mortgagecoach
asked on
Need to know easiest hardware solution for creating a VPN connection to PIX 506
I need to create a site to site VPN for a user in a home office that will be connecting to the PIX 506 at our main office. The home office user does not have a static IP address. What is the easiest way to make this happen? What hardware would you recommend and what would I need to add to the PIX config to make the solution work?
Thanks
Thanks
As far as what hardware I would recomend for the client as the config example uses an 831 I would go for one of those or the corresponding model depending on the internet type you have. The 800 series are cheap.
ASKER
If I added this config and set up my 506 as an EasyVPN Server, would it mess up the other vpn connections I have with static ip's, or the connenctions I get from software VPN clients?
No it shouldn't do. Basically the PIX config is eactly what you would do to enable software VPN clients to connect. All you would need to do is add the extra vpngroup to the config and as the client specifies which vpngroup it wants to use during the authentication phase it wont cause any problems.
In order to avoid confusion you would probably be best off using the same transform set as used by the VPN clients so you dont need to add another to the config.
In order to avoid confusion you would probably be best off using the same transform set as used by the VPN clients so you dont need to add another to the config.
ASKER
Ok, thanks. I have a PIX 501 that I was considering using also and I found this article that might make it all work. What do you think of this?....
http://www.cisco.com/warp/public/110/dynamicpix.html
http://www.cisco.com/warp/public/110/dynamicpix.html
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
By configuring the PIX as a EasyVPN server it does not need the clients IP address hard coded into the config and therefore it is ideal where the client has a dynamic IP address and wants a LAN-LAN connection and therefore cannot use the software client.