How to configure PIX 515E for VPN access with IPSEC? : C, Cisco Pix, Pix 515e

May 17, 2008 01:34am pdt

1. batry_boy 55,660
2. lrmoore 22,725
3. arnold 12,000
4. RobWill 11,200
5. mkielar 10,500
6. dpk_wal 8,625
7. ebjers 8,130
8. SteveH_UK 8,000
9. mwecompu... 7,985
10. trinak96 7,865
11. MrHusy 7,000
12. Cyclops3590 6,900
13. PeteLong 5,975
14. Voltz-dk 5,920
15. keith_al... 4,700

1. lrmoore 282,067
2. RobWill 166,424
3. richrumble 111,037
4. batry_boy 102,035
5. rsivanandan 47,017
6. ahoffmann 44,523
7. grblades 35,012
8. pseudocyber 34,059
9. Cyclops3590 31,775
10. tim_holman 27,445
11. kbbcnet 26,524
12. arnold 25,260
13. Tolomir 23,651
14. sciwriter 23,050
15. keith_al... 22,600

02.24.2008 at 12:44AM PST, ID: 23188193

	[x] Attachment Details

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

8.7

How to configure PIX 515E for VPN access with IPSEC?

Zones: IPSec Security Protocol, Virtual Private Networking (VPN), Cisco PIX Firewall

Tags: C, Cisco Pix, Pix 515e

I have Cisco PIX 515E and it is my users can log from outside through microsoft VPN to my PIX but I need to creat other VPN on it from other company with IPSEC

please advice this can be? if so then how?

thanks
Mostafa

Start your free trial to view this solution

Question Stats

Zone: Networking

Question Asked By: Mostafa_ElSadek

Solution Provided By: Cyclops3590

Participating Experts: 2

Solution Grade: A

Translate:

Loading Advertisement...

Microsoft

Internet Protocols
Applications

Development
OS

Hardware
Windows Security

Apple

Operating Systems
Hardware

Programming
Networking

Software

Internet

Search Engines
File Sharing
WebTrends / Stats
Spy / Ad Blockers

Web Browsers
New Net Users
Web Development
Chat / IM

Anti Spam
Web Servers
Anti-Virus
Email Clients

Gamers

Tips
Online / MMORPG
Puzzle
Emulators

Action / Adventure
Role Playing
Consoles
Game Programming

Strategy
Sports
Misc
Computer Games

Digital Living

Hardware
New Net Users
New Users

Software
Digital Music
Gaming World

Home Security
Apple
Networking Hardware

Virus & Spyware

Vulnerabilities
IDS
Encryption
Anti-Virus

Operating Systems Security
Software Firewalls
WebApplications
Cell Phones

Operating Systems
Internet
Hardware Firewalls

Hardware

Handhelds / PDAs
Displays / Monitors
Components
Networking Hardware

Peripherals
Laptops/Notebooks
Storage
Servers

Desktops
New Users
Misc
Apple

Software

System Utilities
Industry Specific
Network Management
Photos / Graphics
Page Layout
VMWare
Misc
Web Development

OS
CYGWIN
Voice Recognition
Message Queue
Quality Assurance
Security
Firewalls
MultiMedia Applications

Development
Database
Office / Productivity
Business Management
OS/2 Apps
Server Software
Internet / Email

ITPro

OS
Storage
Encryption
Operating Systems Security
Apple Hardware
Laptops & Notebooks
Servers
Networking Hardware
Peripherals

Devices
Displays / Monitors
WebTrends / Stats
Search Engines
Firewalls
WebApplications
IDS
Vulnerabilities
Email Clients

File Sharing
Spy / Ad Blockers
Web Browsers
Web Servers
Networking
Anti-Virus
Chat / IM
Anti Spam

Developer

Web Servers
Web Browsers
Game Programming
Dev Tools
Industry Specific
Office / Productivity

Database
CYGWIN
Web Development
Search Engines
File Sharing
WebTrends / Stats

Programming
Content Management
Application Servers
Protocols

Storage

Removable Backup Media
Storage Technology
Servers

Grid
Remote Access
Backup / Restore

Misc
Hard Drives

Miscellaneous
Security
Development
Linux
VMWare

MainFrame OS
Unix
Apple
OS / 2
AS / 400

BeOS
Microsoft
VMS / OpenVMS

Database

Oracle
Miscellaneous
MySQL
Software
Sybase
Contact Management
PostgreSQL
Data Manipulation
Clarion
InterSystems Cache

Siebel
MUMPS
OLAP
SQLBase
SAS
GIS & GPS
4GL
Berkeley DB
DB2
Informix

Interbase / Firebird
FoxPro
Reporting
LDAP
Filemaker Pro
MS SQL Server
dBase
MS Access

Security

Misc
Web Browsers
Software Firewalls
Operating Systems Security
File Sharing

Spy / Ad Blockers
Vulnerabilities
WebApplications
IDS
Anti-Virus

Encryption
Anti Spam
Email Clients
VPN
Chat / IM

Programming

Editors IDEs
Installation
Handhelds / PDAs
Multimedia Programming
System / Kernel

Algorithms
Game
Signal Processing
Project Management
Open Source

Database
Misc
Languages
Processor Platforms
Theory

Web Development

Scripting
Blogs
Web Servers
Software
Search Engines
Web Graphics
Images

Internet Marketing
Images and Photos
Components
Document Imaging
Web Languages/Standards
Illustration
WebApplications

Fonts
WebTrends / Stats
Authoring
Digital Camera Software
Miscellaneous

Networking

Protocols
Apple Networking
Network Management
Message Queue
Application Servers
Content Management
File Servers
Email Servers
Misc
Java Editors & IDEs

Wireless
Networking Hardware
Backup / Restore
System Utilities
ISPs & Hosting
Web Servers
Storage Technology
Removable Backup Media
Servers
Broadband

Grid
OS / 2
Novell Netware
Unix Networking
Windows Networking
Security
Telecommunications
Operating Systems
Linux Networking

Other

Community Advisor
Lounge
Community Support
New Net Users

Philosophy / Religion
Math / Science
Miscellaneous
URLs

Expert Lounge
Politics
Puzzles / Riddles

Community Support

Suggestions
New to EE
New Topics
Community Advisor

CleanUp
Announcements
General

Feedback
Input
EE Bugs

02.24.2008 at 06:36PM PST, ID: 20972543

Rank: Guru

Cyclops3590:

few questions first,

from other company; a site-to-site or vpngroup/tunnel-group for their users?
what version OS do you have on your 515E?
is the microsoft VPN behind the pix? if so, PPTP or L2TP/IPSec? Is there reason we can't use PIX VPN instead of MS VPN?

02.24.2008 at 10:50PM PST, ID: 20973322

Mostafa_ElSadek:

from other company (a site-to-site)
Cisco PIX Firewall Version 6.3(4)
Cisco PIX Device Manager Version 3.0(2)
I'm using PIX VPN for my users now but the users uses Microsoft VPN to connect.

but I want to creat other VPN Tunnel over IPSEC to let the other company connect to me.

thanks
Mostafa

02.25.2008 at 05:48AM PST, ID: 20975116

Rank: Guru

Cyclops3590:

Can you explain this part
>>I'm using PIX VPN for my users now but the users uses Microsoft VPN to connect.
So are you using PIX IPSec VPN or MS RRAS VPN? or are you using PIX IPSec VPN with MS IAS RADIUS authentication?

also please post your PIX config (sanitized of course) and then I can plug in the holes as to what acl and vpngroup modifications need to take place.

If the users are using a Cisco VPN client to VPN, then this is a very common config you are looking for and will be easy to setup, just need to a couple things about your current config so we make sure the priorities are correct. If the users are using Windows VPN to an RRAS server, then it may require a bit of work.

02.25.2008 at 10:16PM PST, ID: 20982014

Mostafa_ElSadek:

this is my pix config:

Password:
Type help or '?' for a list of available commands.
EM-PIX-Firewall> en
Password: **********
EM-PIX-Firewall# sh run
: Saved
:
PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password Y9e48NMLHPYSCSaa encrypted
passwd Y9e48NMLHPYSCSaa encrypted
hostname EM-PIX-Firewall
domain-name emaratmisr.local
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list 102 permit tcp any host 217.52.XX.XX eq smtp
access-list 102 permit tcp any host 217.52.XX.XX eq pop3
access-list 102 permit tcp any host 217.52.XX.XX eq pptp
access-list 102 permit tcp any host 217.52.XX.XX eq ftp
access-list 102 permit tcp any host 217.52.XX.XX eq https
access-list 102 permit tcp any host 217.52.XX.XX eq 500
access-list 102 permit tcp any host 217.52.X.XX eq 4500
access-list 102 permit tcp any host 217.52.XX.XX eq www
access-list 102 permit tcp any host 217.52.XX.XX eq 4125
access-list 102 permit tcp any host 217.52.XX.XX eq 444
access-list 101 permit ip 192.168.0.0 255.255.255.0 192.168.1.0 255.255.255.0
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 217.52.XX.XX 255.255.255.240
ip address inside 192.168.0.2 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool pptp-pool 192.168.1.1-192.168.1.30
pdm history enable
arp timeout 14400
global (outside) 1 217.52.XX.XX
nat (inside) 0 access-list 101
nat (inside) 1 192.168.0.0 255.255.255.128 0 0
static (inside,outside) 217.52.XX.XX 192.168.0.3 netmask 255.255.255.255 0 0
access-group 102 in interface outside
route outside 0.0.0.0 0.0.0.0 217.52.XX.XX 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 192.168.0.1 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-pptp
telnet 192.168.0.1 255.255.255.255 inside
telnet 192.168.0.3 255.255.255.255 inside
telnet 192.168.0.105 255.255.255.255 inside
telnet timeout 5
ssh timeout 5
console timeout 0
vpdn group 1 accept dialin pptp
vpdn group 1 ppp authentication pap
vpdn group 1 ppp authentication chap
vpdn group 1 ppp authentication mschap
vpdn group 1 ppp encryption mppe 128
vpdn group 1 client configuration address local pptp-pool
vpdn group 1 pptp echo 60
vpdn group 1 client authentication local
vpdn username mostafa password ******
vpdn username Egypt_It password ******
vpdn enable outside
terminal width 80
Cryptochecksum:680321a9486ae710be99ccd665c56e42
: end
EM-PIX-Firewall#

02.25.2008 at 11:00PM PST, ID: 20982150

Mostafa_ElSadek:

this config lets my users connects through normal VPN but I need to add other tunnel to let other company connects as will be PIX-to-PIX over IPSEC

thanks

02.26.2008 at 05:15AM PST, ID: 20983909

Rank: Guru

Cyclops3590:

ok, here ya go. looks like it should be reasonably easy

access-list 101 permit ip 192.168.0.0 255.255.255.0 <other site subnet> <other site mask>
access-list <site>-vpn permit ip 192.168.0.0 255.255.255.0 <other site subnet> <other site mask>
sysopt connection permit-ipsec
isakmp enable outside
isakmp policy 10 authentication pre-share
isakmp policy 10 encrypt 3des
isakmp policy 10 hash sha
isakmp key <secret key> address <other site vpn device> netmask 255.255.255.255
crypto ipsec transform-set esp-3des-sha esp-sha-hmac
crypto map outsidemap 20 ipsec-isakmp
crypto map outsidemap 20 match address <site>-vpn
crypto map outsidemap 20 set peer <other site vpn device>
crypto map outsidemap 20 set transform-set esp-3des-sha

Paramaters
---------------------------------
other site subnet - the IP subnet scheme at the other site
other site mask - the IP subnet mask for the other site
site - the name of the other other site you will use
secret key - the pre-shared key agreed upon to create the tunnel
other site vpn device - the IP of the VPN terminating device at the other site

Keep in mind the other site must configure the same thing. The only real different is the IP subnets in the acl's are reversed and the peer used is your vpn device of course

02.29.2008 at 12:09AM PST, ID: 21011698

Mostafa_ElSadek:

they sent me this parameters to configure at my site :
IKE/ISAKMP Parameter

Key Management pre-shared key
Encryption algorithm 3DES
Dieffie-Hellmann Group group 2
Hash algorithm SHA
Key lifetime 86400 sec
IPSec Parameter Technical description
Key exchange IKE/ISAKMP
Protocol for encryption ESP
PFS (Perfect Forward Secrecy) no
PFS group no
Transform-set ESP-3DES , esp-sha-hmac
Data Integrity SHA
Encryption algorithm 3DES
Security-association Lifetime 3600 sec
Shared Secret XXXXXXXX

the other site Puplic IP is 196.219.XX.XX
the other site subnet is 10.82.9.0/25

please advice

thanks

Mostafa

03.24.2008 at 03:24AM PDT, ID: 21192668

Mostafa_ElSadek:

I resend a data and asked who can help me sorting this data with the solution but no one helped me.
thanks
Mostafa

03.24.2008 at 04:57AM PDT, ID: 21192962

Rank: Guru

Cyclops3590:

sorry I didn't respond to your last comment, I thought my last comment covered the exact commands you needed and your's was just for information purposes since you didn't respond to the commands I told you to run. after filling in the information you posted in the commands and running those, it still didn't work I take it?

03.26.2008 at 01:13AM PDT, ID: 21209645

Mostafa_ElSadek:

The other Company gave me those information before (parameters) to configure my pix for the VPN that why I sent it to you askin for help if you can apply them to my VPN config.

thanks
Mostafa

03.26.2008 at 05:22AM PDT, ID: 21210796

Rank: Guru

Cyclops3590:

ok, you just need to fill in what you X'ed out then.

access-list 101 permit ip 192.168.0.0 255.255.255.0 10.82.9.0 255.255.255.128
access-list l2l-vpn permit ip 192.168.0.0 255.255.255.0 10.82.9.0 255.255.255.128
sysopt connection permit-ipsec
isakmp enable outside
isakmp policy 10 authentication pre-share
isakmp policy 10 encrypt 3des
isakmp policy 10 hash sha
isakmp key XXXXXXXX address 196.219.XX.XX netmask 255.255.255.255
crypto ipsec transform-set esp-3des-sha esp-sha-hmac
crypto map outsidemap 20 ipsec-isakmp
crypto map outsidemap 20 match address l2l-vpn
crypto map outsidemap 20 set peer 196.219.XX.XX
crypto map outsidemap 20 set transform-set esp-3des-sha

Accepted Solution

_m3Rlin_

03.27.2008 at 02:53PM PDT, ID: 21226147

This article may help: http://www.m3rlin.org/wordpress/cisco-pix-515-pptp-problem/

20080236-EE-VQP-29 / EE_QW_2_20070628