PIX to ISA VPN via Cisco 828

Hopefully an easy one this...

I'm setting up a VPN between a PIX 501 and an ISA 2004 box. I've been through the config for this and it works fine at the moment, as both the PIX and the ISA boxes have public IP addresses so can talk to each other directly: PIX -- Web -- ISA. However, the complication is that we're going to be using a dedicated SDSL line for the VPNs into the ISA box via a Cisco 828 router: PIX -- Web -- 828 -- ISA.

There are two possible ways to do this. The simplest would seem to be if we can "turn off" the routing on the 828 and leave the external IP on the ISA's ethernet interface, with the router acting purely as a connector. If this isn't possible, then I'll need to set the 828 to forward everything to the ISA box and vice versa, so as far as the PIX is concerned it's talking directly to the ISA box even though the public IP is on the 828.

I'd be very grateful if someone could tell me the simplest way to achieve this - my IOS knowledge is pretty simplistic! Thanks in advance.

Colin

Reply to
GlasWolf
Loading thread data ...

I've made some progress on this, attempting to set the router to bridge between the two networks - using NAT works, but is no good for IPSec. Using the following config, I keep getting the error message "%TBRIDGE-4-NOVCFLOOD: No VC's configured for bridging on ATM0" when traffic is received at the router. The "bridge-group 1" command is being entered while at the pvc config prompt, but it takes me back to the interface prompt. Am I missing a step?

! version 12.3 no service pad service timestamps debug datetime msec service timestamps log datetime msec service password-encryption ! hostname BCH-SDSL ! boot-start-marker boot-end-marker ! logging buffered 51200 warnings enable secret 5 ******** ! clock timezone PCTime 0 no aaa new-model ip subnet-zero no ip source-route no ip routing no ip bootp server ! ! ! interface Ethernet0 no ip address no ip route-cache no cdp enable bridge-group 1 hold-queue 100 out ! interface ATM0 no ip address no ip route-cache no atm ilmi-keepalive dsl equipment-type CPE dsl operating-mode GSHDSL symmetric annex B dsl linerate AUTO bridge-group 1 pvc 0/38 encapsulation aal5mux ppp dialer dialer pool-member 1 ! ! interface Dialer0 no ip address ip mtu 1452 encapsulation ppp no ip route-cache dialer pool 1 dialer-group 1 no cdp enable ppp authentication chap callin ppp chap hostname ********** ppp chap password ********** ! no ip classless no ip http server ! access-list 1 remark INSIDE_IF=Ethernet0 access-list 1 remark SDM_ACL Category=2 access-list 1 permit any dialer-list 1 protocol bridge permit no cdp run bridge 1 protocol ieee ! line con 0 exec-timeout 120 0 transport preferred all transport output all stopbits 1 line vty 0 4 access-class 23 in exec-timeout 120 0 login local length 0 transport preferred all transport input all transport output all ! scheduler max-task-time 5000 ! end

Reply to
GlasWolf

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.