PIX: Route statement

Similar Questions

• Performs a PIX routes packets from one LAN to the same LAN?

  Hello

  My PIX is the default gateway for my local network.

  Can I set up a static route in my 5151E PIX routes the packets of my LAN to another gateway in the same local network?

  Thanks in advance

  IMHO, it would be better to say:

  The PIX performs routing, but it is is not a router. It can offers routing features, but one thing is that the PIX will never allow traffic leaving the same interface it came. This is due to the Adaptive Security algorithm in the PIX.

  What about the reverse? Make the default gateway router and assigning a static route all (gateway of last resort) of this router for the PIX. Could be a solution.

  Kind regards

  Leo

• VPN clients cannot access remote sites - PIX, routing problem?

  I have a problem with routing to remote from our company websites when users connect via their VPN client remotely (i.e. for home workers)

  Our headquarters contains a PIX 515E firewall. A number of remote sites to connect (via ADSL) to head office using IPSEC tunnels, ending the PIX.

  Behind the PIX is a router 7206 with connections to the seat of LANs and connections to a number of ISDN connected remote sites. The default route on 7206 points to the PIX from traffic firewall which sits to ADSL connected remote sites through the PIX. Internal traffic for LAN and ISDN connected sites is done via the 7206.

  Very good and works very well.

  When a user connects remotely using their VPN client (connection is interrupted on the PIX) so that they get an IP address from the pool configured on the PIX and they can access resources located on local networks to the office with no problems.

  However, the problem arises when a remote user wants access to a server located in one of the remote sites ADSL connected - it is impossible to access all these sites.

  On the remote site routers, I configured the access lists to allow access from the pool of IP addresses used by the PIX. But it made no difference. I think that the problem may be the routes configured on the PIX itself, but I don't know what is necessary to solve this problem.

  Does anyone have suggestions on what needs to be done to allow access to remote sites for users connected remotely via VPN?

  (Note: I suggested a workaround, users can use a server on LAN headquarters as a "jump point" to connect to remote servers from there)

  with pix v6, no traffic is allowed to redirect to the same interface.

  for example, a remote user initiates an rdp session for one of the barns adsl. PIX decrypts the packet coming from the external interface and looks at the destination. because the destination is one of adsl sites, pix will have to return traffic to the external interface. Unfortunately, pix v6.x has a limitation that would force the pix to drop the packet.

  with the v7, this restriction has been removed with the "same-security-traffic control intra-interface permits".

  http://www.Cisco.com/en/us/partner/products/HW/vpndevc/ps2030/products_configuration_example09186a008046f307.shtml

• pix route add time

  Hello

  I have a cisco 520 pix. I want to add 172.16.0.0/255.255.0.0 to point to ip 192.168.2.1.

  can someone tell me how long it will take to add the route? the pix has about 16 MB of ram. He runs that ios.and 6.1 has 6 interfaces which 2 interfaces are active.

  Riou

  OK, that makes more sense.

  It looks like your session may have hung. You can just close, but unfortunately the process within the PIX will probably still active. You may need to eventually restart the PIX to get out them, delete no real way around it so after closing, the session to another session, said that something is to use it. I'm sorry.

• PIX, router/modem connection

  My network need additional security. I replaced the previous firewall with the PIX 515E. Not connecting to the router (DLINK DSL-G604T), there is no communication. How can I solve the problem

  What is the level of communication you have? Is this due to wiring problem (vs right croiseent UTP) or configuration?

  Make sure you use crossover utp. If this is already in place, make sure the router interface both pix is mode active/unshut. Other than that, check the IP asigned to the router and PIX interfaces + netmask. Other than that, maybe, you will need to allow icmp router to reach pix off interface (or any interface that you connect to the router).

  On the end of PIX, is on/flashing LED when you connect to the DLINK router?

  Rgds,

  AK

• Difference b/w PIX & router (router with the firewall option)

  Hi all

  I want to know that how we can differ with router (router with the firewall option) PIX bcz can also make Staefull packet filtering. What PIX device that reviewed by the customer to use PIX of the router.

  Thank you best regards &,.

  Guelma

  Hello

  There is a discussion in this forum on this topic; Check "Firewalling: PIX vs IOS Firewall" last conversation was released January 10, 2006. Let me know if it helps.

  Rgrds,

  Haitham

• routing of blunders

  Hey all,.

  I am at a loss. is a released 501 box 6.3.3. assign a public IP XXX. XX. XX.13 and its private IP 10.1.25.254

  the public interface is connected to a 2600, eth0 ip address is one of my XXX public ip addresses. XX. XX.254 and se0 is 172.XX. XXX.157, which is provided by my ISP. Inside, I have a Cat4006, IP 10.1.254.254. Here is where I get confused. Until I'm the 501 I could tracert ip address on se0 (icmp is enabled). Since the 501 I can ping et0 the 2600, but I couldn't get any traffic to go outside. I tried http, dns, ftp. I left the ACL, which to my knowledge is all outbound traffic is allowed.

  before I start I tracert one ip address and could follow for se0

  now when I tracert it stops at the cat4006 it timesout it.

  I'm confused about my routing statements

  on the cat4006, I define a ' ip route 0.0.0.0 0.0.0.0 10.1.25.254 ' so that all packets not for my network go to the private ip address of the pix. (is that right)

  I then tried to define a route in the pix inside interface for route 0.0.0.0 0.0.0.0 to XXX. XX. XX.254 (is that at the time) I don't think it is. I can't understand how routing should be accomplised. Run the external interface to XXX. XX. XX.254? Right now I'm trying this on a 501, but in a few weeks I intend to use a 515e

  any help would be appreciated

  S.O.S.

  Thank you

  Matt

  Hello

  Your default route to swich CAT is correct, that points to the private IP address of PIX. But there is no default route on the PIX. you need such a statement

  outdoor circuit 0 0 xxx.xxx.xxxx.254 (the ip of your router)

  Ping or traceroute may not work unless you allow them to go outside using the access list. but the other protocols such as http and telnet statefull should work.

  Thank you

  Nadeem

• Photosmart 6520 does not print after upgrading the firmware on the router.

  I have problems with my router and a remote technician for Verizon FIOS updated firmware, solve my problem of the internet, but now my printer is not working.  When I try to print from my macbook pro (OSX Lion 10.7.5) it is said that the printer is idle.  When I try to print from my ipod and the iphone, it is said that it prints, but then nothing happens.

  I was able to set up direct wireless to print, but I don't want to go into the settings and change networks whenever I need to print.

  I tried to turn off the router unplug the printer and turn it back on.

  I checked to make sure that the WEP code and network name are correct.

  What can I do else?

  treeBear wrote:
  

  ricksmom wrote:
  

  I appreciate really all the efforts that you and other posters are on this issue, but I feel that I will not find a solution.  Maybe a new router?

  It is a long shot. But since we are short of ideas, please try to change the configuration of the router from WEP to WPA2 and try again to establish the connection. Because WEP is very old standard, some routers may have a few inherited defects that were never resolved.

  Well... This opens a huge can of worms, it leads eventually to a solution.  I changed the security settings and when I presented to them, 'wait while we apply the settings' screen appeared and never went away.  The timer kept spinning and this went on for over an hour.  Neither the old or new passwords worked and I completely lost my internet connection.  I called Verizon and ordered a new router and said the technician on the line of my being stuck in limbo. After a few basic tests (unplug and pluggng again) she transferred me to someone in the advanced group.  To make a long story short, he traced the fault not the router, but the optical network outside my home box.  It reset, reset the router (losing the new security settings and everything else) but my internet is back, and fortunately, so is my printer.  I'll live with that until the arrival of my new router state-of-the-art.

  Thanks for the suggestion, it was a frustrating experience, it finally lead me to a printer to work! I doubt that I would come to this point another way.

• Removing static route get % corresponding to any error no route to remove

  I'm trying to remove a static route, I added:

  -------------------------------------------------------------------------------------------------

  R2 #show ip route
  Code: C - connected, S - static, mobile R - RIP, M-, B - BGP
  D - EIGRP, OSPF, IA - external EIGRP, O - EX - OSPF inter zone
  N1 - type external OSPF NSSA 1, N2 - type external OSPF NSSA 2
  E1 - OSPF external type 1, E2 - external OSPF of type 2
  i - IS - Su - summary IS, L1 - IS - IS level 1, L2 - IS level - 2
  -IS inter area, * - candidate failure, U - static route by user
  o - ODR, P - periodic downloaded route static

  Gateway of last resort is not set

  172.168.0.0/29 is divided into subnets, subnets 1
  S 172.168.0.0 [1/0] via 192.168.2.2
  C 192.168.1.0/24 is directly connected, FastEthernet0/0
  192.168.2.0/30 is divided into subnets, subnets 1
  C 192.168.2.0 is directly connected, Serial0/0
  R2 #conf t
  Enter configuration commands, one per line.  End with CNTL/Z.
  R2 (config) #no ip route 172.168.0.0 255.255.255.0 192.168.2.2
  % Corresponding to any no route to remove
  R2 (config) #r2 #show ip route

  ----------------------------------------------------------------------------------------------------

  I was training establishment of a static routing on three routers r2 (2600xm) connected to r1 (2600xm) via maps module T1 on the serial ports. connected to r1 is a router 2500 old called PC.

  I removed the static routes off r2 and PC but when I get to r2 I connect to 2500 another console cable that I use to access a server I get the above error.  all IP addresses are just generic subnets that I created to play with static routing.   I can't remove someone has any ideas?

  you use the subnet mask different than the one you used. According to the route table entry mask is 29

  Try this,

  1] r2 (config) #no ip route 172.168.0.0 255.255.255.248 192.168.2.2

  or 2] another easy method would be to check the working config and copy stick with 'no' at the beginning.

  See the race | include the ip route

  Copy the static route statement and paste this what with 'no' in the global configuration and check the routing table.

• Using PIX 515E configuration require

  Dear all,

  Hi.Actually I need help for PIX 515E.Pls. check out the scenario, design & suggest?

  Pls. find the details following and configuration of VLAN attached router.

  # I want to put as

  «Spend my LAN on CISCO 2900 (range 172.16.29.X IP...» (25 PCs) - VLAN router - CISCO PIX - ISP public IP.

  # Now it's

  "My LAN on CISCO 2900 - VLAN (external) router - ISP.

  Details of router & PIX:

  #Router inside the IP - 172.16.29.1 (inside property intellectual as it is very critical that cannot be changed)

  Outdoor #Router ip - what ip should I use? (I tried with 1.1.1.1 255.255.255.0)

  #PIX outside intellectual property - what ip should I use? (My ISP IP?-j' tried with 208.144.230.197 which is currently outside of my router)

  #PIX within the intellectual property - what ip should I use? (I tried with 1.1.1.2 255.255.255.0)

  Connection ISP #My is directly from the ISP GW to an ethernet cat 5 on my router VLAN

  #I would allow www, FTP, web-based like Yahoomail... etc... & Messenger services

  VLAN router Config:

  Current configuration: 1028 bytes

  !

  version 12.3

  horodateurs service debug datetime msec

  Log service timestamps datetime msec

  no password encryption service

  !

  hostname VLANRouter

  !

  boot-start-marker

  boot-end-marker

  !

  activate the gcsroot password

  !

  No aaa new-model

  IP subnet zero

  !

  !

  no record of conflict ip dhcp

  DHCP excluded-address IP 172.16.29.1 172.16.29.240

  DHCP excluded-address IP 172.16.29.250 172.16.29.254

  !

  IP dhcp pool dhcppool

  network 172.16.29.0 255.255.255.0

  DNS-server 208.144.230.1 208.144.230.2

  router by default - 172.16.29.1

  !

  !

  !

  !

  controller E1 0/0

  !

  controller E1 0/1

  !

  !

  interface FastEthernet0/0

  IP 208.144.230.197 255.255.255.224

  NAT outside IP

  automatic duplex

  automatic speed

  !

  interface FastEthernet0/1

  IP 172.16.29.1 255.255.255.0

  IP nat inside

  automatic duplex

  automatic speed

  !

  IP nat inside source list 7 interface FastEthernet0/0 overload

  IP http server

  IP classless

  IP route 0.0.0.0 0.0.0.0 208.144.230.200

  !

  !

  access-list 7 permit 172.16.29.0 0.0.0.255

  !

  Line con 0

  line to 0

  line vty 0 4

  opening of session

  !

  !

  !

  end

  All advice is appreciated.

  Kind regards

  Hiren s Mehta.

  ORG Informatics Ltd.

  Bamako, MALI

  AFRICA

  Hi hiren,.

  See the answers below:

  #Router inside the IP - 172.16.29.1 (inside property intellectual as it is very critical that cannot be changed)

  When you upgrade the PIX router inbetween and your switch, you must put the PIX inside IP like 172.16.29.1 and change the router within the subnet to someother pool. Do the PAT on the PIX, rather than the router.

  Outdoor #Router ip - what ip should I use? (I tried with 1.1.1.1 255.255.255.0)

  Router outside the property intellectual property will be that given by the ISP... The ISP would have given a public IP address for the WAN link. This cannot be changed.

  #PIX outside intellectual property - what ip should I use? (My ISP IP?-j' tried with 208.144.230.197 which is currently outside of my router)

  PIX outside IP must be comprehensive. ISP would have given you a LAN subnet. Use it. In this case, inside the interface of the router has an IP address from that subnet even...

  #PIX within the intellectual property - what ip should I use? (I tried with 1.1.1.2 255.255.255.0)

  PIX inside must be 172.16.29.1, which will be the default gateway for all PCs. If you change this subnet, then the PC should have an IP address on the same subnet that has decided.

  Connection ISP #My is directly from the ISP GW to an ethernet cat 5 on my router VLAN

  didn't get it... is that on the internet router or switch?

  #I would allow www, FTP, web-based like Yahoomail... etc... & Messenger services

  If all these must be permitted from inside to outside, you have not open anything... by default, all traffic to the inside outside is allowed (except if you put a list of access denied)...

• traceroute pix 7.0 problems

  Hiya,

  I've updated to v7.0 (1) pix and after that, I had this problem can't traceroute out of my WAN connection. The pix connects to the internet and when I do a ping from inside outside external ip addresses, it works, but traceroute will be inaccessible after the jump of pix. Traceroute to the border immediately after the pix router. Check the logs indicated that time ICMP exceeded packet newspapers:

  % 4 PIX-400015: time ID: 2005 exceeded ICMP from xxx to yyy off

  I have already explicitly allow access-list out_in line 12 extended permit icmp any xxx 255.255.255.224 exceeded time

  to allow packets time exceeded icmp to come in, but nothing helped. Any suggestions? Inspect the icmp is on as well

  Directly from Cisco TAC:

  To allow traceroute

  through PIX code 7.0, we must add "inspect icmp error" in PIX configuration. Please

  to implement following commands in configuration - PIX mode

  --> Policy-map global_policy

  --> class inspection_default

  --> inspect icmp error

  --> write mem

  I hope this works for you too!

• Redirect Port WRV210 not open ports

  Greetings,

  I have a Linksys/Cisco WRV210 Wireless-G VPN Router with RangeBooster.  ISP is a dynamic IP with all ports open.  I have no equipment to interact with them. they give me just a CAT5 cable on the wall.  ISP-> WRV210-> LAN

  Router stats

  Hardware Version: WRTR-221G_V1

  Software version: 2.0.0.11

  Connection type: Automatic Configuration - DHCP

  IP address: 10.1.222.104

  Subnet mask: 255.255.255.0

  Default gateway: 10.1.222.1

  Port Forwarding 22152 - 22152 192.168.1.152 enabled

  No trigger port

  DMZ disabled

  If I am controlled within the local network

  nmap -p22152 192.168.1.152Interesting ports on 192.168.1.152:PORT      STATE SERVICE22152/tcp open  unknown
  

  If I am controlled from outside the router (xxx and # are just my changes of masking)

  nmap -p22152 desktop.dns.xxx
  Interesting ports on ##.###.##.###:
  PORT      STATE  SERVICE
  22152/tcp closed unknown
  

  If I am controlled from inside the LAN on the router

  nmap -p22152 192.168.1.1
  Interesting ports on 192.168.1.1:
  PORT      STATE  SERVICE
  22152/tcp closed unknown
  

  It seems that the router is completely ignoring my Port Forwarding instructions.  I have the hard reset of the router.  I've upgraded to the latest firmware.  None of them has made a difference.

  My final test was to see if all ports are open on the router

  nmap 192.168.1.1
  Interesting ports on 192.168.1.1:
  Not shown: 997 closed ports
  PORT      STATE SERVICE
  80/tcp    open  http
  443/tcp   open  https
  60443/tcp open  unknown
  

  My questikon would be if someone has a 'trick' to enable port forwarding on the road?

  Thank you.

  This product is managed by the Cisco Small Business Support Community.

  For future discussions about this product, go here.

• Problem NAT I think

  I have 2 Cisco 1720 routers connected via a T1 line I ping the inside interface of each router to the external interface of the other, but I can't ping from an interface to an inside interface inside I enclose the show run from each router, the names have been changed to protect the innocent ;-)

  The router has #sh ru

  Building configuration...

  Current configuration: 1033 bytes

  version 12.2

  horodateurs service debug uptime

  Log service timestamps uptime

  no password encryption service

  A router host name

  Select the secret xxx

  iomem 25 memory size

  IP subnet zero

  name of the IP-server 205.171.3.65

  name of the IP-server 205.171.2.65

  interface FastEthernet0

  192.168.0.4 IP address 255.255.255.0

  IP nat inside

  automatic speed

  interface Serial0

  192.168.101.1 IP address 255.255.255.0

  NAT outside IP

  no fair queue

  service t1 clock source module internal

  time intervals t1 service-module 1-24

  overload of IP nat inside source list 131 interface Serial0

  IP classless

  IP route 0.0.0.0 0.0.0.0 192.168.0.1

  IP route 10.6.18.0 255.255.255.0 192.168.101.2

  IP http server

  access-list 2 permit 10.6.18.0 0.0.0.255

  access-list 4 allow 192.168.0.0 0.0.0.255

  access-list 5 permit 192.168.101.0 0.0.0.255

  ARP 10.6.18.5 00c0.b607.d30b ARPA

  ARP 10.6.18.1 0010.e004.6ccb ARPA

  Line con 0

  Synchronous recording

  line to 0

  line vty 0 4

  absolute-timeout 60

  opening of session

  No Scheduler allocate

  end

  ========================================

  Router B #sh ru

  Building configuration...

  Current configuration: 1453 bytes

  version 12.2

  horodateurs service debug uptime

  Log service timestamps uptime

  no password encryption service

  router host name B

  Select the secret xxx

  iomem 25 memory size

  IP subnet zero

  name of the IP-server 205.171.3.65

  name of the IP-server 205.171.2.65

  Tunnel1 interface

  no ip address

  interface FastEthernet0

  IP 10.6.18.4 255.255.255.0

  IP nat inside

  automatic speed

  interface Serial0

  IP 192.168.101.2 255.255.255.0

  IP accounting output-packets

  NAT outside IP

  no fair queue

  service t1 clock source module internal

  time intervals t1 service-module 1-24

  interface Serial1

  IP 192.168.100.4 255.255.255.0

  IP accounting output-packets

  NAT outside IP

  no fair queue

  time intervals t1 service-module 1-24

  IP classless

  IP in udp 5631 avant-protocole

  IP in udp 5632 avant-protocole

  IP route 0.0.0.0 0.0.0.0 10.6.18.2

  IP route 192.168.1.0 255.255.255.0 192.168.100.3

  IP route 192.168.1.0 255.255.255.0 192.168.100.1

  IP http server

  access-list 1 permit 192.168.0.0 0.0.0.255

  access-list 2 permit 10.6.18.0 0.0.0.255

  access-list 3 allow 192.168.100.0 0.0.0.255

  access-list 4 allow to 192.168.1.0 0.0.0.255

  access-list 5 permit 192.168.101.0 0.0.0.255

  access-list 121 allow ip 192.168.0.0 0.0.255.255 everything

  IP access-list 130 allow any host 10.6.18.1

  ARP 10.6.18.5 00c0.b607.d30b ARPA

  Line con 0

  Synchronous recording

  line to 0

  line vty 0 4

  session-timeout 60

  absolute-timeout 60

  opening of session

  end

  If you see something that I must try it please let me know.

  Thank you

  Dale

  Just be sure that your routing statements are correct, IE. On router B, you must make sure to include a statement of "ip route...". "for roads belonging to router C and make the next on the router A break point. And of course vice versa... :)

  You are welcome.. and on the 'check'... here at netpro, the currency's sides and fix... Just make sure that you note appropriate positions and if something resolved your case, mark appropriate... :)

• PIX501 VPN PPTP: I have to browse the internet side remote via my VPN server

  Hello

  IM using PPTP for remote access to my server VPN, its power remotely connect to LAN, but I did not have Internet access on the remote side is that I need...

  IM using windows PPTP client and he has to select the "use default gateway on remote network": but still does not.

  Could you help me, thanks in advance

  Rolando

  6.3 (5) PIX version
  interface ethernet0 car
  interface ethernet1 100full
  ethernet0 nameif outside security0
  nameif ethernet1 inside the security100
  fixup protocol dns-length maximum 512
  fixup protocol ftp 21
  fixup protocol h323 h225 1720
  fixup protocol h323 ras 1718-1719
  fixup protocol http 80
  fixup protocol rsh 514
  fixup protocol rtsp 554
  fixup protocol sip 5060
  fixup protocol sip udp 5060
  fixup protocol 2000 skinny
  fixup protocol smtp 25
  fixup protocol sqlnet 1521
  fixup protocol tftp 69
  !
  inside_access_in ip access list allow a whole
  Note outside_access_in list of outdoor access
  access-list outside_access_in allow icmp a whole
  inside_outbound_nat0_acl ip access list allow any 192.168.1.200 255.255.255.248
  pager lines 24
  the history of logging alerts
  ICMP allow all outside
  Outside 1500 MTU
  Within 1500 MTU
  IP address outside of *. *. *. * 255.255.255.248
  IP address inside 192.168.1.1 255.255.255.0
  alarm action IP verification of information
  alarm action attack IP audit
  IP pool local remote_users 192.168.1.200 - 192.168.1.205
  !
  PDM logging 100 information
  history of PDM activate
  ARP timeout 14400
  Global 1 interface (outside)
  NAT (inside) 0-list of access inside_outbound_nat0_acl
  NAT (inside) 1 0.0.0.0 0.0.0.0 0 0
  Access-group outside_access_in in interface outside
  inside_access_in access to the interface inside group
  Route outside 0.0.0.0 0.0.0.0 *. *. *. *
  Timeout xlate 0:05:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225
  H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00
  Sip timeout - disconnect 0:02:00 prompt Protocol sip-0: 03:00
  Timeout, uauth 0:05:00 absolute
  GANYMEDE + Protocol Ganymede + AAA-server
  AAA-server GANYMEDE + 3 max-failed-attempts
  AAA-server GANYMEDE + deadtime 10
  RADIUS Protocol RADIUS AAA server
  AAA-server RADIUS 3 max-failed-attempts
  AAA-RADIUS deadtime 10 Server
  AAA-server local LOCAL Protocol
  Enable http server
  enable floodguard
  Sysopt connection permit-pptp
  Telnet timeout 5
  SSH timeout 5
  Console timeout 0
  VPDN PPTP-VPDN-group accept dialin pptp
  VPDN group PPTP-VPDN-GROUP ppp mschap authentication
  VPDN group PPTP-VPDN-GROUP ppp encryption mppe auto
  VPDN group configuration client PPTP-VPDN-GROUP address local remote_users
  VPDN group VPDN GROUP-PPTP client configuration dns 200.57.2.108 200.57.7.61
  VPDN group VPDN GROUP-PPTP pptp echo 60
  VPDN group VPDN GROUP-PPTP client for local authentication
  VPDN username * password *.
  VPDN allow outside
  VPDN allow inside
  dhcpd address 192.168.1.100 - 192.168.1.199 inside
  dhcpd dns 200.57.2.108 200.57.7.61
  dhcpd lease 3600
  dhcpd ping_timeout 750
  dhcpd outside auto_config
  dhcpd allow inside

  The PIX cannot re - route traffic to the Internet because it's a feature supported on version 7.x and higher. You cannot execute code on PIX501 7.x.

  You can send all traffic through the tunnel (for the PIX) and have the PIX route this traffic to a router internal (on the head), then rewritten the PIX to the Internet.

  Federico.

• L2L configuration with the same intellectual property regime

  Hi all

  hoefully it won't be easy. I set up some VPN site to site, but now I have one that has a plan of the same IP as me. 192.168.9.x is the subnet in question. I think I'll need to NAT, the jobs of 192.168.9.x who will have access to my network. I usually add a rule exempt from NAT for my other L2L sites, but since I'm on NAT for this one I can not add, correct? Also, I think that when I add a route statement to my router I point to the NAT address... Thanks in advance for any help.

  Please visit the following OCC configuration guides...

  http://www.Cisco.com/en/us/partner/products/ps5855/products_configuration_example09186a0080a0ece4.shtml

  http://www.Cisco.com/en/us/partner/products/ps6120/products_configuration_example09186a0080b37d0b.shtml