site to site vpn with pix multiple tunnels

Similar Questions

• question links to site 2 site VPN with authentication cert

  Currently we are accumulate tunnel site-2-site VPN with our client. Usually we use pre-shared key as authentication with other customers without any problems, but it must use authentication cert with her this time. But the question is that our CA is different from theirs. I tried a few times, but he failed. Is it someone please let me know that he must have the certificate issued by the same certification authority to create the VPN tunnel?

  Thank you very much!

  Hello

  You can read this document to get a simple example of setting up a VPN S2S using certificates on an ASA:

  http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a0080aa5be1.shtml

  Basically the sides must have the same certification authority and If there is an intermediate certificate that must be installed also. The ASA 2 will generate a CSR (certificate access code request), now then PKI will create a certificate for both parties, commonly called "certificate of identity".

  Please pass a note and mark as he corrected the post helpful!

  David Castro,

  Kind regards

• Is site to site VPN with sufficiently secure router?

  Hello

  I have a question about the site to site VPN with router.

  Internet <> router <> LAN

  If I have a VPN site-to-site configured on the router above with another site. I configured to block incoming Internet connections with the exception of VPN to access list. What are the risks of the LAN is exposed to threats from the Internet? Recommend that you put in a firewall between the router and the LAN, or replace the router with a firewall?

  Thank you

  Hi Amanda,.

  Assuming your L2L looks like this:

  LAN - router - INTERNET - Router_Remote - LAN

  |-------------------------------------------------------------------------------|

  L2L

  Traffic between the two local area networks is protected by the VPN tunnel. It is recommended to use the recommended security (strong encryption settings) to ensure that the encrypted traffic would not be compromised through the Internet.

  On the other hand, if you talk about outbound plaintext to the Internet, as when a user acceses google.com, then you just make out traffic, but never allow all incoming connections.

  If you want to protect your network with advanced security as a FW features, you can consider ZBF, which is the available in IOS Firewall/set function:

  Design of the area Guide of Application and firewall policies

  If you consider that this is not enough, check the ASA5500 series.

  HTH.

  Portu.

  Please note all useful posts

• Site to site VPN with router IOS

  I want to create a VPN site-to site on the Internet. On the remote site, aside from the VPN to the head office, there should be no traffic not allowed in internal from the Internet to the network and that there should be no traffic from the internal network to the Internet allowed. The internal network will run a private 192.168.x.x address range.

  I'm going to use a Cisco 2811 router integrated of services on the remote site and this will last an IPSec VPN that will end a hub at Headquarters. I understand that this router has an IOS and IPS firewall built in.

  Would I be right in thinking that because I don't want to have access to the Internet (except VPN) or should I configure IOS firewall features on the router? And there is no point in the configuration of the features IPS wouldn't?

  My thought is that only an entry in list of unique access to deny pi a whole applied inbound to the interface that connects to the Internet would be the best strategy. I think that the command "sysopt connection permit-ipsec" should allow the VPN to form even with the ip address to deny any any ACL (or is it just a Pix command? If Yes, then I have to allow ESP and UDP 500 (ISAKMP) from the public address of the hub at Headquarters to allow the VPN to form wouldn't I?).

  Think I'll probably expand slightly the access list to allow the icmp Protocol, ssh and https traffic from the IP address of firewall seat outside so that I can monitor the remote site and access it safely if the fail VPN.

  And I wouldn't need one access list on the interface connected to the internal network I would like because the range of addresses would be not routable, so they would not be able to initiate connections to the Internet (all the trffic to the remote site is specified under a valuable traffic to bring up the VPN)

  Use one of the IOS Firewall inspect commands or the IPS would be useless and have no effect in this case wouldn't it?

  I really just need to know if the ip address to deny any any ACL on the external interface on the remote site is the best solution (and the simplest), and whether it will be safe.

  We used to use fiewalls Pix for remote VPN site to site, Amazon refuse incoming connections on the external interface by default but now I have been informed that these series 2800 routers will be used later, so I would get my thoughts straight and be able to build safe to do the same work all existing PIX are doing (they are all installed for just the VPN at Headquarters as in) the first paragraph).

  I would like any advice or thoughts on the subject. I don't know there must be a ton of people who put routers for the same purpose.

  Thank you in advance.

  Pete.

  Pete

  I did a lot of implementations site VPN to another using IOS routers. They work very well. Based on my experience I offer these comments and I hope that they will help you:

  -you don't want a list of incoming access on the external interface, but you want more in it than simply refuse an ip. There is no permit-ipsec sysopt connection in IOS so you want to certainly allowed ISAKMP and IPSec/ESP. I suggest that you also want to allow SSH. I would like to allow ICMP but only starting from the address space of the network head end. I do not allow HTTPS since I generally do not allow the http server on the router. If you want HTTPS then certainly enable it. To facilitate the ping and traceroute on the remote I frequently allow icmp echo-reply, timeout and unreachable port from any source.

  -I want to put an inside interface access list. There are certain types of traffic that I don't want to send from the Remote LAN. I have usually refuse any trap SNMP or snmp for LAN devices and refuse out of the local network icmp redirects. I also often configure RPF controls inside interface to catch any device which is misconfigured.

  -If you want to allow SSH when the VPN is not active (and I highly recommend that you do) then you will probably need to configure at least 1 (and maybe more) users and password of the router ID. And you want to configure authentication on the vty use local authentication if the head end authentication server is not available.

  -I'm not clear from your description if you plan to run a dynamic routing via the VPN Protocol. I wish I had a dynamic routing protocol because I want to announce a default route to the remote control via the VPN. I do not locally configure a default route on the remote router. This way if the VPN tunnel is up there is a default route pointing to the tunnel and if the VPN tunnel is not up then there is no local route by default and users on the remote database can not access the Internet. It is a simple and very effective method to ensure that all user traffic must pass through the central site.

  -regarding the routes defined on the remote router, my approach is that I define a static route for the endpoint of the tunnel to allow the tunnel to implement and I set up static routes for the subnet to the head of line I can SSH. And I do not configure other static routes the on the remote router.

  -You probably want to disable cdp on the external interface and also to disable the proxy-arp (and I don't make any ip unreachable).

  -There is frequently a problem when using VPN site-to-site with fragmentation. If a device on the local network sends a frame of maximum size, and then the router needs to add additional headers for IPSec, then the frame is too large and requires fragmentation. I like to use tcp adjust-mss ip to control the chunk size for TCP traffic and avoid any problems with fragmentation.

  -I don't think you want to set up the firewall or IPS from the features of IOS on the 2811.

  I hope that your application is fine and that my suggestions could be useful.

  [edit] after posting my response, I read through your post again and realize that you make to a VPN concentrator. The approach I have proposed on the execution of a routing protocol works for me because I usually have a router IOS in mind. It would not work to connect to a hub.

  HTH

  Rick

• Problems with site-to-site vpn with of the asa 2

  I tried different ways so that this works, but failed. After 8 hours, I literally have a bad headache and have to step away for a minute.  I realize I need to ping between the tunnels mentioned, but still can not to. can someone take a look and tell me where I have gone wrong?  Im trying to configure a site to site vpn between:

  ASA_A

  external interface 5.179.17.66

  inside the interface 10.1.1.1

  ASA B

  external interface 5.81.57.19

  inside the 10.1.2.1 interface

  Frist why do you have two DGs on box -

  Route outside 0.0.0.0 0.0.0.0 5.179.121.65 1

  Route outside 0.0.0.0 0.0.0.0 5.179.17.65 1

  Attach the two end then it should work.

  Thank you

  Ajay

• site to site vpn with ASA 5500 series SSL?

  We have routers DLink DIR - 130 5505 s ASA and PIXen, all work well with our PIX 515E, we need to replace.

  We also have Internet satellite in two places. High latency makes IPsec VPN to DLinks on these very slow sites.

  We were informed by HughesNet that a SSL VPN will mitigate some of the problems of latency.

  However, we cannot use a VPN client for the biometric timeclocks in these places, the clocks need static IP addresses and are more or less "dumb terminals".

  The machine of series 5000 ASA VPN site to site similar to OpenVPN or only the most comment client-server type SSL VPN connections?

  Thank you, Tom

  Hi Thomas,

  The SSL VPN on ASAs feature is a client/server relationship where the remote computer can connect without client (browser) or clientbased (AnyConnect) to the ASA.

  Federico.

• Site to site VPN with the VPN Client for both sites access?

  Current situation:

  Scenario is remote to the main office. Site IPSEC tunnel site (netscreen) remote in hand (506th pix). Cisco VPN Client of main office of remote access to users.

  It's that everything works perfectly.

  Problem:

  Now we want remote users who connect to the seat to also be able to access resources in the remote offices.

  This seems like it would be easy to implement, but I can't understand it.

  Thanks in advance.

  Rollo

  ----------

  #10.10.10.0 = Network1

  #10.10.11.0 = Network2

  #172.16.1.0 = vpn pool

  6.3 (4) version PIX

  access-list 101 permit ip 10.10.10.0 255.255.255.0 172.16.1.0 255.255.255.0

  access-list 101 permit ip 10.10.10.0 255.255.255.0 10.10.11.0 255.255.255.0

  splitTunnel 10.10.10.0 ip access list allow 255.255.255.0 any

  splitTunnel ip 10.10.11.0 access list allow 255.255.255.0 any

  access-list 115 permit ip any 172.16.1.0 255.255.255.0

  access-list 116 allow ip 10.10.10.0 255.255.255.0 10.10.11.0 255.255.255.0

  IP access-list 116 allow all 10.10.11.0 255.255.255.0

  access-list 116 allow ip 10.10.11.0 255.255.255.0 10.10.10.0 255.255.255.0

  ICMP allow all outside

  ICMP allow any inside

  Outside 1500 MTU

  Within 1500 MTU

  IP address outside 209.x.x.x 255.255.255.224

  IP address inside 10.10.10.1 255.255.255.0

  alarm action IP verification of information

  alarm action attack IP audit

  IP local pool 172.16.1.0 vpnpool - 172.16.1.50

  Global 1 interface (outside)

  Global (outside) 10 209.x.x.x 255.255.255.224

  (Inside) NAT 0-list of access 101

  NAT (inside) 10 10.10.10.0 255.255.255.0 0 0

  Access-group outside_access_in in interface outside

  Route outside 0.0.0.0 0.0.0.0 209.x.x.x 1

  Timeout xlate 01:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225

  H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00

  Timeout, uauth 0:05:00 absolute

  enable floodguard

  Permitted connection ipsec sysopt

  Crypto ipsec transform-set esp-3des esp-sha-hmac RIGHT

  crypto dynamic-map Clients_VPN-dynmap 10 transform-set RIGHT

  35 Myset1 ipsec-isakmp crypto map

  correspondence address 35 Myset1 map cryptographic 116

  card crypto Myset1 35 counterpart set x.x.x.x

  card crypto Myset1 35 set transform-set Myset1

  Myset1 card crypto ipsec 90-isakmp dynamic dynmap Clients_VPN

  client configuration address card crypto Myset1 launch

  client configuration address card crypto Myset1 answer

  interface Myset1 card crypto outside

  ISAKMP allows outside

  ISAKMP key * address x.x.x.x 255.255.255.255 netmask No.-xauth-no-config-mode

  ISAKMP identity address

  ISAKMP nat-traversal 20

  part of pre authentication ISAKMP policy 15

  ISAKMP policy 15 3des encryption

  ISAKMP policy 15 sha hash

  15 1 ISAKMP policy group

  ISAKMP duration strategy of life 15 28800

  part of pre authentication ISAKMP policy 20

  ISAKMP policy 20 3des encryption

  ISAKMP policy 20 chopping sha

  20 2 ISAKMP policy group

  ISAKMP duration strategy of life 20 3600

  part of pre authentication ISAKMP policy 25

  encryption of ISAKMP policy 25

  ISAKMP policy 25 md5 hash

  25 2 ISAKMP policy group

  ISAKMP living 25 3600 duration strategy

  part of pre authentication ISAKMP policy 30

  ISAKMP policy 30 aes-256 encryption

  ISAKMP policy 30 sha hash

  30 2 ISAKMP policy group

  ISAKMP duration strategy of life 30 86400

  vpngroup address vpnpool pool mygroup

  vpngroup dns-server dns1 dns2 mygroup

  vpngroup mygroup wins1 wins2 wins server

  vpngroup mygroup by default-domain mydomain

  vpngroup split splitTunnel tunnel mygroup

  vpngroup idle time 64000 mygroup

  mygroup vpngroup password *.

  Telnet timeout 5

  dhcpd lease 3600

  dhcpd ping_timeout 750

  dhcpd outside auto_config

  Hi Rollo,

  You can not be implemented for a simple reason, it is not supported on the version 6.x PIX. It relies on the PIX 7.x worm but 7.x is not supported on PIX 506. Thus, in a Word, it can be reached on a PIX 506. If you have an ASA, a PIX 515 running 7.x, a router or a hub as well, it can be reached.

  HTH,

  Please rate if this helps,

  Kind regards

  Kamal

• Site to Site VPN between PIX and Linksys RV042

  I am trying to create a tunnel between a 506th PIX and a Linksys RV042 vpn .  I configured the Phase 1 and Phase 2 as well as the transformation defined and interested traffic and connected to the external interface, but it will not create the tunnel.  Configurations are as follows:

  506th PIX running IOS 6.3

  part of pre authentication ISAKMP policy 40
  ISAKMP policy 40 cryptographic 3des
  ISAKMP policy 40 sha hash
  40 2 ISAKMP policy group
  ISAKMP duration strategy of life 40 86400
  ISAKMP key * address 96.10.xxx.xxx netmask 255.255.255.255
  access-list 101 permit ip 192.168.21.0 255.255.255.0 192.168.1.0 255.255.255.0crypto map Columbia_to_Office 10 ipsec-isakmp
  crypto Columbia_to_Office 10 card matches the address 101
  card crypto Columbia_to_Office 10 set peer 96.10.xxx.xxx
  10 Columbia_to_Office transform-set ESP-3DES-SHA crypto card game
  Columbia_to_Office interface card crypto outside

  Linksys RV042

  Configuration of local groups
  IP only
       IP address: 96.10.xxx.xxx
  Type of local Security group: subnet
  IP address: 192.168.1.0
  Subnet mask: 255.255.255.0

  Configuration of the remote control groups
  IP only
  IP address: 66.192.xxx.xxx
  Security remote control unit Type: subnet
  IP address: 192.168.21.0
  Subnet mask: 255.255.255.0

  IPSec configuration
  Input mode: IKE with preshared key
  Group Diffie-Hellman phase 1: group2
  Phase 1 encryption: 3DES
  Authentication of the phase 1: SHA1
  Life of ITS phase 1: 86400
     
  Phase2 encryption: 3DES
  Phase2 authentication: SHA1
  Phase2 life expectancy: 3600 seconds
  Pre-shared key *.

  I'm a novice on the VPN. Thanks in advance for your expertise.

  Yes, version PIX 6.3 does not support HS running nat or sh run crypto.

  Please please post the complete config if you don't mind.

  Please also try to send traffic between subnets 2 and get the output of:

  See the isa scream his

  See the ipsec scream his

• multi-site VPN with just the cisco vpn client

  Hello everyone

  Please I need your help.

  We have a headquarters office and up to 60 is BranchOffice, we want to create VPN network between its. so let's deploy 2 router cisco esy vpn server with HA (HSRP) at the Headquarters Office and all branches have Connection ADSL and they will use just the cisco vpn client to connect to the Headquarters Office.

  My question is: is it possible to do it just with the client vpn cisco without purchased for any exercise bracnh a cisco router to create an ipsec tunnel because it is so expensive?

  It depends on if the routers to offices can handle NAT with several internal VPN clients to 1 IP address. Most of the new material should be fine. Keep in mind the maximum limit of the VPN client, with 60 agencies and 5 people each of whom you are above the limit.

  Michael

  Please note all useful posts

• Cisco ASA 5510 VPN with PIX 515

  Hello

  I have VPN between Cisco ASA and Cisco PIX.

  I saw in my syslog server this error that appears once a day, more or less:

  Received a package encrypted with any HIS correspondent, drop

  I ve seen issue in another post, but in none of then the solution.

  Here are my files from the firewall configuration:

  Output from the command: 'show running-config '.

  : Saved
  :
  ASA Version 8.2 (1)
  Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac
  life crypto ipsec security association seconds 28800
  Crypto ipsec kilobytes of life - safety 4608000 association
  card crypto WAN_map2 2 corresponds to the address WAN_cryptomap_1
  card crypto WAN_map2 2 set pfs
  card crypto WAN_map2 2 peer 62.80.XX game. XX
  map WAN_map2 2 game of transformation-ESP-DES-MD5 crypto
  card crypto WAN_map2 2 defined security-association 2700 seconds life
  card crypto WAN_map2 2 set nat-t-disable
  card crypto WAN_map2 WAN interface
  enable LAN crypto ISAKMP
  ISAKMP crypto enable WAN
  crypto ISAKMP policy 1
  preshared authentication
  the Encryption
  md5 hash
  Group 5
  lifetime 28800
  No encryption isakmp nat-traversal
  tunnel-group 62.80.XX. XX type ipsec-l2l
  tunnel-group 62.80.XX. IPSec-attributes of XX
  pre-shared-key *.
  

  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

  8.0 (4) version PIX
  !
  Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac
  life crypto ipsec security association seconds 28800
  Crypto ipsec kilobytes of life - safety 4608000 association
  card encryption VPN_map2 3 corresponds to the address VPN_cryptomap_2
  card encryption VPN_map2 3 set pfs
  card crypto VPN_map2 3 peer 194.30.XX game. XX
  VPN_map2 3 transform-set ESP-DES-MD5 crypto card game
  card encryption VPN_map2 3 defined security-association life seconds 2700
  card encryption VPN_map2 3 set security-association kilobytes of life 4608000
  card VPN_map2 3 set nat-t-disable encryption
  VPN crypto map VPN_map2 interface
  crypto ISAKMP enable VPN
  crypto ISAKMP allow inside
  crypto ISAKMP policy 30
  preshared authentication
  the Encryption
  md5 hash
  Group 5
  lifetime 28800
  No encryption isakmp nat-traversal
  ISAKMP crypto am - disable
  attributes of Group Policy DfltGrpPolicy
  Protocol-tunnel-VPN IPSec
  tunnel-group 194.30.XX. XX type ipsec-l2l
  tunnel-group 194.30.XX. IPSec-attributes of XX
  pre-shared-key *.
  

  If you need more information dedailed ask me questions.

  Thanks in advance for your help.

  Javi

  Hi Javi,

  Please after the release of "see broadcasting DfltGrpPolicy of any political group." See if you have the "vpn-idle-timoeout" command configured in that. If so, please change to "vpn-idle-timeout no" and see if that stops at these popping up error messages.

  http://www.Cisco.com/en/us/docs/security/ASA/asa80/command/reference/uz.html#wp1571426

  Thank you and best regards,

  Assia

• Remote VPN with PIX without access to the local network

  Hi @all,

  I ve running into problems and I have not found any solution. Can someone check my config?

  Facts:

  PIX 501 6.3 (3)

  4.04 VPN client

  Wanted solution: access to HO via VPN

  VPN tunnel will be established, I get an IP address, but I can´t the systems behind the pix and the pix of access itself.

  To the VPN Client Staticts, I see outgoing packets, but no entrant (if I send a ping to peer behind the pix)

  I hope someone can help me

  Attached is my config:

  PIX 501 and 506/506e pix are not supported in v7 due to the fact that the cpu is not able to deal with the extended features of v7.

  PIX 520 is not supported I guess it's because of the fact that the model is discontinued.

• Cannot access the internal network of VPN with PIX 506th

  Hello

  I seem to have a problem with the configuration of my PIX. I ping the VPN client from the network in-house, but cannot cannot access all the resources of the vpn client. My running configuration is the following:

  Building configuration...

  : Saved

  :

  6.3 (5) PIX version

  interface ethernet0 car

  Auto interface ethernet1

  ethernet0 nameif outside security0

  nameif ethernet1 inside the security100

  activate the encrypted password of N/JZnmeC2l5j3YTN

  2KFQnbNIdI.2KYOU encrypted passwd

  hostname SwantonFw2

  domain name * *.com

  fixup protocol dns-length maximum 512

  fixup protocol ftp 21

  fixup protocol h323 h225 1720

  fixup protocol h323 ras 1718-1719

  fixup protocol http 80

  fixup protocol rsh 514

  fixup protocol rtsp 554

  fixup protocol sip 5060

  fixup protocol sip udp 5060

  fixup protocol 2000 skinny

  fixup protocol smtp 25

  fixup protocol sqlnet 1521

  fixup protocol tftp 69

  names of

  access-list outside_access_in allow icmp a whole

  allow_ping list access permit icmp any any echo response

  allow_ping list all permitted access all unreachable icmp

  access-list allow_ping allow icmp all once exceed

  the INSIDE-IN access list allow inside the interface tcp interface outside

  list access to the INSIDE-IN permit udp any any eq field

  list access to the INSIDE-IN permit tcp any any eq www

  list access to the INSIDE-IN permit tcp any any eq ftp

  list access to the INSIDE-IN permit icmp any any echo

  the INSIDE-IN permit tcp access list everything all https eq

  permit access ip 192.168.0.0 list inside_outbound_nat0_acl 255.255.255.0 192.168.240.0 255.255.255.0

  swanton_splitTunnelAcl ip access list allow a whole

  outside_cryptomap_dyn_20 ip access list allow any 192.168.240.0 255.255.255.0

  no pager

  Outside 1500 MTU

  Within 1500 MTU

  192.168.1.150 outside IP address 255.255.255.0

  IP address inside 192.168.0.35 255.255.255.0

  alarm action IP verification of information

  alarm action attack IP audit

  IP pool local VPN_Pool 192.168.240.1 - 192.168.240.254

  location of PDM 0.0.0.0 255.255.255.0 outside

  location of PDM 192.168.1.26 255.255.255.255 outside

  location of PDM 192.168.240.0 255.255.255.0 outside

  PDM logging 100 information

  history of PDM activate

  ARP timeout 14400

  Global 1 interface (outside)

  NAT (inside) 0-list of access inside_outbound_nat0_acl

  NAT (inside) 1 192.168.0.0 255.255.255.0 0 0

  Access-group outside_access_in in interface outside

  group-access INTERIOR-IN in the interface inside

  Route outside 0.0.0.0 0.0.0.0 192.168.1.1 1

  Timeout xlate 0:05:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225

  H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00

  Sip timeout - disconnect 0:02:00 prompt Protocol sip-0: 03:00

  Timeout, uauth 0:05:00 absolute

  GANYMEDE + Protocol Ganymede + AAA-server

  AAA-server GANYMEDE + 3 max-failed-attempts

  AAA-server GANYMEDE + deadtime 10

  RADIUS Protocol RADIUS AAA server

  AAA-server RADIUS 3 max-failed-attempts

  AAA-RADIUS deadtime 10 Server

  AAA-server local LOCAL Protocol

  Enable http server

  http 192.168.0.0 255.255.255.0 inside

  No snmp server location

  No snmp Server contact

  SNMP-Server Community public

  No trap to activate snmp Server

  enable floodguard

  Permitted connection ipsec sysopt

  Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

  Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

  Dynamic crypto map outside_dyn_map 20 match address outside_cryptomap_dyn_20

  Crypto-map dynamic outside_dyn_map 20 the transform-set ESP-DES-MD5 value

  map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map

  client authentication card crypto outside_map LOCAL

  outside_map interface card crypto outside

  ISAKMP allows outside

  ISAKMP identity address

  part of pre authentication ISAKMP policy 20

  encryption of ISAKMP policy 20

  ISAKMP policy 20 md5 hash

  20 2 ISAKMP policy group

  ISAKMP duration strategy of life 20 86400

  Swanton vpngroup address pool VPN_Pool

  vpngroup swanton 192.168.1.1 dns server

  vpngroup swanton splitting swanton_splitTunnelAcl tunnel

  vpngroup idle 1800 swanton-time

  swanton vpngroup password *.

  Telnet timeout 5

  SSH timeout 5

  Console timeout 0

  dhcpd address 192.168.0.36 - 192.168.0.254 inside

  dhcpd dns 8.8.8.8 8.8.4.4

  dhcpd lease 3600

  dhcpd ping_timeout 750

  dhcpd outside auto_config

  dhcpd allow inside

  scott hwDnqhIenLiwIr9B of encrypted privilege 15 password username

  username password encrypted ET3skotcnISwb3MV privilege 2 norm

  username password tarmbrecht Zre8euXN6HxXaSdE encrypted privilege 2

  username, password jlillevik 9JMTvNZm3dLhQM/W encrypted privilege 2

  username privilege 15 encrypted password 49ikl05C8VE6k1jG ruralogic

  username bzeiter 1XjpdpkwnSENzfQ0 encrypted password privilege 2

  name of user mwalla encrypted password privilege 2 l5frk9obrNMGOiOD

  username heavyfab1 6.yy0ys7BifWsa9k encrypted password privilege 2

  username heavyfab3 6.yy0ys7BifWsa9k encrypted password privilege 2

  username heavyfab2 6.yy0ys7BifWsa9k encrypted password privilege 2

  username djet encrypted password privilege 2 wj13fSF4BPQzUzB8

  username, password cmorgan y/NeUfNKehh/Vzj6 encrypted privilege 2

  username password cmayfield Pe/felGx7VQ3I7ls encrypted privilege 2

  username privilege 2 encrypted password zQEQceRITRrO4wJa jeffg

  Terminal width 80

  Cryptochecksum:9005f35a85fa5fe31dab579bbb1428c8

  : end

  [OK]

  Any help will be greatly appreciated

  BJ,

  You try to access resources behind the inside interface network?

  IP address inside 192.168.0.35 255.255.255.0

  If so, please make the following changes:

  1 SWANTON_VPN_SPLIT permit access ip 192.168.0.0 list 255.255.255.0 192.168.240.0 255.255.255.0

  2-no vpngroup swanton splitting swanton_splitTunnelAcl tunnel

  Swanton vpngroup split tunnel SWANTON_VPN_SPLIT

  outside_cryptomap_dyn_20 3-no-list of ip access allowing any 192.168.240.0 255.255.255.0

  4 - isakmp nat-traversal 30

  Let me know how it goes.

  Portu.

  Please note all useful posts

• Save the password on the Client VPN with PIX

  I'm running a PIX 515 6.1 (2) configured for a small number of VPN clients. I want VPN clients to automatically remember the password of login for users do not have to enter it each time (we have an application which periodically autoconnexions).

  While it is a configurable option with concentrators 3000 series, it seems not be configurable with the PIX.

  The only work around, I can find is to make the connection file (.pcf) read-only and set SaveUserPassword = 1. The problem

  which is the password, and then must be stored in clear text in the file and it becomes inconvenient for the user to change their password.

  Does anyone know if the command exists on the PIX from the VPN client to save the connection password?

  Thank you

  Misha

  The command to do this is not currently available on the PIX. He has just been included in the IOS EZVPN server functionality, but have not heard of anything anyone yet as to if it will be included in the PIX.

  If you want this feature, do not hesitate to contact your account manager and have them grow for him, the more customers requesting a new feature faster he gets.

• VPN with PIX 501

  Help!

  I'm trying to set up VPN on my PIX 501. I have no experience of the PIX and have no idea where to start!

  Any help will be greatly appreciated.

  Thank you

  Bennie

  access list allow accord a

  where is the name of the access list that you applied the entrants to your external interface. You may also allow accord coming out, if you have a list of incoming configured access to your inside interface.

• VPN with ASA 5500 VPN with PIX 515E vs

  I wonder what are the differences between the use of an exisitng PIX 515E for VPN remote users as appossed to acquire an ASA 5500 VPN remote users? Information or advice are appreciated to help me lean toward one or the other.

  Craig

  According to the version of the code that you run on the PIX on the PIX or ASA VPN features must be the same. So if the choice is not based on differences in features, what else would help guide the choice? You can consider if the existing PIX has sufficient resources to add the extra processing VPN load or if you should put that on another box. You might consider that the PIX is an older product range, and his end is near, while the ASA is the product that is the strategic replacement for the PIX. Given a choice I probably prefer to use a technology newer than the old technology. I also believe that the ASA will give you more choice of technology to go forward (a way of better growth) while the PIX provides current capacity but no path of growth.

  On the other hand, there is the aspect of consider that using the existing PIX does not need not to buy something new and ASA would be an expense you have to cover in the budget. And for some people the budget constraint is an important consideration.

  HTH

  Rick