Cisco 801 to Pix506

[youngneil]

I have a 801 ISDN router that dials the ISP (dynamic) that I want to connect to a Pix 506 by creating a VPN tunnel. I have set up several tunnels to the 506 already, but with 501's with static addresses.

Does anyone have config examples of this scenario? I was wondering if I could just use DES and pre-shared key and configure the 506 like the 801 is a simple Cisco VPN Client?

Please help!

 

[dopehead]

You can find them on

http://www.cisco.com,

the feature i think you are looking for is easy vpn client in network extension mode. Also you could use it in client mode, which will make the 801 look like a regular vpn client : i.e ip address assigned for PAT, so no backwards traffic from your lan.
Also the pix needs to have vpngroup configuration and the IOS needs to be quite new.

Jan

 

[youngneil]

Client mode, exactly. I want to make it very simple. The IOS is v12.3(1a) by the way (Pix 6.3(1)).

But then I need to put the router in a VPN group (like a Cisco VPN Client). Is that possible?

 

[dshinde]

Hi!!

It just that you need to follow the link and you can understand the command sets.

http://www.cisco.com/warp/customer/110/pixpixvpn.html

http://www.cisco.com/cgi-bin/Suppor...ementation_and_Configuration#Samples_and_Tips

Let me know if you have any queries and how it goes.

Have a great day.

 

[dopehead]

It is possible, but the config in dshinde's note is for a pix-to-pix lan-to-lan with clients.

You need to run the router as a regular Easy VPN Client, and yes the router needs to know the group and password of your vpngroup, you would prolly make one just for the router. In network extension mode the pix will automatically learn the ip net behind your router, and route the encrypted traffic to it. You can try to look at this example :

---------801 Router ----------------------------------
crypto ipsec client ezvpn VPN
group <groupname> key <key>
mode network-extension
peer <pix ip adr outside>
interface e0 (outside interface on your router)
crypto ipsec client ezvpn VPN

http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122newft/122t/122t13/ftezvpcm.htm

 

[youngneil]

I am obviously on thin ice here, but I GOT to make this work. I am puzzled by especially one line here:

crypto ipsec client ezvpn VPN

It looks very &quot;non-IOS&quot;, and in any case the 801 really don't like &quot;client&quot; very much... Am I missing something very obvious here?

 

[dopehead]

I think you need a &quot;T&quot; release for this to work, and probably a rather new one.

Jan

 

[youngneil]

Aha! OK, I'll get a new (&quot;T&quot IOS tomorrow and see if I'll get this to work. Would be fab if I could set up ISDN routers this way and configure the Pix as it's a regular Cisco VPN Client.

Thanx!

 

[youngneil]

I got the IOS ver. 12.2(15)T7 and still can't get the router to accept &quot;crypto ipsec client ezvpn VPN&quot; or &quot;group <groupname> key <key>&quot; in global or interface mode. Is the IOS still not correct? It's getting a bit frustrating this...

Is this version (T7) not a &quot;real&quot; &quot;T&quot; release? Please help!