Routing to PIX VPN

Posted on 2004-11-19
Last Modified: 2010-03-17

First of all, I know that a PIX is not a router.

My situation is this:

Router A (Cisco 17xx) has a public IP a.b.c.d on Ethernet interface.
Router B (Cisco 26xx) has a public IP e.f.g.h on Ethernet Interface.

PIX A (501) is w.x.y.z outside
PIX A (506) is

PIX B is s.t.u.v outside
PIX B is Inside

Data Center Firewall (Linux running Freeswan and also a router with iptables)
the DCFW is running two VPN's one to Office A, the other to Office B

The issue is that from office A using an internal IP of, we can ping the DC VPN ( just fine, but are not able to ping across to  The DNS is pointing to a server in the DC  Some of the sites that are requested are behind the DCFW, so when going to, it's attempting to use  

What's happening is that the PIX is only routing traffic for through the VPN.  It's routing to the router, that has no idea how to get to the rest of the networks.  

Question is - how do I get the router to pass back to the PIX over the VPN.  Also, how can I tell it to find over at Office B...

I'm assuming I need to tell the PIX to do it, other wise, I'm going to have a nice loop...


Question by:carlosmp
    1 Comment
    LVL 13

    Accepted Solution

    When you set up VPN tunnels (on PIX or other) you define what traffic is "interesting" for this tunnel. That is the traffic that is then sent over the tunnel.
    Both ends of a VPN tunnel need to be configured with the same interesting traffic for the VPN.
    The other thing to remember for the PIX is that you need to EXCLUDE traffic that you want to gover the VPN from NAT by using the NAT 0 command.

    You could also setup a third VPN tunnel directly from PIX A to PIX B, so that the traffic doesn't have to go via your data center (but maybe you don't want this, depends on what control you are wanting).

    Hopefully this helps, if you have more specific questions, please ask.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    How your wiki can always stay up-to-date

    Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
    - Increase transparency
    - Onboard new hires faster
    - Access from mobile/offline

        Over the past few years, small business and home owners have become so dependent on internet that a need for redundancy has arisen.    What happens when your small business or home / home office loses its internet connection?  The results c…
    This solves the problem of diagnosing why an internet connection is no longer working. It also helps identify the likely cause of the lost connection if the procedure fails to re-establish your internet connection. It helps to pinpoint the likely co…
    Here's a very brief overview of the methods PRTG Network Monitor ( offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
    In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor ( If you're interested in additional methods for monitoring bandwidt…

    760 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    12 Experts available now in Live!

    Get 1:1 Help Now