PIX Firewall connect whit 2 remote site-to-site is possible?

[absantos]

I have 1 site whit PIX (520 model) and just 1 connection site-to-site works good.
But i'm tying configure other site to connect to this same PIX.
But is impossible until now.

Is this possible???
Is possible use PIX like VPN concentrator (IPSEC)
How made de crypto map tables??

I'm trying whit this under configuration(but not working):

nat (inside) 0 access-list 101 (ACL whit nonat addrees - range site 1 and range site 2)
nat (inside) 1 10.0.0.0 255.0.0.0 0 0

crypto ipsec transform-set TS2 esp-3des esp-md5-hmac

crypto map CLIENTE 10 ipsec-isakmp
crypto map CLIENTE 10 match address 81 (that is ACL address range site 1)
crypto map CLIENTE 10 set peer 80.x.x.2(valid address remote pix 1)
crypto map CLIENTE 10 set transform-set TS2

crypto map CLIENTE 11 ipsec-isakmp
crypto map CLIENTE 11 match address 82 (that is ACL address range site 2)
crypto map CLIENTE 11 set peer 66.x.x.2(valid address remote pix 2)
crypto map CLIENTE 11 set transform-set TS2

crypto map CLIENTE client configuration address initiate
isakmp enable internet

crypto map CLIENTE interface internet (this is outside)

isakmp key ******** address 80.x.x.2 netmask 255.255.255.255 no-config-mode
isakmp key ******** address 66.x.x.2 netmask 255.255.255.255 no-config-mode

isakmp identity address
isakmp policy 8 authentication pre-share
isakmp policy 8 encryption 3des
isakmp policy 8 hash md5
isakmp policy 8 group 2
isakmp policy 8 lifetime 28800

Please help me!!

Thanks!

Alexsander
Sao Paulo - Brazil

Alexsander Santos
Network Analist
Brazil

 

[yizhar]

HI.

> Is this possible???
Yes. Here are some samples:

http://www.cisco.com/pcgi-bin/Support/browse/psp_view.pl?p=Internetworking:IPSec

http://www.cisco.com/pcgi-bin/Support/browse/psp_view.pl?p=Hardware:PIX&s=Software_Configuration

Some troubleshooting tips:
* Use syslog messages.
* Remember that you need 2 for a tango (or VPN) - check remote devices and not only main office.
* Use ipsec debug commands:

http://www.cisco.com/warp/public/707/ipsec_debug.html

* Can each vpn peer ping the other?
* Check the mirrored access-list of interesting traffic and nat 0 on both sides.


Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar