VPN between 5 Pix501

[ebusdk]

Hi
Im trying to set up the following:

http://sparmere.dk/cisco/cisco.gif

All the local sites should be able to se the Mainsite "bsn-sverige" and all the other local networks.
I cant get the pix's to work.
If any of you have a running config of the mentioned, please show it to me so I can learn a little

 

[dopehead]

Basically what you need is fully meshed, and your will need 5 tunnels from each pix to the other 5 pix'es since you cannot relay the traffic through the swedish main site with a pix.

If you have one tunnel running the other tunnels should be pretty simple to replicate.

Jan


Network Systems Engineer
CCNA/CQS/CCSP/Infosec

 

[ebusdk]

Do you have a sampel of that?

The current LAN is like this:

Sweden:
IP : 192.168.1.1-255
SN : 255.255.0.0
GW : 192.168.1.254

Denmark:
IP : 192.168.2.1-255
SN : 255.255.0.0
GW : 192.168.2.254

Dont i have to change the Subnet mask to 255.255.255.0 when i make all the tunnels?

 

[ebusdk]

Do you have a sampel of that?

The current LAN is like this:

Sweden:
IP : 192.168.1.1-255
SN : 255.255.0.0
GW : 192.168.1.254

Denmark:
IP : 192.168.2.1-255
SN : 255.255.0.0
GW : 192.168.2.254

Dont i have to change the Subnet mask to 255.255.255.0 when i make all the tunnels?

 

[dopehead]

The pc's will be a problem as they will believe that they are part of 192.168.0.0/16 and as such will never forward traffic to their default gateway as they would think that the destination 192.168.2.x is part of their own lan.

you would need to nat the entire danish/swedish lan before encrypting which is not a pretty thing.

http://www.cisco.com

is full of examples on lan-to-lan tunneling on the pix, try searching.

Jan


Network Systems Engineer
CCNA/CQS/CCSP/Infosec

 

[ebusdk]

wouldent it be better to change the lan subnet to 255.255.255.0? I mean, if i change the lan like this:

Sweden:
IP : 192.168.1.1-255
SN : 255.255.255.0
GW : 192.168.1.254 (router lan)

Denmark:
IP : 192.168.2.1-255
SN : 255.255.255.0
GW : 192.168.2.254 (router lan)

Regards Kristoffer

 

[computerhighguy]

That is kindup to you. If that new IP structure will work for you then, by all means, go for it.


It is what it is!!
__________________________________
A+, Net+, I-Net+, Certified Web Master, MCP, MCSA, MCSE, CCNA, CCDA, and few others (I got bored one day)

 

[dopehead]

Ya, but then you would have to change the setup on the pc's as well.


Network Systems Engineer
CCNA/CQS/CCSP/Infosec

 

[ebusdk]

the PC's is not a problem (Running DHCP) the servers will take 3 minutes to change with a VBS script in a policy. The Printes on the other hand will take forever :-(

 

[dopehead]

Well, yes then your own solution would be best.
Jan


Network Systems Engineer
CCNA/CQS/CCSP/Infosec