Solved

Configure Cisco VPN Client for PIX 501 6.3(5)

Posted on 2006-11-19
2
864 Views
Last Modified: 2010-08-05
I hate to be the millionth person to ask how to configure a VPN on PIX 501, but I have no other choice.

I'm trying to learn how to setup an encrypted VPN connection via Cisco VPN Client 4.x to my PIX 501 6.3(5). I would like to VPN to my Internal network, where I can access my server and browse the Internet. Currently, I can connect to my Windows Server 2k via RDP and do FTP. However, I would like to add a secure connection by configuring VPN w/ Split Tunneling. I've spent hours reading samples on Ciscos website and ExpertsExchange, but its not specific to my needs.
The only example the comes close to my need is http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00805734ae.shtml


Below is an idea of what I'm trying to accomplish.
Laptop w/Cisco VPN Client via broadband (Hotel) ---> WWW ---> Broadband Modem (Home) ---> PIX 501 ---> Personal Computers & Internet.


Thanks in advanced.
0
Comment
Question by:Intruder_3
2 Comments
 
LVL 20

Accepted Solution

by:
calvinetter earned 500 total points
ID: 17977599
 No problem, here's an example ( assuming home LAN is: 192.168.4.x ), run these commands in this order:

access-list nonat permit ip 192.168.4.0 255.255.255.0 172.26.125.0 255.255.255.0
access-list split_acl permit ip 192.168.4.0 255.255.255.0 172.26.125.0 255.255.255.0  <- for split-tunneling
nat (inside) 0 access-list nonat
ip local pool vpnpool 172.26.125.1-172.26.125.50

sysopt connection permit-ipsec
crypto ipsec transform-set myset esp-des esp-md5-hmac
crypto dynamic-map mydynamic 90 set transform-set myset
crypto map extmap 5 ipsec-isakmp dynamic mydynamic

isakmp nat-traversal
isakmp policy 5 authentication pre-share
isakmp policy 5 encryption des
isakmp policy 5 hash md5
isakmp policy 5 group 2

vpngroup joe_user address-pool vpnpool
vpngroup joe_user split-tunnel split_acl   <- for split-tunneling
vpngroup joe_user password secretstuff

crypto map extmap interface outside
isakmp enable outside
clear xlate

  Since you're on a home connection, I assume you don't have a static IP. You'll want to check out one of the free dynamic DNS services:  http://www.dyndns.com/   or  http://www.no-ip.com/

  On the VPN client, create a new connection entry:
- host will be whatever hostname you setup in the dynamic DNS above
- leave the default "Group Authentication" checked
- name (username):  joe_user
- password: secretstuff   (obviously make a stronger password than this!)

cheers
0
 

Author Comment

by:Intruder_3
ID: 17998341
Thanks.. I will give this a try.
0

Featured Post

Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Don’t let your business fall victim to the coming apocalypse – use our Survival Guide for the Fax Apocalypse to identify the risks and signs of zombie fax activities at your business.
When you try to share a printer , you may receive one of the following error messages. Error message when you use the Add Printer Wizard to share a printer: Windows could not share your printer. Operation could not be completed (Error 0x000006…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

685 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question