routing between vpn segments

[mmkcia]

hi all

i have 3 cisco pix firewall 506e configuered as the following

A------vpn------B------vpn------C

this means a connect b with ipsec tunnel and b connect c with ipsec tunnel but there is no link between A&C
1- is there is a way to route between them using B site
not ordinary route (vpn tunnel)
2- is there is some special pix meshing the all peers connecting to it

thanks ,

momustafa m. kaid
ccna
commuim group
iraq

 

[Supergrrover]

You would need to have a vpn from A to C to have that happen with the 506s.
With pix OS7 you can have a hub and spoke topology for the VPN where branches connect to each other through the central ASA/PIX. You would need an ASA or a pix 515e or higher as the hub to accomplish that.

http://www.cisco.com/en/US/products...s_configuration_example09186a00804675ac.shtml

Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[mmkcia]

thanks mr brent for answering me
actully i got 18 peer 506e and they r full meshed each pix have vpn tunnel with other 17 but it take 80 % of memory so i am afraid to slow down the traffic if any more peers added
and u know 506e allow me max 25 peer so i need 515 hub and spoke configuration and if u can tell me more about hub and spoke.

thanks alot

moustafa m kaid
ccna
commium group
iraq

 

[Supergrrover]

That link pretty much tells you everything you need to know. You might want to up it to an ASA5520 instead of a 515 for that many concurrent tunnels if they are passing a lot of traffic.


Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[mmkcia]

yes thanks i think about 5510 or 5520 thanks alot

 

[mmkcia]

yes but i need an example if you have to the config
i dont know the site is not opened




regards,

 

[mmkcia]

is pix 5510 work on IOS7 (i mean did it support) hub and spoke



Regards,


moustafa m kaid
ccna
commium group
iraq

 

[Supergrrover]

Yes, The ASA devices are the replacements for the PIX appliances. They all run on OS7x code. The old pix 515 and up can be upgraded to that os but do not benefit from the better hardware.


Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[Supergrrover]

Try this link to the PDF version. Posting the config examples here would be too long.

http://www.cisco.com/warp/public/110/enhance-vpn-pix70.pdf

Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[mmkcia]

ok thanks