PIX to Router

[kaneranch]

I have a situation whereby i need to setup a vpn tunnel from a pix 501 to a 1760 router - the problem is that the isp provider at the remote ( pix ) end cannot give me a fixed ip ( outside )address.Is it possible to setup a tunnel without a fixed outside ip address??

 

[mtashiro]

There is a way to do this with IOS boxes but not sure you can do this with a PIX and a router. I will try to test this in m LAB.

 

[havanajoe]

Does the end with the 1750 have a fixed IP? If so, have it be the originator and have the PIX end just respond to the tunnel request.

 

[mtashiro]

One of the endpoints should be static. Here is a link for PIX to router dynamic IPSec connection. In this example the PIX has the static but there is no reason that you shouldn't be able to reverse the config.

http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a0080094a87.shtml

 

[mtashiro]

Here is a router to router link as well.

http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a0080093f86.shtml

 

[kaneranch]

Thanks all for the responses.Firstly the 1760 router has the static ip, so i need to setup the pix without the static.Looking at the document link (mtashiro)i see that both the pix and the router have ip addresses assigned - am i missing something??
On my pix501 i have set "ip address outside dhcp" is this correct??

 

[yizhar]

HI.

If both the pix and router OS versions supports the new "Easy VPN" feature, you can use it.
The router will be configured for VPN access (similar configuration to remote access) and the pix will be configured as "Easy VPN" client (similar to software VPN client 3.x).

Search Cisco web site for Easy VPN.
Start here:

http://www.cisco.com/pcgi-bin/Support/browse/psp_view.pl?p=Internetworking:IPSec

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar