PIX 501 newbie guestion

Hello,

I am a Cisco challenged newbie with a desire to learn.

Our current network has a site to site VPN using 2 PIX-501's. I need to configure another site to site VPN connection with an additional PIX 501 to only one of the other network. I have no need to connect to PIX1, only PIX2 to PIX3 using IPSec. All PIX's are version 6.3

Do I need to do a hub & spoke connection? If so the Cisco example diagram I found shows a need for a hub from the VPN tunnel to the both of the other networks. Is this a requirement?

Could I just setup another ACL, cryptomap, and isakmp policy to VPN from PIX2 to PIX3? If you could refer me to any examples, I would appreciate it.

I have the config's for the existing 2 PIX. If I post the two config's I have would someone be willing to help me out with the third config?

Thanks in advance and Happy New Year.

Bob

Reply to
Robert Little
Loading thread data ...

Hub and spoke is only supported on 7.x PIX OS - the 501 won't support 7.x OS.

Reply to
none

If you are looking at

formatting link
's not a hub and spoke configuration - it's fully meshed (all to all)

- a hub and spoke would have a singe site connecting to all sites with one VPN for each site - in either case any site could talk to any site - the hub and spoke requires less VPN's and is only on PIX 7.x

Hub and spoke (Site one is the hub) Site 2 Site 1 Site 3

Fully meshed Site 2 Site 1 \\ / \\ / -> Site 3

Reply to
none

The hub & spoke url I'm looking at is

formatting link
.It shows it as being a config for ver.6.3

Thanks for your response.

Bob

Reply to
Robert Little

Reply to
none

The HUB would be the Internet

Sure - use the same example you were looking at (below) except don't use the commands that connect PIX3 to "PIX Central" - instead modify them to connect PIX2 to PIX3.

formatting link

Reply to
none

Hub and spoke is a fine topology in 6.3. All it means is that your spoke sites won't be able to talk to each other. If you want this to happen, then you will need your hub site with a PIX version of 7 to permit this communication.

Regards

n>

Reply to
James

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.