PPTP to 2 different LANs using VPDN groups

[heyburt]

Hi

We run a shared PIX firewall for two customers and we require remote users for both customers to VPN to their respective LAN's after 1. authentiating against a RADIUS server and 2. receiving an IP address from the respective group/company's pool. My question is how will the PIX know which VPDN group to use if all remote users come in on the Outside interface, i.e. how will it differentiate or it this at all possible? Also, we are trying to do this using PPTP and not IPsec. Any info on these topics would be much appreciated. Can't find much on the subject at the moment.

Cheers.

 

[themut]

You define the pool with the command: ip local pool <pool-name> <start-of-pool>-<end-of-pool>

Then you define your groups with the vpdn commands and specify which pool to use: vpdn group <group-name> client configuration address local <pool-name>

You need to configure all the vpdn commands.

 

[heyburt]

I already have the groups configured with different pools and auth servers, but how do you configure the PPTP client (eg Win2K) so that it uses the preferred vpdn group?

 

[themut]

I don't think that can be done. Here's the link to configure pptp on a widows box:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnras/html/instpptp.asp

 

[pdk68]

You need to different groups of people to authenticate on one PIX and then each group needs to have access to there respective network correct?

If this is correct you can assign a seperate IP pool to each group then use and access list to limit each pool to only access there respective network.

Hope this helps.

 

[yizhar]

HI.

I would use static to map a registered ip address to the internal MS server of each client, then permit PPTP and GRE to each server, and handle VPN at each customer server and not at the pix.

In that way you get 2 things:
1) Eliminate the problem of managing complex 2 VPN scenario at the pix.
2) Let each network manage its own VPN.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[heyburt]

To clarify the problem:

- Two seperate groups of users require access to different resources behind the PIX.
- The two groups need to have different IP Pools (so they can be restricted to specifed services using access-list) and they need to be authenticated using different servers (ie 2 seperate Radius servers).

This can be done on the PIX using vpdn groups - configure 2 groups, each with a differnet authentication server and IP Pool.
Configuring the PPTP client is easy, but how do you specify which group the client will use when the connection is iniated, ie how does the PIX which group to assign to the client?