VPN on PIX in VLAN own?

Similar Questions

• VPN concentrator + PIX on LAN-> customers can not reach local servers

  Hello

  I have a problem wrt. remote access clients coming via a VPN3000 concentrator and trying to access local servers.

  For the topology:

  The internal network is 10.0.1.0/24. It connects with the outside world, as well as via a PIX DMZ; the PIX has 10.0.1.1 in the internal network.

  On the same LAN (internal), I have the VPN concentrator for the inside address 10.0.1.5. It assigns addresses in the 10.0.100.0/24 range to the

  VPN client-PCs.

  I can sucessfully connect using the VPN client SW to the hub, i.e. remote access clients out addresses

  the 10.0.100.0/24 range.

  The problem: access from VPN clients to internal network is * not * possible; for example, a customer with 10.0.100.1 cannot connect to

  internal to the 10.0.1.28 server.

  To my knowledge, this is a routing problem because the server (10.0.1.28) has no idea on how to reach customers in

  10.0.100.0/24. The only thing that the server is a default static route pointing to the PIX, i.e. 10.0.1.1.

  So I set up a static route on the PIX for 10.0.100.0 pointing to the hub-VPN, that is

  Mylan route 10.0.100.0 255.255.255.0 10.0.1.5 1

  This does not solve my problem though.

  In the PIX logs, I see the entries as follows:

  % 3 PIX-106011: deny entering (no xlate) tcp src trainee: 10.0.1.28 (atlas) / 445 intern dst: 10.0.100.1 (pending) 1064

  The PIX seems to abandon return packages, i.e. traffic from the server back to the client

  To my knowledge, the problem seems to be:

  Short traffic VPN - client-> Concentrator VPN-> Server-> PIX - where it gets moved.

  My reasoning: the PIX only sees the package back, i.e. the package back from the server to the client - and therefore decreasing the

  package because he has not seen the package from the client to the server.

  So here are my questions:

  (o) how do I configure the PIX that I be connectivity between my remote VPN clients (10.0.100.0/24) and

  computers servers on the local network (10.0.1.0/24)?

  (o) someone else you have something like this going?

  PS: Please note that the first obvious idea, installation of static routes on all machines on the local network is not an option here.

  Thank you very much in advance for your help,.

  -ewald

  Hello, PIX the because can not route traffic on the same interface (prior to version 7.0 anyway), I suggest you two places your hub to the outside with the inside of the legs on a zone demilitarized or (if you can not do a makeover of the network) you remove your pool with 10.0.100.0 - addresses and create a pool with 10.0.1.0 - addresses which is a part of the address space. No, NOT all. A little book that it is not used inside.

  Best regards

  Robert Maras

• VPN to PIX access problem.

  I set up PPTP VPN on PIX 515 access with unrestricted license for Windows-based computers. I can connect but I'm unable to access all the resources on the network. I suspect this has something to access the list, but I don't know where to start. Here's the relevant part of the PIX config:

  access-list all-traffic ip to allow a whole

  access-list 100 permit icmp any any echo response

  access-list 100 permit icmp any one time exceed

  access-list 100 permit everything all unreachable icmp

  .

  IP address outside x.x.x.130 255.255.255.252

  IP address inside 192.168.254.1 255.255.255.0

  IP address x.x.x.97 255.255.255.224 DMZ1

  address IP DMZ2 192.168.251.1 255.255.255.0

  alarm action IP verification of information

  alarm action attack IP audit

  IP local pool vpnpool 192.168.254.201 - 192.168.254.254

  .

  Global (outside) 1 x.x.x.65 - x.x.x.93 netmask 255.255.255.224

  Global (outside) 1 x.x.x.94 netmask 255.255.255.224

  NAT (inside) 1 access-list all-traffic 0 0

  (DMZ1) 1 access-list all-traffic NAT 0 0

  Access-group 100 in external interface

  Route outside 0.0.0.0 0.0.0.0 x.x.x.129 1

  .

  Sysopt connection permit-pptp

  Telnet 192.168.254.0 255.255.255.0 inside

  Telnet timeout 5

  SSH timeout 5

  Console timeout 0

  VPDN Group 1 accept dialin pptp

  PAP VPDN Group 1 ppp authentication

  VPDN Group 1 chap for ppp authentication

  VPDN Group 1 ppp authentication mschap

  VPDN group ppp 1 encryption mppe auto

  VPDN Group 1 client configuration address local vpnpool

  VPDN Group 1 pptp echo 60

  VPDN Group 1 client authentication local

  VPDN username * password *.

  VPDN allow outside

  dhcpd address 192.168.254.100 - 192.168.254.200 inside

  dhcpd dns x.x.x.131 x.x.x.200

  dhcpd rental 86400

  dhcpd ping_timeout 750

  dhcpd allow inside

  Looks like you forgot to add a "nat 0" defines that there are no PAT beween your local inside network and the PPTP DHCP pool.

  PPTP pool must be different from the inside pool otherwise it is not routable correctly.

  no ip local pool vpnpool 192.168.254.201 - 192.168.254.254

  # Choose a new network PPTP pool that is not in use

  example of dansMon # is 192.168.1.0/24

  IP local pool vpnpool 192.168.1.1 - 192.168.1.254

  access-list 101 permit ip 192.168.254.0 255.255.255.0 192.168.1.0 255.255.255.0

  (Inside) NAT 0-list of access 101

  See this site for more information:

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a0080143a5d.shtml

  http://www.Cisco.com/pcgi-bin/support/browse/psp_view.pl?p=hardware:PIX & s = Software_Configuration

  see PPTP

  sincerely

  Patrick

• Login problem VPN on PIX on the side of the inside of the n/w

  I am tring to connect to the vpn server (pix) outside my laptop within the network.

  I have routed ip vpn on pix515 and fine ping pix.but not able to ping of 3550 switch and computer laptop.

  How to get the vpn ip Switch? as I don't know the mask of the ip...

  I would also like to know... is their something extra that I need on pix or 3550?

  Hello!

  -What is the default gateway of your laptop?

  -You do any kind of NAT on the PIX? What is NAT PAT, static or normal?

  -Can you ping the inside of the PIX of the laptop?

  There could be several problems to solve here.

  (1) first of all, make sure that your laptop has access to the internet

  (2) If you want to ping him make sure internet you have an ACL on the PIX like the one below:

  i.e.

  Allow Access - list icmp an entire TEST

  TEST group access in the interface outside

  Also make sure you have no access list applied inside the PIX

  -Now, can you connect at all?

  -When you connect to? Another PIX? Router? Hub?

  If you pass by PAT make sure that you have this command on the PIX:

  "fixup protocol esp-ike.

  Please let me know if you can answer my questions, in this way, it would be easier to help you.

  Frank

• Information on the routing of traffic of the client VPN to PIX.

  Hey all,.

  I could follow the VPN Wizard included in the PDM and able to connect with the VPN Clients for the PIX. But I'm looking for more information about how the routing is done.

  For example, my remote is 67.71.252.xxx and my inside is 192.168.1.xxx. But if I connect via VPN to PIX Client, all data is transferred through my VPN to PIX and then trying to get out to the Internet.

  I'll settle for data goes 192.168.1.xxx for transit through the VPN. This configuration made via the PIX or is it the responsibility of the Client machine to set up rules of the road?

  All links to the guides to installation, or technical notes would be great.

  Thank you inadvance.

  Paul

  Hello

  I think the key word you are looking for is "split tunneling". This can be validated on the PIX using the vpngroup split access_list tunnel GroupName command.

  "Split tunneling allows a remote VPN client or encrypted simultaneous Easy VPN remote access device to the corporate network and Internet access. Using the vpngroup split-tunnel command, specify the access list name with which to associate the split tunneling of traffic. "

  In this example configuration: http://www.cisco.com/warp/public/110/pix3000.html, note that the same access list is used to "nat 0" and split-mining:

  access-list 101 permit ip 10.1.1.0 255.255.255.0 10.1.2.0 255.255.255.0

  (Inside) NAT 0-list of access 101

  vpngroup vpn3000 split tunnel 101

  Order reference:

  http://www.Cisco.com/en/us/products/sw/secursw/ps2120/products_command_reference_chapter09186a00801727ae.html#wp1099471

  Please let us know if this helped

  Kind regards

  Mustafa

• Can the customer vpn to pix interface unprotected to a protected interface

  I have a pix multi-interface, the description of the interface is as follows:

  Outside-> 10MB to ISP

  Inside-> vlan main

  DMZ-> Web servers, etc...

  Lab1-> test application servers

  LAB2-> test application servers

  etc...

  Comments wireless-> free wireless (connected to the Cisco WAP)

  The open wireless only has access to the internet, not one of the reliable networks. It is an untrusted interface (security lvl 1). The external interface is security 0.

  I want to be able to allow vpn access from the wireless in networks of trust like vpn from outside (internet) is processed.

  I guess that the pix sees a vpn connection attempt to another of its interfaces.

  The client times out connecting since the wireless for the pix outside IP interface.

  The pix records simply this:

  January 20, 2009 13:38:23: % 7-710005-PIX: UDP request and eliminated from 192.168.20.5/1346 to GuestWireless:yy.yy.yy.yy/500

  the external interface IP = yy.yy.yy.yy

  the pix is also the dhcp server for wireless network connections.

  Is it still possible? If so, what Miss me?

  Thank you

  Dave

  To answer: -.

  The leg wireless of the PIX is the security level 1, and the external interface is the security level 0. That would not mean that vpn is launched from a higher to a lower security interface? Yes but the traffic is clear--asked to terminate a VPN connection to an interface that is locally attached to the PIX effectivly in the inside of the unit. Sure that PIX will refuse the connection he received on the external interface of the interface without comment thread.

  No it isn't the same thing, something like: -.

  crypto ISAKMP enable GuestWireless - this indicates the PIX to listen and accept connections VPN ISAKMP/issues of ANY device connected to this interface FOR the GuestWireless interface.

  HTH >

• VPN to pix 515

  Good day to all,

  I'm trying to configure the client VPN to a PIX 515.  Once VPN'ed in, the traffic is going no where, but on THIS subnet. The Vlan that we are trying to achieve is a 10.111.250.x/23.  Once VPN'ed in the allocation of an IP address is 10.111.250.33 - 10.111.250.63. We can VPN in and get VPN IP assigned, but we cannot get anywhere inside VLANs.  I was sure that it could be done in a layer 2.  You can view the assigned addresses VPN arped entries and the inside address Vlan on the Pix.

  Keep in mind, my first thought was to change the VPN address assigned, but we do not want to carry on this Vlan especially because access is very limited.

  Is it possible to make this work?  If I have to redo attributes and policy, I.

  Thank you

  Dwane

  The output shows that the PIX is decrypt packets, but not encryption.

  So there is a good chance that packets are sent within the network but not to return.

  Check the following:

  management-access within the--> this command should allow ping to the IP of the VPN PIX inside (make sure you that if you can TEST this IP address when connected)

  Verify that the default gateway within the network (behind the PIX) is the current inside the property intellectual of the PIX.

  After these tests, post again "sh cry ips its"

  Federico.

• Client VPN on PIX needs to access DMZ

  VPN clients 3.5 ending PIX 6.X cannot access hosts on a PIX DMZ interface. Journal reports of error that there is no 'translation group available outside' for the subnet of the VPN Client (from the vpngroup pool).

  I should add the VPN client subnet to a nat (outside) device?

  Can I add it to the nat inside?

  Can I just add static to the DMZ hosts within the subnet interface because VPN clients can access the inside hosts?

  (I have the subnets in the nat 0 sheep ACL)

  Thanks and greetings

  JT

  You'll need to add is nat 0. You say in your () you have an acl sheep, for the perimeter network or the inside interface? You use the same access list to the sheep inside and dmz? You should separate if you use separate access list. Is your pool of client on a different subnet than your home network and dmz? It must be something like this:

  Customer IP local pool 192.168.1.1 - 192.168.1.254

  IP, add inside 10.10.10.1 255.255.255.0

  Add 10.10.20.1 dmz IP 255.255.255.0

  access-list sheep by 10.10.10.0 ip 255.255.255.0 192.168.1.0 255.255.255.0

  nonatdmz list of access by IP 10.10.20.0 255.255.255.0 192.168.1.0 255.255.255.0

  NAT (inside) 0 access-list sheep

  NAT (dmz) 0-list of access nonatdmz

  If this is correct then clear x, wr mem, reload. I hope this helps.

  Kurtis Durrett

  PS

  If he did not, only can recommend the upgrade your client and pix because that is exactly how it should look, and if its does not work you are facing an additional feature you want.

• VPN to Pix problem

  It seems that I have problems similar to many others in the connection of remote clients to a PIX 515E.

  Currently, I have tried both the client VPN Cisco 3.6 and 4.03 without success. Users are authenticated very well and the customer, you can see that their assigned an address etc but they are unable to access the internal network. The crypto ipsec his watch HS no encrypted traffic has affected the Pix as its...

  within the State of the customer etc., it shows that packets are encrypted so I'm at a bit of a loss.

  I have also a problem with pptp connections - this seems to differ between the BONES on the client but Win2K machines can connect and get checked etc but again failed to connect within the networks. These could be linked?

  My current config is: (change of address, etc.)

  SH run

  : Saved

  :

  PIX Version 6.2 (1)

  ethernet0 nameif outside security0

  nameif ethernet1 inside the security100

  nameif ethernet2 security10 intf2

  enable password xxxx

  passwd xxxx

  hostname fw

  domain name

  fixup protocol ftp 21

  fixup protocol http 80

  fixup protocol h323 h225 1720

  fixup protocol h323 ras 1718-1719

  fixup protocol they 389

  fixup protocol rsh 514

  fixup protocol rtsp 554

  fixup protocol smtp 25

  fixup protocol sqlnet 1521

  fixup protocol 2000 skinny

  No fixup protocol sip 5060

  names of

  name Inside_All 10.0.0.0

  name 10.30.1.0 Ireland1_LAN

  name 159.135.101.34 Ireland1_VPN

  name 213.95.227.137 IrelandSt1_VPN

  name 10.30.2.0 Cardiff_LAN

  name 82.69.56.30 Cardiff_VPN

  access-list 101 permit ip Inside_All 255.0.0.0 10.1.1.88 255.255.255.248

  access-list 101 permit ip Ireland1_LAN 255.255.255.0 255.0.0.0 Inside_All

  access-list 101 permit ip Cardiff_LAN 255.255.255.0 255.0.0.0 Inside_All

  access-list 101 permit ip Inside_All 255.0.0.0 10.30.3.0 255.255.255.0

  access-list 101 permit ip Inside_All 255.0.0.0 192.168.253.0 255.255.255.0

  outside_interface list access permit icmp any any echo

  outside_interface list access permit icmp any any echo response

  outside_interface list of access permit icmp any any traceroute

  outside_interface list access permit tcp any host 212.36.237.99 eq smtp

  outside_interface ip access list allow any host 212.36.237.100

  access-list permits outside_interface tcp host 212.241.168.236 host 212.36.237.101 eq telnet

  outside_interface list of access permitted tcp 192.188.69.0 255.255.255.0 host 212.36.237.101 eq telnet

  outside_interface list access permit tcp any any eq telnet

  allow the ip host 82.69.108.125 access list outside_interface a

  access-list 102 permit ip 10.1.1.0 255.255.255.0 Ireland1_LAN 255.255.255.0

  access-list 103 allow ip 10.1.1.0 255.255.255.0 Cardiff_LAN 255.255.255.0

  access-list 104. allow ip 10.1.1.0 255.255.255.0 10.30.3.0 255.255.255.0

  pager lines 24

  opening of session

  recording of debug console

  monitor debug logging

  interface ethernet0 10baset

  interface ethernet1 10baset

  Automatic stop of interface ethernet2

  Outside 1500 MTU

  Within 1500 MTU

  intf2 MTU 1500

  IP outdoor 212.36.237.98 255.255.255.240

  IP address inside 10.1.1.250 255.255.255.0

  intf2 IP address 127.0.0.1 255.255.255.255

  alarm action IP verification of information

  alarm action attack IP audit

  IP local pool ippool 10.1.1.88 - 10.1.1.95

  IP local pool mspool 10.7.1.1 - 10.7.1.50

  IP local pool mspools 192.168.253.1 - 192.168.253.50

  location of PDM Inside_All 255.255.255.0 inside

  location of PDM 82.69.108.125 255.255.255.255 outside

  location of PDM 10.55.1.0 255.255.255.0 inside

  PDM logging 100 information

  history of PDM activate

  ARP timeout 14400

  Global 1 interface (outside)

  (Inside) NAT 0-list of access 101

  NAT (inside) 1 0.0.0.0 0.0.0.0 0 0

  public static 212.36.237.100 (Interior, exterior) 10.1.1.50 netmask 255.255.255.255 0 0

  public static 212.36.237.101 (Interior, exterior) 10.1.1.254 netmask 255.255.255.255 0 0

  public static 212.36.237.99 (Interior, exterior) 10.1.1.208 netmask 255.255.255.255 0 0

  Access-group outside_interface in interface outside

  Route outside 0.0.0.0 0.0.0.0 212.36.237.97 1

  Route inside Inside_All 255.255.255.0 10.1.1.254 1

  Route inside 10.2.1.0 255.255.255.0 10.1.1.254 1

  Route inside 10.3.1.0 255.255.255.0 10.1.1.254 1

  Route inside 10.4.1.0 255.255.255.0 10.1.1.254 1

  Route inside 10.5.1.0 255.255.255.0 10.1.1.254 1

  Route inside 10.6.1.0 255.255.255.0 10.1.1.254 1

  Route inside 10.7.1.0 255.255.255.0 10.1.1.254 1

  Route inside 10.8.1.0 255.255.255.0 10.1.1.254 1

  Route inside 10.9.1.0 255.255.255.0 10.1.1.254 1

  Route inside 10.10.1.0 255.255.255.0 10.1.1.254 1

  Route inside 10.11.1.0 255.255.255.0 10.1.1.253 1

  Timeout xlate 03:00

  Timeout conn 01:00 half-closed 0: 10:00 udp 0:02:00 CPP 0: h323 from 10:00 0:05:00 sip 0:30:00 sip_media 0:02:00

  Timeout uauth 0:00:00 uauth absolute 0:30:00 inactivity

  GANYMEDE + Protocol Ganymede + AAA-server

  RADIUS Protocol RADIUS AAA server

  AAA-server local LOCAL Protocol

  AAA-server AuthInOut Protocol Ganymede +.

  AAA-server AuthInOut (inside) host 10.1.1.203 Kinder timeout 10

  the AAA authentication include http outside 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 AuthInOut

  the AAA authentication include http inside 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 AuthInOut

  AAA accounting include http outside 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 AuthInOut

  AAA accounting include http inside 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 AuthInOut

  Enable http server

  http 82.69.108.125 255.255.255.255 outside

  http 10.1.1.0 255.255.255.0 inside

  No snmp server location

  No snmp Server contact

  Server SNMP community xxx

  No trap to activate snmp Server

  enable floodguard

  Permitted connection ipsec sysopt

  Sysopt connection permit-pptp

  Sysopt route dnat

  Crypto ipsec transform-set esp - esp-md5-hmac VPNAccess

  Crypto ipsec transform-set esp-3des esp-md5-hmac VPNAccess2

  Crypto-map dynamic dynmap 10 game of transformation-VPNAccess2

  card crypto home 9 ipsec-isakmp dynamic dynmap

  card crypto ipsec-isakmp 10 home

  address of 10 home game card crypto 102

  set of 10 House card crypto peer IrelandSt1_VPN

  House 10 game of transformation-VPNAccess crypto card

  card crypto ipsec-isakmp 15 home

  address of home 15 game card crypto 103

  set of 15 home map crypto peer Cardiff_VPN

  House 15 game of transformation-VPNAccess crypto card

  card crypto ipsec-isakmp 30 home

  address of 30 home game card crypto 104

  crypto home 30 card set peer 212.242.143.147

  House 30 game of transformation-VPNAccess crypto card

  interface card crypto home outdoors

  ISAKMP allows outside

  ISAKMP key * address IrelandSt1_VPN netmask 255.255.255.255

  ISAKMP key * address Cardiff_VPN netmask 255.255.255.255

  ISAKMP key * address 212.242.143.147 netmask 255.255.255.255

  ISAKMP identity address

  part of pre authentication ISAKMP policy 5

  ISAKMP strategy 5 3des encryption

  ISAKMP strategy 5 md5 hash

  5 2 ISAKMP policy group

  ISAKMP life duration strategy 5 86400

  part of pre authentication ISAKMP policy 7

  ISAKMP strategy 7 3des encryption

  ISAKMP strategy 7 sha hash

  7 2 ISAKMP policy group

  ISAKMP strategy 7 life 28800

  part of pre authentication ISAKMP policy 10

  encryption of ISAKMP policy 10

  ISAKMP policy 10 md5 hash

  10 1 ISAKMP policy group

  ISAKMP policy 10 life 85000

  part of pre authentication ISAKMP policy 20

  encryption of ISAKMP policy 20

  ISAKMP policy 20 md5 hash

  20 2 ISAKMP policy group

  ISAKMP duration strategy of life 20 85000

  vpngroup client address mspools pool

  vpngroup dns-server 194.153.0.18 client

  vpngroup wins client-server 10.155.1.16

  vpngroup idle time 1800 customer

  vpngroup customer password *.

  Telnet 82.69.108.125 255.255.255.255 outside

  Telnet 10.55.1.0 255.255.255.0 inside

  Telnet 10.1.1.0 255.255.255.0 inside

  Telnet timeout 15

  SSH 82.69.108.125 255.255.255.255 outside

  SSH timeout 15

  VPDN Group 6 accept dialin pptp

  PAP VPDN Group 6 ppp authentication

  VPDN Group 6 chap for ppp authentication

  VPDN Group 6 ppp mschap authentication

  VPDN Group 6 ppp encryption mppe auto

  VPDN Group 6 client configuration address local mspools

  VPDN Group 6 pptp echo 60

  local 6 VPDN Group client authentication

  VPDN username xxxx password *.

  VPDN username password xxx *.

  VPDN username password xxx *.

  VPDN username password xxx *.

  VPDN username xxxx password *.

  VPDN allow outside

  username xxx pass xxx

  Terminal width 80

  Cryptochecksum:8f8ceca91c6652e3cc8086edc8ed62fa

  : end

  If you do not see decrypts side Pix while my thoughts are (for IPSEC) ESP and GRE (for PPTP) do not get to your Pix (blocks perhaps of ISP or other devices).

  If you do a "capture" of the packets on the external interface you see all traffic ESP or GRE? Where the customer? If this isn't the case, dialup is ESP or permitted GRE?

• VPN with PIX 501

  Help!

  I'm trying to set up VPN on my PIX 501. I have no experience of the PIX and have no idea where to start!

  Any help will be greatly appreciated.

  Thank you

  Bennie

  access list allow accord a

  where is the name of the access list that you applied the entrants to your external interface. You may also allow accord coming out, if you have a list of incoming configured access to your inside interface.

• Termination of VPN on Pix behind router IOS with private subnet

  OK, basically, I wonder if it is possible to terminate a VPN connection on a Pix 506 Firewall which is behind a router IOS. The public interface of the Pix 506 have a private on a 29 ip address will IOS within the interface. Network is configured as follows:

  Internet as 10Base T

  | (5 public - X.X.X.34. 38)

  | (In WIC-1ENET)

  | (.34 assigned to interface)

  Cisco 1760

  | (Pomp) | (WIC-4PORTSWITCH)

  | | (10.0.0.1 29 on 1760)

  Net private Pix 506

  (192.168.1.0) (10.0.0.2 29 on Pix)

  Now, two internal interfaces of the 1760 are configured to PAT on the IP of the interface of the 1760 and all internet traffic goes perfectly. None of the access lists are currently applied anywhere on the 1760 and a static translation on the 1760 is configured pour.35 to 10.0.0.2 ('public' ip pix). RDP and other services authorized in the pix access list work perfectly well from the outside world when you enter a.35, but if I try to terminate a VPN from a pix 501 for the pix 506 offsite using the Intellectuelle.35 property, it does not work.

  Is it possible to do this type of work setting.

  I realize I could put an external switch to 1760 and run the public subnet directly and individually in the 1760 and Pix 506, however, I really would prefer not no need to do so if it is possible to avoid it.

  Remove the crypto map to the interface on the PIX and reapply.

• VPN between PIX and ASA

  I have a vpn beteen two sites, which works very well. traffic is launched from site A and can connect to the site B ok.

  I just tried to set up traffic from site B to site A, but its failure the vpn encrypt point. I checked the acl and they match:

  site A (PIX)

  Crypto acl

  access-list site_a permit tcp host 10.51.3.32 10.0.0.0 255.0.0.0 eq 3389

  no nat

  no_nat list of allowed access host ip 10.51.3.32 10.0.0.0 255.0.0.0

  site B (ASA)

  Crypto acl

  Site_B list extended access permitted tcp 10.0.0.0 255.0.0.0 host 10.51.3.32 eq 3389

  no nat

  access-list extended sheep allowed ip 10.0.0.0 255.0.0.0 10.51.3.32 host

  the only difference I see is the extended acl, but it works well in one direction?

  Thank you

  Hello

  Using port-based ACLs for crypto card is not recommended, use IP access lists and configure VPN filters to implement port restrictions.

  http://www.Cisco.com/c/en/us/support/docs/security/ASA-5500-x-series-NEX...

  Kind regards

  Averroès

• client vpn Cisco pix 501

  I wonder and wonder, is it possible for a branch (2 vpn clients) to connect to the central location (cisco 501 pix) at the same time via the vpn client with a public address on each side. If this is not the case, what will be the way to make it work without additional equipment (another pix of cisco).

  Yes you can, you should check your os 6.3 a pix and you enable nat-transapency: -.

  ISAKMP nat-traversal 20

• PIX of VPN to Pix does not allow navigation from one end.

  Hello

  We went an office of a router to connect to the internet (do Nat) our Pix VNP company. Now from this office, I can go through all our corporate network, but I can't browse them from our corporate network. I read a few cisco docs and I installed WINS, still no luck.

  Technicians from the isp for this office recommended disable Nat on this router (its doubly from). I have to change this Office Ip address external PIX and the default gateway to match any Ip subnet, they give me.

  This change will affect our current VPN IKE and IPSEC policies and connection to that office?

  Thank you

  Mario Cabrejo

  Network engineer

  You will need to use an external (visible ip internet) on the external interface of the PIX and disable the NAT on the router. You have to re-create the tunnels they will point to a new ip address and not the router.

  Hope this helps

  Richard

• site to site vpn with pix multiple tunnels

  Hello

  I have a vpn site-to-site between two PIX firewall tunnel.

  Is it possible to build on one side, another tunnel vpn site to site with the third PIX?

  Thank you

  Robert

  Robert

  You can use one card encryption on an interface, but you may have within your crypto card so your config sequence numbers

  The existing tunnel

  mykink1 card crypto ipsec isakmp 1

  correspondence address 1 card crypto mykink1 101

  mykink1 card crypto 1jeu peer 21.21.21.21

  mykink1 card crypto 1 set transform-set aesonly

  Your new tunnel

  mykink1 map ipsec-isakmp crypto 2

  card crypto mykink1 game 2 address "LCD number".

  mykink1 crypto map peer set 2 "new peer address.

  card crypto mykink1 2 the value transform-set "new transform set.

  card crypto mykink1 2 security association second life "number of seconds.

  You must complete the good values in the "" marks.

  Note that the sequence number is incremented by 1 in your first entry for 2 in the second entry.

  You can specify the duration of security association in the crypto map config that overrides the global settings.

  Add this config should not affect your existing tunnel.

  HTH

  Jon