0 is needed for the interface pointing to the nonat access-list. Can't help you much more than that without the config.

-Brian

On Feb 22, 6:14 pm, "Brian V" wrote:

I have added a "nat 1" command (I'm already using nat 0 for something else, perhaps that's my problem?) but I still seem to have the same problem. The tunnel is up (even a "show crypto isakmp sa" says that it is), but I can't pass traffic over it. Any thoughts? "show logging" on the 525 produced this error:

305005: No translation group found for icmp src twc:172.20.13.1 dst inside:172.16.1.133 (type 8, code 0) 172.16.1.133 is a machine on the local (local to the 525) LAN, 172.20.13.1 is the IP address of the client at the remote site.

Here is the config of the main office 525:

interface ethernet0 100full interface ethernet1 auto interface ethernet2 auto interface ethernet3 auto interface ethernet4 auto interface ethernet5 100full nameif ethernet0 outside security0 nameif ethernet1 inside security100 nameif ethernet2 mtz security90 nameif ethernet3 dmz security50 ! this is the ethernet interface i'm using nameif ethernet4 twc security8 nameif ethernet5 state security75 fixup protocol dns fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 names access-list pphvpnlist permit ip 172.16.0.0 255.255.0.0 172.16.23.0

255.255.255.0 access-list pphvpnlist permit ip 172.16.0.0 255.255.0.0 172.16.22.0 255.255.255.0 access-list pphvpnlist permit ip 172.16.0.0 255.255.0.0 172.16.24.0 255.255.255.0 access-list pphvpnlist permit ip 172.16.0.0 255.255.0.0 172.16.25.0 255.255.255.0 access-list pphin permit tcp host 64.223.x.4 host 64.223.x.13 access-list pphin permit udp host 64.223.x.4 host 64.223.x64.240.x.13 access-list pphin permit icmp any any echo-reply access-list pphin permit tcp any host 64.223.x.10 eq www access-list pphin permit tcp any host 64.223.x.10 eq ftp access-list pphin permit tcp any host 64.223.x.10 eq https access-list pphin permit tcp any host 64.223.x.12 eq www access-list pphin permit tcp any host 64.223.x.12 eq https access-list mtzin permit tcp any host 192.168.0.159 access-list mtzin permit tcp any host 192.168.0.170 access-list mtzin permit tcp any host 192.168.0.136 access-list mtzin permit tcp any host 192.168.0.138 access-list nonat permit ip 172.16.0.0 255.255.0.0 172.20.13.0 255.255.255.0 ! the ACL i'm trying to use access-list TEST permit ip 172.16.0.0 255.255.0.0 172.20.13.0 255.255.255.0 ! ditto pager lines 24 icmp deny any outside icmp permit any echo-reply outside icmp permit any echo-reply dmz mtu outside 1500 mtu inside 1500 mtu mtz 1500 mtu dmz 1500 mtu twc 1500 mtu state 1500 ip address outside 64.223.x.9 255.255.255.240 ip address inside 172.16.1.181 255.255.0.0 ip address mtz 192.168.0.181 255.255.255.0 ip address dmz 172.30.1.1 255.255.255.0 ip address twc 72.45.x.194 255.255.255.248 ip address state 10.1.1.1 255.255.255.0 ip verify reverse-path interface outside ip verify reverse-path interface inside ip audit info action alarm ip audit attack action alarm ip local pool vpnpool1 172.16.22.1-172.16.22.255 ip local pool vpnpool2 172.16.23.1-172.16.23.255 ip local pool vpnvendorpool 172.16.24.1-172.16.24.255 failover failover timeout 0:00:00 failover poll 15 failover ip address outside 64.223.x.11 failover ip address inside 172.16.1.182 failover ip address mtz 192.168.0.182 failover ip address dmz 172.30.1.2 failover ip address twc 72.45.x.195 ! this is the interface i'm concerned about failover ip address state 10.1.1.2 failover link state pdm location 172.16.0.0 255.255.0.0 inside no pdm history enable arp timeout 14400 global (outside) 2 interface global (mtz) 2 interface global (dmz) 2 interface nat (inside) 0 access-list pphvpnlist nat (inside) 1 access-list nonat 0 0 ! and this is the ACL nat (inside) 2 172.16.0.0 255.255.0.0 0 5000 nat (mtz) 2 192.168.0.0 255.255.255.0 0 5000 nat (dmz) 2 172.30.1.0 255.255.255.0 0 5000 static (inside,dmz) tcp 172.30.1.20 ftp 172.16.1.128 ftp netmask 255.255.255.255 0 0 static (inside,dmz) tcp 172.30.1.39 ftp 172.16.1.39 ftp netmask 255.255.255.255 0 0 static (dmz,outside) tcp 64.223.x.10 www 172.30.1.3 www netmask 255.255.255.255 0 5000 static (dmz,outside) tcp 64.223.x.10 ftp 172.30.1.3 ftp netmask 255.255.255.255 0 5000 static (inside,mtz) 192.168.0.159 172.16.1.159 netmask 255.255.255.255 0 2000 static (inside,mtz) 192.168.0.170 172.16.1.170 netmask 255.255.255.255 0 2000 static (inside,mtz) 192.168.0.136 172.16.1.36 netmask 255.255.255.255 0 2000 static (inside,mtz) 192.168.0.138 172.16.1.38 netmask 255.255.255.255 0 2000 static (inside,dmz) 172.30.1.8 172.16.1.8 netmask 255.255.255.255 0 5000 static (inside,outside) 64.223.x.8 172.16.1.116 netmask 255.255.255.255 0 0 access-group pphin in interface outside access-group mtzin in interface mtz access-group dmzin in interface dmz route outside 0.0.0.0 0.0.0.0 64.223.x.1 1 route twc 63.118.x.135 255.255.255.255 72.45.165.193 1 ! this is the route timeout xlate 4:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout uauth 0:00:00 absolute uauth 2:00:00 inactivity aaa-server TACACS+ protocol tacacs+ aaa-server RADIUS protocol radius aaa-server RADIUS (inside) host 172.16.1.5 private timeout 5 aaa-server LOCAL protocol local aaa authentication exclude http inside 172.16.1.0 255.255.255.0 0.0.0.0 0.0.0.0 RADIUS aaa authentication include http inside 172.16.0.0 255.255.0.0 0.0.0.0 0.0.0.0 RADIUS ntp server 172.16.1.223 source inside floodguard enable sysopt connection permit-ipsec sysopt noproxyarp inside crypto ipsec transform-set myset esp-3des esp-md5-hmac crypto ipsec transform-set testset esp-3des esp-md5-hmac crypto dynamic-map dynamap 30 set transform-set myset crypto map pph 20 ipsec-isakmp dynamic dynamap crypto map pph client configuration address initiate crypto map pph client configuration address respond crypto map pph client authentication RADIUS crypto map pph interface outside crypto map site-vpn 13 ipsec-isakmp ! this is the site-to-site VPN i'm trying to use crypto map site-vpn 13 match address TEST crypto map site-vpn 13 set peer 63.118.x.135 crypto map site-vpn 13 set transform-set testset crypto map site-vpn interface twc isakmp enable outside isakmp enable twc isakmp key ******** address 63.118.x.135 netmask 255.255.255.255 isakmp identity address isakmp keepalive 10 isakmp nat-traversal 20 isakmp policy 1 authentication pre-share isakmp policy 1 encryption 3des isakmp policy 1 hash md5 isakmp policy 1 group 2 isakmp policy 1 lifetime 86400 vpngroup vpnclient address-pool vpnpool2 vpngroup vpnclient dns-server 172.16.1.223 172.16.1.136 vpngroup vpnclient idle-time 3600 vpngroup vpnclient password ******** vpngroup pphvpn address-pool vpnpool1 vpngroup pphvpn dns-server 172.16.1.223 172.16.1.136 vpngroup pphvpn idle-time 3600 vpngroup pphvpn password ******** vpngroup vpn-client idle-time 1800 vpngroup vpnvendor idle-time 1800 vpngroup vpnvendor password ********

Chris

You need to add to the nonat list or create another one and apply it on the new interface.