Pix VPN multiple networks

[Guest_imported]

Peeps

Pls can you answer a ? for me. I've installed a Pix and have it connecting to our firewall at another office via vpn. This seems to working nicely. However, there is another network connected at the vpn site which I cannot connect to across the vpn. Any ideas as I have been playing around with access-list and also adding route's.

 

[yizhar]

HI.

You will need to provide much more details to get better answers.

The are probably needed configurations thet should be applied to your local pix, the remote fw, and maybe at the remote internal router as well.

At the pix you should add the in-accessible subnet to the access-list that defines the traffic that should be VPNed, and to the access-list used for NAT 0 if it is a different ACL .

At the remote firewall (is it another pix??) you need to also check access-lists.

At the remote internal router you probably do not need modifications, but this should be verified agains its routing configuration.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[Guest_imported]

Yizhar

Thanks for the input. Sorry I didn't leave more information.
At the moment, We have a Pix connecting to a Watchguard Firebox via vpn. The vpn is working fine as we can see each others networks. However, like I say we have another network connected at the firebox side. Lets say the private IP of the network we cannot see from the pix is 192.168.4.0/24. I've added some access lists as followed.
access-list 101 permit 192.168.4.0 255.255.255.0 10.11.0.0 255.255
access-list 101 permit 10.11.0.0 255.255.0.0 192.168.4.0 255.255.255.0
Is this correct???
What do I have to do now? You say I have to add a NAT.
This is the NAT I have in place.
NAT inside 0 access-list 101

Is this correct??

Thanks in advance!!

 

[yizhar]

HI.

I will assume the following network

10.11.0.0/24 subnet
pix
internet
firebox
192.168.1.0/24
router
192.168.4.0/24

In that case, here is partial config of the pix,
BUT THE FIREBOX CONFIGURATION MUST ALSO BE CHECKED!

access-list 101 permit ip 10.11.0.0 255.255.0.0 192.168.1.0 255.255.255.0
access-list 101 permit ip 10.11.0.0 255.255.0.0 192.168.4.0 255.255.255.0
nat 0 access-list 101
crypto map mymap XXX match address 101

There is no need for the reverse access-list if you are using "sysopt connection permit ipsec".
If you are not using this command, then you need to adjust the access-list that is bound to the pix outside interface.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[Iota]

Peeps, It cannot be done.

The Pix is not a router and by the nature of IPSEC, it can only respond to the packet. I actually tried allowing a VPN Client to VPN into the PIX for the purposes of accessing another network that was attatched to the pix via a VPN. I could not get it to work so I opened up a case with TAC. The person I spoke with said it could not be done--at least with the pix.

You need to nail up a direct connection between your site and the remote site. In essence, creating a triangle VPN topology.

Iota

 

[Guest_imported]

OK

V confused.

Lets start again
pix> 10.11.0.0/16
|
VPN
|
Firebox 192.168.1.0/24
|
Leased line with router
|
192.168.4.0/24

From the pix I cannot see the 192.168.4.0 network and cannot see it backwards either.
I understand the pix isn't a router, what should be my next step to getting the 10.11.0.0 and the 192.168.4.0 to see each other??

Yizhar is this possible with the instructions you gave me?

Iota how do u mean a triangle vpn. Do you mean create a tunnel for the 192.168.4.0 traffic also??



The Inspector

 

[yizhar]

HI.

I don't know if it will work or not, but please read this again:
BUT THE FIREBOX CONFIGURATION MUST ALSO BE CHECKED!

So you'll have to work hand to hand with the FireBox administrator if its not you.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[ChrisAC]

Yizhar is right, as usual! You have to look at the config on the other firewall.

Just to raise a point regarding Iota, there should be nothing stoping you from seeing the 192.168 from the VPN connection if the correct routes are set up. When you log into a network via VPN you become, in effect a local user. Firewall are not routers but static routes can be added to point them in the right direction. ie. the next hop router or firewall. To see the 192.168 network from the VPN the Firebox need to know where the 192.168 is!

Good luck with this!

Chris.
************************
Chris Andrew, CCNA
chrisac@gmx.co.uk
************************

 

[yizhar]

HI.

And to be more specific, the FireBox needs to be configured to send traffic from 192.168.4.0 to 10.11.0.0 via the VPN tunnel to the pix.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar