Pix to Pix VPN understanding

[Fritjof]

Hi!

I have some problems understanding side to side vpn.

Location A is an standard office network. 50 user behinde e pix 515e (newest ios, newest pdm). User connect to the internet via PAT. User log in from remote via pptp-vpn. The pix is the vpn-server and authenticates the users on an active directory radius server in the inside network. Works like a charm.

Location B is a new office that we build up in Austria. There we have a DSL-Connection to the internet with on fixed IP-Numer. I use a pix 506e (same ios, same pdm)to connect the users to the internet (PAT). Works great.

Now I need to connect both offices via pix to pix vpn. Thats when my problems start. I configured both pix with the pdm (shame on me, but I like this tool <g>). After finishing the wizard on both sides I have an ipsec-vpn tunnel up and running (says the monitoring tool in the pdm). The problem is that I can't connect anywhere. In my understanding this vpn tunnel should work like a standard vpn connection that i get when I use my vpn client on my notebook and connect to location A. That means it should behave like I'm in the office, just a little bit slower. What am I doing wrong ?

1) In the vpn wizard traffic selector section on local site(protected by this pix) I use the inside network of location A (192.168.100.0/24)on the inside interface. On the next page I use the inside network of location B (10.49.10.0/24) on the outside interface. On the other pix in location B in configured it the other way round. The pdm than can not find 10.49.10.0 255.255.255.0 on the interface outside and ask me to ad this host or network. Do I need to do this?

2) After finishing the wizard on both sites the VPN-Connection is established. Anyway I can't connect anywhere. Do I have to add some additional routing entries ? Or is the wizard all I have to do ? What about access lists ? I have checked to bypass access check for IPSec and L2TP traffic, so I have not configured any access list for the VPN-Tunnel. Ist this correct ?

3) The network configuration on the clients is very simple. It comes from the dhcp and has the pix as only gateway. Is this ok ?

4)What about this easy vpn remote feature ? Easy sounds good to me . I have a working VPN-Server (the pix) in location A. Can I connect the pix in location B with easy vpn ? Do I use the client mode or the network extension mode ? What does that mean for my network configuration ?

So this are a lot of questions I think. Maybe you can help me in some points. I'm glad for any help. Thank you!

best regards from Hamburg/Germany

Fritjof

 

[EddieVenus]

First, may I suggest that you use the CLI to set up VPN tunnels. Not that you cannot do it via the PDM, just that it seems actually more difficult than it needs to be when using the PDM.

With that said, make sure that your pixA and pixB internal LAN addresses are on different subnets. If they are both using 192.168.100.x then you will have problems. If that is the case you can get around it, but you will have alot more work to do. If they are using differnt subnets, then the next step is to check the tunnel status.

If you insist on using the PDM, then use the command line feature of the PDM and type in &quot;show ipsec sa&quot;. If you get a response that shows nothing, they you did not set things up right and no tunnels are being made. If you get a response and it shows stuff about the tunnel settings they you set things up properly (for that site at least, not neccisarily for both sites). If you see that there is an inbound SA and that there are packets enctypted and decrypted then the tunnel is up for real and you then have most likely a routing issue preventing connections to the other end.

Your best bet for a resolution is calling Cisco TAC. Next best thing is to post your &quot;show run&quot; output here, taking note to remove any passwords or other sensitive information. Lastly the next best thing is delete your current VPN setting relating to the pixA to pixB tunnel and start over, following the guidlines on the Cisco web site for setting up the tunnel, preferably in CLI mode.

If you can post the &quot;show run&quot; please do. Please include as much of the config as possible, but at the bare minimum we need to see the inside address the access-list pertaining to the pixA to pixB tunnel, and the commands at the end of the file beginning with lines that begin with &quot;crypto&quot; and ending with the lines that begin with &quot;isakmp&quot;. Do not omit any of these lines when posting or else we may not see the whole picture. This pertains to both PIX devices, so we would need to see 2 sets of outputs, pixA's and pixB's in order to see what if anything is wrong.

Finally, you can use easy VPN, but why would you want to when you could do a real VPN just as easily.

Eddie Venus

&quot;Cap'n says I'm dumb as carp. Want to see how a harrem girl dances?&quot; - Kenny the Cabin Boy