PIX site-to-site VPN

Are the 2 ADSL routers both doing many-to-one NAT? If so, this is not going to work. You will need public IP addresses on the pix's outside.

For the Solution you need to have

For Small BOX VPN you need to have Public IP on the outside interface whihc the remote VPN Device assumes as VPN Server for Site to site key sharing.

Fo thi syou need 2 public IPS both on the outside interface of PIX.

CK

snipped-for-privacy@gmail.com wrote:

The 11.11.11.111 and 22.22.22.22 addresses are public IP addresses. The New York site will be the VPN Server site as such.

I'm not sure what you mean by many-to-one NAT.

Initially I just want a VPN to connect. Then I will look at setting up multiple sites to site-2-site VPN into the New York site.

I'm still hoping someone will fill in my ?.?.?.? ip address according to my network diagram.

Many thanks Nick

'crypto' is not used as a prefix for 'isakmp key' in PIX 5 or PIX 6, and neither your 501 nor 506E support PIX 7.

Whatever you like. Your ADSL router is going to NAT it anyhow, so anything you put in there for the global addresses only has to match what the ADSL router is expecting. You might as well not even use a global pool (the first kind of global), since your ADSL router is going to be mapping everything to a single IP address.

Here and in the isakmp key statement, the IP you need to use is the IP that you need to address the packets to in order to reach the other machine. If something along the way is going to NAT your IPSec packets, then you need to use the NAT'd address because that's what you are going to see in the packets that originate from the other PIX.

You have the non-trivial problem of getting your ADSL routers to de-NAT the received packets and send them on to the PIXes.

Your setup would be much easier if you could spare some public IPs for the PIX themselves, addresses that were not NAT'd by the ADSL router.

If 501 & 506E don't support PIX 7, then please could someone supply a link to a configuration that does work between a 501 & 506E PIX v6.

I need to make this work with just 1 internet IP at each end (on the ADSL router) as per network diagram in initial question.

Thanks Nick

Whether you will be able to do it at all will depend upon how the ADSL routers can be configured. *If* you can configure them so that they send pretty much all incoming traffic on to the PIXes, then configure as follows. The below requires 6.3(*)

ADSL modem 1:

outside IP address: 111.111.111.111 inside address: 10.y.y.2 255.255.255.0 configure to nat all outgoing 10.x.y.0 255.255.255.0 to 111.111.111.111

PIX 1:

ip address inside 10.x.x.1 255.255.255.0 ip address outside 10.y.y.1 255.255.255.0 access-list nonat permit ip 10.x.x.0 255.255.255.0 10.z.z.0 255.255.255.0 access-list acl_to_city2 ip 10.x.x.0 255.255.255.0 10.z.z.0 255.255.255.0 access-list acl_to_city2 ip host 10.y.y.1 10.z.z.0 255.255.255.0 access-list acl_to_city2 ip host 10.y.y.1 host 222.222.222.222 global (outside) 1 interface nat (inside) 0 access-list nonat nat (inside) 1 10.x.x.0 255.255.255.0 isakmp identity hostname isakmp enable outside isakmp nat-traversal 20 isakmp key SharedSecret address 222.222.222.222 netmask 255.255... crypto map map_to_city2 100 ipsec-isakmp crypto map map_to_city2 100 match address acl_to_city2 crypto map map_to_city2 100 set peer 222.222.222.222 crypto map map_to_city2 100 set transform-set ... crypto map map_to_city2 interface outside sysopt connection permit-ipsec

ADSL modem 2:

outside address: 222.222.222.222 inside address 10.w.w.2 255.255.255.0

PIX 2:

ip address inside 10.z.z.1 255.255.255.0 ip address outside 10.w.w.1 255.255.255.0 access-list nonat permit ip 10.w.w.0 255.255.255.0 10.x.x.0 255.255.255.0 access-list acl_to_city1 ip 10.w.w.0 255.255.255.0 10.x.x.0 255.255.255.0 access-list acl_to_city1 ip host 10.z.z.1 10.x.x.0 255.255.255.0 access-list acl_to_city1 ip host 10.z.z.1 host 111.111.111.111 global (outside) 1 interface nat (inside) 0 access-list nonat nat (inside) 1 10.z.z.0 255.255.255.0 isakmp identity hostname isakmp enable outside isakmp nat-traversal 20 isakmp key SharedSecret address 111.111.111.111 netmask 255.255... crypto map map_to_city2 100 ipsec-isakmp crypto map map_to_city2 100 match address acl_to_city1 crypto map map_to_city2 100 set peer 111.111.111.111 crypto map map_to_city2 100 set transform-set ... crypto map map_to_city2 interface outside sysopt connection permit-ipsec

If you want to control the traffic between the two sites more precisely, you will need to omit the sysopt connection permit-ipsec and you will need to add access-list and access-group statements. Those statements should refer to the inside of city1 as 10.x.x.*, to the inside of city2 as 10.z.z.*. At city1, host 10.y.y.1 refers to communication from the local PIX itself (e.g., if you want to use the PIX itself to ping something at the other side); conversely, at city2, host 10.w.w.w.1 refers to communication from that local PIX itself. However, at city1, communication from the remote PIX itself will be seen as host 222.222.222.222, and at city2, communication from the city1 PIX itself will be seen as host 111.111.111.111 .

Hi Walter Would you mind filling in the transform-set "..." for the quote line above?

With this configuration, will icmp between the sites work, or so I have to add specific access-lists to achieve that?

Thanks Nick

crypto ipsec transform-set strong esp-3des esp-sha-hmac crypto map map_to_city2 100 set transform-set strong

It really doesn't matter, though. Anything supported by the PIXes that you can get the PIXes to agree on is fine. I also left out the isakmp policy definitions because they aren't important to your question of what IPs to use where; copy the ones you have now.

With that configuration, not only would icmp work between the lans, but icmp would also work from either lan to the outside interface of the other PIX. But you'll be wanting to put in 'icmp' commands to block random people on the net from rerouting your packets:

I am still confused about whether I should see "20" matched up on a different line, as well as what further isakmp (and other) lines might be required.

Would someone mind posting a full config for each PIX, where each site only has 1 internet IP, and NAT is in use, and where icmp is permitted between the 2 sites. Or refer me to a website which contains the same.

Seems a big ask, but would be incredibly helpful. Nick

No. The 20 is a time, which fact you could have read in the PIX documentation.

Thanks Walter. Your posts here and elsewhere have been extremely helpful. I think I have the correct IP's in my config now. Nick