Pix Default Gateway

Using Cisco VPN client we are establishing a secure IPSEC connection to a PIX box. We want the remote users to then (i.e when on the VPN) to browse the internet. We dont want to use split tunnelling.

Could someone tell us how to setup the default gateway paramter on the pix box so that it is the same as any client within the LAN. I undersatand the overhead of doublde bandwidth but this is ok.

Please provide instructions to use PDM.
malbotejuAsked:
Who is Participating?
 
lrmooreCommented:
Here's how to configure it once you've upgraded:
http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00805734ae.shtml

Boils down to two simple config lines:
same-security-traffic permit intra-interface
nat (outside) 1 192.168.10.0 255.255.255.0  <==where 1921.68.10.0 = VPN client ip pool subnet

0
 
billwhartonCommented:
I strongly suggest you stay away from pdm as it doesn't work as good as command line. You can also paste commands directly into the pdm console

Follow steps from this link
http://www.cisco.com/en/US/docs/security/pix/pix63/configuration/guide/basclnt.html
0
 
lrmooreCommented:
What version PIX? If using 6.x you cannot do it without split-tunneling. You have to be running 7.x or above.
0
Identify and Prevent Potential Cyber-threats

Become the white hat who helps safeguard our interconnected world. Transform your career future by earning your MS in Cybersecurity. WGU’s MSCSIA degree program was designed in collaboration with national intelligence organizations and IT industry leaders.

 
RPPreacherCommented:
Echo lrmoore.
0
 
PugglewuggleCommented:
If you have enough RAM/Flash I highly recommend upgrading your PIX to the latest version (8.0.4). If not enough for 8.x, then at least upgrade to 7.x.
This will enable this feature and also provide you with more modern features and a more secure platform.
0
 
malbotejuAuthor Commented:
thanks a lot for the info. I am not a full time pix guy but have experienced a few issues with PDM, and have upgraded a couple of boxes to support ASDM sometime ago, which works better, but its about finding downtime to do it.

According to lrmoore can this be certinaly done with Version 7, and possibly runing with ASDM.

RPPreacher mentioned Echo, but did not clarify, is there a solution without upgrading the box.

If possible I prefer to do this without having to stroll thru endless commands. I have always appreciated the solid performance of Pixes. Unfortunate that there are no better GIU support to help busy life of today's admins who has to deal with 100s of different systems everyday.

Cisco PIX Firewall Version 6.3(1)
Cisco PIX Device Manager Version 3.0(1)
0
 
RPPreacherCommented:
I was saying lrmoore is right.

Here's the upgrade procedure, step by step
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a00804708d8.shtml
0
 
malbotejuAuthor Commented:
ok, thanks :), thought that was some workaround using a command.
0
 
malbotejuAuthor Commented:
in fact, could someone tell me the steps for doing this using Pix 7, so that I can try it on a different box before bringing down the one in question. That's my last request.

0
 
RPPreacherCommented:
The above link was for upgrading 6.x to 7.x.
0
 
PugglewuggleCommented:
I still say go ahead and upgrade to the latest - 8.0.4 and ASDM 6.1.3
New features and security patches.
0
 
malbotejuAuthor Commented:
Thanks Gents.

Just to clarify, I'm after a link or steps for setting up default gateway after upgrading to Pix 7.

Not for upgrading itself.

I have another box (running 7.04 and ASDM 5.04) on which I want to test this before upgrading.

0
 
PugglewuggleCommented:
ooohhh. if you mean the default gateway for you to get out to the internet it is simply:

route outside 0.0.0.0 0.0.0.0 DEFAULT_GATEWAY_IP 1
where DEFAULT_GATEWAY_IP = your ISP default gateway!
0
 
PugglewuggleCommented:
Wait - you mean for remote VPN users don't you.
The thing is that this cannot be done easily in the old software. You must upgrade if you want this to be simple and secure.
0
 
PugglewuggleCommented:
6.x just won't do it. Upgrade to 8 if you've got enough flash/RAM.
0
 
PugglewuggleCommented:
lrmoore's config lines look good and will do it but you must upgrade as stated.
0
 
PugglewuggleCommented:
Just make sure you use the NAT command and not static - statics will the FORCE all traffic through where you say and you won't be able to access either the web or internal resources.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.