5 points site-to-site vpn

[PaoloZ]

Hi, I'm an absolute newbie with PIX fw.
Unfortunately I've to solve a problem bigger than my knowledge, I'm still studying CISCO PIX, but an emergency ask me to provide a solution ASAP.
I need to connect via vpn 5 nets connected to the Internet.
Every site is provided with a Pix 506e.
There is a main site and 4 satellite offices.

How do I connect all 5 the LAN each other ? What are the key element of the configuration for each PIX ?

Could anyone provide me with a template of the configuration ?

Thanks

Paolo

 

[dx1]

Around the middle of the page are several samples on site to site VPN with PIX.

http://www.cisco.com/pcgi-bin/Support/browse/psp_view.pl?p=Hardware:PIX&viewall=true

 

[yizhar]

HI.

You can also use GUI tools to help you.
The current pix devices come with PDM that has VPN wizard which works fine.
You can also use my pixcript tool to generate sample configs:

http://teachers.sivan.co.il/yizhar#pixcript

A combination of Cisco samples to understand what is going on and a GUI tool to help you manage it, can be a good way to go.

You should ask yourself some questions regarding the VPN design:
* Will you have static fixed IP for each pix device?
* Do you need a "full mesh" or "Hub and Spoke", or what?
* Do you need bidirectional VPN or only branch offices will initiate connection to main office?
* What about bandwidth issues? Maybe you'll also need to install a terminal server at the main office?
* What about name resolution (DNS/WINS), and other OS issues related to WAN links?

You can choose between traditional IPSec site to site VPN, or the newer "Easy VPN" feature which is available with the pix.
I recommend the standard IPSec VPN which is very flexible, but the choice of "Easy VPN" can be easier to configure, and should be preffered if the branch offices will NOT have fixed ip address.

In general - the pix is a good choice for such implementation.
You might wish to put a pix515 at the main office for additional features like DMZ.

You'll find more pix related links here:

http://teachers.sivan.co.il/yizhar/files/pixlinks.htm

Good Luck.


Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar