PIX 501 newbie guestion

Dec 31, 2006 6 Replies
R
PIX 501 newbie guestion open original image

Hello,



I am a Cisco challenged newbie with a desire to learn.



Our current network has a site to site VPN using 2 PIX-501's. I need to configure another site to site VPN connection with an additional PIX 501 to only one of the other network. I have no need to connect to PIX1, only PIX2 to PIX3 using IPSec. All PIX's are version 6.3



Do I need to do a hub & spoke connection? If so the Cisco example diagram I found shows a need for a hub from the VPN tunnel to the both of the other networks. Is this a requirement?



Could I just setup another ACL, cryptomap, and isakmp policy to VPN from PIX2 to PIX3? If you could refer me to any examples, I would appreciate it.



I have the config's for the existing 2 PIX. If I post the two config's I have would someone be willing to help me out with the third config?



Thanks in advance and Happy New Year.



Bob


Vote
Twitter Facebook LinkedIn
N

Hub and spoke is only supported on 7.x PIX OS - the 501 won't support 7.x OS.

Vote
Twitter Facebook LinkedIn
N

If you are looking at

formatting link
's not a hub and spoke configuration - it's fully meshed (all to all)

- a hub and spoke would have a singe site connecting to all sites with one VPN for each site - in either case any site could talk to any site - the hub and spoke requires less VPN's and is only on PIX 7.x

Hub and spoke (Site one is the hub) Site 2 Site 1 Site 3

Fully meshed Site 2 Site 1 \\ / \\ / -> Site 3

Vote
Twitter Facebook LinkedIn
R

The hub & spoke url I'm looking at is

formatting link
.It shows it as being a config for ver.6.3

Thanks for your response.

Bob

Vote
Twitter Facebook LinkedIn
N

The HUB would be the Internet

Sure - use the same example you were looking at (below) except don't use the commands that connect PIX3 to "PIX Central" - instead modify them to connect PIX2 to PIX3.

formatting link

Vote
Twitter Facebook LinkedIn
J

Hub and spoke is a fine topology in 6.3. All it means is that your spoke sites won't be able to talk to each other. If you want this to happen, then you will need your hub site with a PIX version of 7 to permit this communication.

Regards

n>

Vote
Twitter Facebook LinkedIn

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required