non-contiguous public IP addresses 2

[Speaker]

We need to set up some static mappings through our PIX 515 so 10 clients can VPN to a third-party supplier. Unfortunately, we don't have enough public addresses available, so we've contacted our ISP to get some more. I've requested that they give us the next 16 numbers, then all I'd have to do is change the subnet mask and be good to go (correct?).

If they're not able to get continuous numbers, what issues do I face? I know this is a vague question, but maybe if I get some general ideas, then I can ask more specific questions.

TIA,
speaker

 

[ChrisAC]

If the next set of 16 IP addresses isn't available then you will have to look at changing the whole range! This isn't such a hugh task but does require some careful planning.

You (or your ISP) will have to reconfigure the router with the new addresses. You will have to change the firewall config and you will also have to make DNS changes. We usually do this sort of thing on a Friday afternoon. This gives a couple of days over the weekend for DNS to propagate before it's business as usual on the Monday morning.

Chris.
********************************
Chris Andrew, CCNA
Technical Support Engineer
********************************

 

[xlee]

This is simple.

On your internet router, make sure you have a route statement with your new address to the outside interface of the PIX. I have this setup with no problems.

 

[Russky]

Speaker,

Could you let me know if you had to go with a new range of addresses, or if Xlee`s suggestion worked?

I have exactly the same problem with my PIX and I`m unsure which way is best!

Cheers,

Russky

 

[Speaker]

I actually didn't need it.

We were trying to connect multiple VPN sessions from our PIX to another company's PIX. Each outbound VPN session required a unique public address. But we ended up building a Linux box with an app that would allow multiple VPNs to go out from the same public address, thus negating the need to purchase more.

Incidentally, that didn't work because Cisco told us that PIX wont allow multiple INbound VPN sessions from the same public address, either. What we ended up doing was connecting one machine--a Win2K Professional box--and using Internet Connection Sharing to share out the VPN tunnel, then setting that machine as the gateway for the others.

 

[yizhar]

HI.

Have you considered a site to site (pix to pix) VPN?

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[Speaker]

Re: site-to-site

We looked at it, but this is only a temporary solution, until the frame-relay line is installed in a few weeks. I believe the site-to-site required one of them there fancy concentrators that cost so much money.

 

[yizhar]

HI.

Pix To Pix VPN requires only (at both pixes):
Planning (which hosts will participate in the VPN).
DES activation key (which is free but need to be installed).
Configuration.

The configuration is not a big deal, you can follow cisco samples and/or use pixcript:

http://teachers.sivan.co.il/yizhar#pixcript

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar