PIX 515 VPN RELAYING FROM INSIDE

daniel-fr 19 years ago

HI, I'v got a couple of PIX 515 in failover which are used to make vpn connections with some of our clients and all works fine. What we are challenged to make is relaying a vpn from the inside because we have several inside sites and from one of them there will be a vlan dedicated to computers belonging to our new client. Routing them from this site to the pix would imply putting all the routes to my client's networks. First inconvenience, they use internally publice addresses which they don't own.

2nd constraint, the internal network assigned to the client must be sealed to and from all our networks. I thought including this network in an internal vpn with a little pix
501 on this site up to the pix connected to the Internet. Trying to make a layout :

MY SITE A MY SITE B INTERNET CLIENT

CLIENT----PIX 501----RTRA------RTRB----PIX515-----VPN --------HIS NETWORKS

Does somebody knows if it is possible to make a vpn directly to pix 515 on its inside interface and then rebuild another tunnel to the client networks ?

I thought of another solution with another pix 501 in front of the pix

515 having a vpn between the 2 501 and then rebuilding another tunnel with the 515. MY SITE A MY SITE B INTERNET CLIENT

CLIENT----PIX 501----RTRA------RTRB--501--PIX515-----VPN --------HIS NETWORKS

Could this work ? Does anybody have already setup such a configuration ?

Thanks in advance Daniel

Vote

Walter Roberson 19 years ago

No, it isn't. The only way to VPN from outside a lower security interface, "directly" to a higher security interface, is to use a "management interface" VPN. Management VPNs can only be used to manage the PIX itself (or for the PIX to send out traffic that it itself has generated) -- for example, ping or ssh the PIX. Management VPNs use a different -kind- of IPSec which is *defined* as not permitting relaying.

Vote

daniel-fr 19 years ago

Thanks for the answer Walter I thought of it already. So I think the only solution should be the second one : vpn between the 2 501 on both sites and from the 515 to the client between the 501 on site B and the 515 I'll build a legitimate subnet and it should work ... I hope. I'll try modeling it today

Walter Robers> > > MY SITE A MY SITE B INTERNET CLIENT > >

Vote

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required