Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 3202
  • Last Modified:

LANtoLAN VPN Between PIX 515 and Non Cisco Devices

Currently, our remote users uses a Cisco VPN client to access our main office via DSL.  The VPN sessions are terminated at Cisco PIX 515. Now, we are interested in LAN to LAN VPN.  We want to VPN session to be up and running 24 hours. Is any device enable to accomplish this with PIX 515 termination point? if so, which device?  Since each remote location has 1 user, we don't need to have a high scale device.

Please advise.

Thank you.      
0
kaysar
Asked:
kaysar
  • 4
  • 2
1 Solution
 
lrmooreCommented:
I'm currently using a Linksys VPN router to connect to multiple PIX's. Piece of cake to setup, and relatively cheap <$200
0
 
plemieux72Commented:
If you want a Cisco-only solution, see http://www.cisco.com/en/US/products/hw/vpndevc/ps2286/index.html

This hardware client is compatible with the PIX firewalls and emulates the Cisco VPN software client.  

I also have setup a "permanent" site-to-site IPSec tunnel between a Cisco SOHO 91 to a PIX firewall and it works great as well.  There are lots of sample configs posted on the Cisco site with different ways of doing it.
0
 
kaysarAuthor Commented:
Hi Irmoor,

With Linksys LAN to LAN soltion,   Do you know any link that shows a sample configs at PIX 515 end?

Thanks.
0
Get free NFR key for Veeam Availability Suite 9.5

Veeam is happy to provide a free NFR license (1 year, 2 sockets) to all certified IT Pros. The license allows for the non-production use of Veeam Availability Suite v9.5 in your home lab, without any feature limitations. It works for both VMware and Hyper-V environments

 
kaysarAuthor Commented:
Hi premieux72,

Do you know the price for Cisco SOHO 91?  

Thank you.
0
 
lrmooreCommented:
Not a specific link, but I can show you mine that I know works.

access-list outside_cryptomap_40 permit ip 172.16.0.0 255.255.0.0 192.168.122.128 255.255.255.128
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto map CRYMAP 40 ipsec-isakmp
crypto map CRYMAP 40 match address outside_cryptomap_40
crypto map CRYMAP 40 set peer xx.xx.255.42                          <== my Linksys WAN IP
crypto map CRYMAP 40 set transform-set ESP-3DES-SHA
crypto map CRYMAP interface outside
isakmp enable outside
isakmp key ******** address xx.xx.255.42 netmask 255.255.255.255 no-xauth no-config-mode
isakmp identity address
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash sha
isakmp policy 20 group 2
isakmp policy 20 lifetime 3600

On my Linksys, Security, VPN page, I simply choose the same settings. Isakmp key is pre-shared, keys match, encryption policy for both phase 1 and phase 2 are 3DES/SHA. The web page is pretty self-explanatory except for the "group 2". It has a "group" choice, but it's not 1 or 2. Choose "1024".
DH Group 1 = 768
DH Group 2 = 1024
DH Group 5 = 1536 bit (usually only used with AES vs DES)

The exact model I'm using is Linksys WRV54G (I need the wireless). I have three independent VPN's to two different PIX's.

If you have multiple peers, just keep adding for each peer:

access-list outside_cryptomap_50 permit ip 172.16.0.0 255.255.0.0 192.168.xx.0 255.255.255.0
crypto map CRYMAP 50 ipsec-isakmp
crypto map CRYMAP 50 match address outside_cryptomap_50
crypto map CRYMAP 50 set peer xx.xx.xx.xx                     <== Peer #2
crypto map CRYMAP 50 set transform-set ESP-3DES-SHA
crypto map CRYMAP interface outside     <== always re-apply the map after any changes
isakmp key ******** address x.x.x.x netmask 255.255.255.255 no-xauth no-config-mode


access-list outside_cryptomap_60 permit ip 172.16.0.0 255.255.0.0 192.168.xx.0 255.255.255.0
crypto map CRYMAP 50 ipsec-isakmp
crypto map CRYMAP 50 match address outside_cryptomap_60
crypto map CRYMAP 50 set peer xx.xx.xx.xx                     <== Peer #3
crypto map CRYMAP 50 set transform-set ESP-3DES-SHA
crypto map CRYMAP interface outside     <== always re-apply the map after any changes
isakmp key ******** address x.x.x.x netmask 255.255.255.255 no-xauth no-config-mode
0
 
lrmooreCommented:
Of course, with only one user, you could just use the *free* VPN client from Cisco, it just won't be "always on"
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

  • 4
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now