1. Home
  2. Cisco Systems
  3. PIX 506e Access VPN and Lan2Lan VPN

PIX 506e Access VPN and Lan2Lan VPN

Hi all,

I have a question about PIX 506e running 6.3(5).

The PIX is configured for L2L VPN and also Access VPN using CISCO VPN Client.

Inside LAN is 192.168.2.0/24 Remote site is 10.9.3.0/24

As far as i remember there is no way to access the 10.9.3.0/24 while using the Access VPN at least in 6.3?

Could anyone please confirm this point? And is it possible in 7.2 (after changing PIX506e by an ASA55xx)?

Just in case here is the config.

Thanks in advance.

Regards.

______

: Saved : PIX Version 6.3(5) interface ethernet0 auto interface ethernet1 auto nameif ethernet0 outside security0 nameif ethernet1 inside security100 enable password **** encrypted passwd *** encrypted hostname jupiter domain-name 192.168.0.0 fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 names name 192.168.11.171 XXXAPP1 name 192.168.11.172 XXXAPP2 name 10.9.3.0 XXXPROD name 10.9.3.1 YYYAPP1 name 10.9.3.2 YYYAPP2 access-list no-nat-inside permit ip 192.168.2.0 255.255.255.0 host XXXAPP1 access-list no-nat-inside permit ip 192.168.2.0 255.255.255.0 host XXXAPP2 access-list no-nat-inside permit ip 192.168.2.0 255.255.255.0 host YYYAPP1 access-list no-nat-inside permit ip 192.168.2.0 255.255.255.0 host YYYAPP2 access-list no-nat-inside permit ip 192.168.2.0 255.255.255.0

192.168.2.0 255.255.255.0 access-list vpn-lusis permit ip 192.168.2.0 255.255.255.0 host XXXAPP1 access-list vpn-lusis permit ip 192.168.2.0 255.255.255.0 host XXXAPP2 access-list vpn-XXXPROD permit ip 192.168.2.0 255.255.255.0 host YYYAPP1 access-list vpn-XXXPROD permit ip 192.168.2.0 255.255.255.0 host YYYAPP2 access-list in_outside permit icmp any any access-list splitunnel permit ip 192.168.2.0 255.255.255.0 192.168.2.0 255.255.255.0 access-list splitunnel permit ip XXXPROD 255.255.255.0 192.168.2.0 255.255.255.0 access-list splitunnel permit ip host XXXAPP1 192.168.2.0 255.255.255.0 access-list splitunnel permit ip host XXXAPP2 192.168.2.0 255.255.255.0 no pager icmp permit any outside mtu outside 1500 mtu inside 1500 ip address outside 193.0.0.25 255.255.255.252 ip address inside 192.168.2.1 255.255.255.0 ip audit info action alarm ip audit attack action alarm ip local pool vpnclientpool 192.168.2.130-192.168.2.139 mask 255.255.255.0 pdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 0 access-list no-nat-inside nat (inside) 1 0.0.0.0 0.0.0.0 0 0 access-group in_outside in interface outside route outside 0.0.0.0 0.0.0.0 81.252.66.26 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout sip-disconnect 0:02:00 sip-invite 0:03:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server TACACS+ max-failed-attempts 3 aaa-server TACACS+ deadtime 10 aaa-server RADIUS protocol radius aaa-server RADIUS max-failed-attempts 3 aaa-server RADIUS deadtime 10 aaa-server LOCAL protocol local no snmp-server location no snmp-server contact snmp-server community public no snmp-server enable traps floodguard enable sysopt connection permit-ipsec crypto ipsec transform-set esp3dessha esp-3des esp-sha-hmac crypto ipsec transform-set vpnclientset esp-3des esp-md5-hmac crypto dynamic-map vpnclientmap 1000 set transform-set vpnclientset crypto map map_outside 10 ipsec-isakmp crypto map map_outside 10 match address vpn-lusis crypto map map_outside 10 set pfs group5 crypto map map_outside 10 set peer 193.0.0.66 crypto map map_outside 10 set transform-set esp3dessha crypto map map_outside 20 ipsec-isakmp crypto map map_outside 20 match address vpn-XXXPROD crypto map map_outside 20 set pfs group5 crypto map map_outside 20 set peer 194.0.0.114 crypto map map_outside 20 set transform-set esp3dessha crypto map map_outside 1000 ipsec-isakmp dynamic vpnclientmap crypto map map_outside client authentication LOCAL crypto map map_outside interface outside isakmp enable outside isakmp key ******** address 194.0.0.114 netmask 255.255.255.255 no-xauth no-config-mode isakmp key ******** address 193.0.0.66 netmask 255.255.255.255 no-xauth no-config-mode isakmp policy 10 authentication pre-share isakmp policy 10 encryption 3des isakmp policy 10 hash sha isakmp policy 10 group 5 isakmp policy 10 lifetime 86400 isakmp policy 20 authentication pre-share isakmp policy 20 encryption 3des isakmp policy 20 hash sha isakmp policy 20 group 2 isakmp policy 20 lifetime 86400 vpngroup vpnclientgroupaltergaz address-pool vpnclientpool vpngroup vpnclientgroupaltergaz split-tunnel splitunnel vpngroup vpnclientgroupaltergaz pfs vpngroup vpnclientgroupaltergaz idle-time 1800 vpngroup vpnclientgroupaltergaz password ******** telnet YYYAPP1 255.255.255.255 inside telnet timeout 5 ssh 195.0.0.152 255.255.255.248 outside ssh 0.0.0.0 0.0.0.0 inside ssh timeout 5 console timeout 0 dhcpd address 192.168.2.151-192.168.2.240 inside dhcpd dns 194.2.0.20 194.2.0.50 dhcpd lease 86400 dhcpd ping_timeout 750 dhcpd enable inside username xxxx password xxxx encrypted privilege 2 terminal width 80
Reply to
Laurent
Loading thread data ...

Correct.

In the context of your configuration, Yes.

When you wrote "Access VPN" there was a possibility that you meant a "management VPN"; I don't know if management VPNs can access the other VPNs in 7.2. But you aren't using a management VPN so it is not an issue for you.

Reply to
Walter Roberson

Hello Walter;

Thanks for your reply.

By "Access VPN" I mean a VPN using Cisco Client VPN.

I will try in 7.2 to setup one of our devices operatinf in 7.2 before having our customer buy an ASA55xx

Laurent.

Reply to
Laurent

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.