Connecting to VPN throught the PIX

[bwoodley]

Ok, wasnt sure if this had already been discussed, but i'm having an issue...

We have a PIX 515, ver 6.2 OS

One of our remote customers has a VPN that we access with the Cisco VPN Dialer 3.6. Everything works fine if the employees use a dial up account and tell the vpn client to connect with it. why use a modem when you have T lines... so what happens when the people use the vpn over the PIX is this... if they communicate on a 1 to 1 basis with no PAT, and I create an access rule allowing all traffice from the vpn to come in then it works fine. But if i access it using the normal NAT (everyone coming out of one IP) then it will connect but not allow any traffice to pass through the connection. All they need is esentially a telnet session to run throught the VPN. Do I NEED to set up an outside accesable address for the people here? or can I get by with changing something in the PIX that wil allow the communication to work with the NAT/PAT? The only problem is that we have a small public pool and I have no way of sharing 1 ip address with 10+ people who use the clients VPN. Modem line bills are starting to be a problem.

Thanks for any help in advance!

 

[yizhar]

HI.

I understand that the VPN server is at the remote side, managed by the "remote customer".
> We have a PIX 515, ver 6.2 OS
I understand that this pix as at your side, and is not the VPN server in question, right?
What VPN device is used as the VPN server? Is it a pix? What OS version?

You have several possible solutions - here are some:

* You can ask the remote client to create an access-list which will allow SSH from your network to a host at their side. This can also be done with Telnet but then there is no encryption.

* If the VPN server is a pix, ask the remote customer to upgrade it to version 6.3 which supports "NAT traversal":

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/63rnotes/pixrn63.htm

* You can configure a single host at your site with VPN client, to act as a proxy/nat/terminal server, so it will connect to the VPN on behalf of the other clients.

* You can purchase a Cisco 3002 VPN hardware client to act as proxy for VPN connections. A pix501 with "Easy VPN" can also do this.

There are other possible variations and solutions...



Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[bwoodley]

What would be the easiest way to setup the relay for the one vpn client for all to access?

 

[fdavari]

use the following config segment. We are using it and it works.

conduit permit udp host <internal-station-ip> any eq isakmp
conduit permit esp host <internal-station-ip> any
conduit permit gre host <internal-station-ip> any

 

[harryhcl]

Sounds like you should configure NAT-T (nat traversal) this should be set up on the client and the concentrator. NAT-T wraps up all the ipsec in a TCP or UDP wrapper so you can use pat. It depends on what you are terminating the clients on (and the software version)