Pix515 VPN

[chadw]

I have never setup a VPN. I have Terminal Services setup for one remote employee. I was wondering if a VPN will better serve the company. I have heard that VPN are very slow. I have a pix515 and I didn't know what ports to open and if it was hard to establish a connection on the server side. What is all involved? What are the Pros and Cons of a VPN?

Can anyone help me out here?

Thank you,

Chad

 

[ixleplix]

A VPN adds extra security and as such is always a good idea. Also, you can use Terminal Services or Remote Desktop over the VPN & this (if you have high-speed internet) is almost as fast as working at the machine locally.

You would want to use the CISCO 4.0.1 client (you can download this from CISCO), add the following commmands to the PIX and follow the directions to set up the client.

These are examples and you can change the numbers to suit your network

access-list 100 permit ip 10.40.0.0 255.255.0.0 10.40.20.0 255.255.255.0

ip local pool ippool 10.40.20.1-10.40.20.50

nat (inside) 0 access-list 100

access-group 100 in interface outside

sysopt connection permit-ipsec
crypto ipsec transform-set myset esp-3des esp-md5-hmac
crypto dynamic-map dynmap 90 set transform-set myset
crypto map newmap 90 ipsec-isakmp dynamic dynmap
crypto map newmap interface outside

isakmp enable outside
isakmp identity address
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400

vpngroup groupname idle-time 1800
vpngroup address-pool idle-time 1800
vpngroup groupname address-pool ippool
vpngroup groupname dns-server 10.40.x.x
vpngroup groupname wins-server 10.40.x.x
vpngroup groupname default-domain your.domain.name
vpngroup groupname idle-time 1800
vpngroup groupname password ********

 

[tdoma]

Will the above config work in an environment wirh PAT, instead of NAT? Would it also work with the Cisco client 3.6.6?

Thank U.

 

[themut]

Yes it will work with 3.6 vpn client. Also you are not natting the traffic since you are bypassing NAT with the nat (inside) 0 access-list ... command, so PAT shold not be an issue.