1. Home
  2. Cisco Systems
  3. Using groups in VPN IPsec rules [PIX]

Using groups in VPN IPsec rules [PIX]

I have made a VPN from my LAN (behind a PIX525) and 3 LANs behind a PIX 515. I specified them as 3 separated rules on IPsec ACL. I moved to 1 rule using group as I've already done it for ACL to control traffic from those 3 LAN to mine. I thought that adding new LANs to tunnel would have been easier as I need only to add more LANs to the group used for the tunnel. I got a refuse from PIX. It tells me that there is an error on a rules on the ACL applied on the interface where the tunnel terminates. I searched for the group through the entire config file just to see if there is a point where some rules are specified LAN by LAN instead of by that group. But I didn't find anything. Maybe I need to remove all the references in that ACL, add the other object to the group and then re-apply the ACL? What a silly thing. VPN rules are completely indipendent from ACL to permit traffic fowing on the tunnel, so why is the PIX behaving that way?

Alex.

Reply to
AM
Loading thread data ...

group as I've already done it for ACL to

to add more LANs to the group used for

Generally speaking, that approach should work.

ACL applied on the interface

Could you remind me whether you are running 6.3 or 7.0 ? In 6.3, the only cases I can -think- of in which altering a network object-group might result in a message about an invalid ACL, involve policy nat and policy static. If, though, the new element of the network group happened to be a "host" entry that named a PIX interface address, there would be a faint chance in 6.3 that you might get a warning to use the "interface" keyword instead.

Reply to
Walter Roberson

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.