?
Solved

Pix Default Gateway

Posted on 2008-09-29
17
Medium Priority
?
621 Views
Last Modified: 2012-05-05
Using Cisco VPN client we are establishing a secure IPSEC connection to a PIX box. We want the remote users to then (i.e when on the VPN) to browse the internet. We dont want to use split tunnelling.

Could someone tell us how to setup the default gateway paramter on the pix box so that it is the same as any client within the LAN. I undersatand the overhead of doublde bandwidth but this is ok.

Please provide instructions to use PDM.
0
Comment
Question by:malboteju
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 7
  • 4
  • 3
  • +2
17 Comments
 
LVL 11

Expert Comment

by:billwharton
ID: 22601798
I strongly suggest you stay away from pdm as it doesn't work as good as command line. You can also paste commands directly into the pdm console

Follow steps from this link
http://www.cisco.com/en/US/docs/security/pix/pix63/configuration/guide/basclnt.html
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 22601896
What version PIX? If using 6.x you cannot do it without split-tunneling. You have to be running 7.x or above.
0
 
LVL 20

Expert Comment

by:RPPreacher
ID: 22601996
Echo lrmoore.
0
Get your Disaster Recovery as a Service basics

Disaster Recovery as a Service is one go-to solution that revolutionizes DR planning. Implementing DRaaS could be an efficient process, easily accessible to non-DR experts. Learn about monitoring, testing, executing failovers and failbacks to ensure a "healthy" DR environment.

 
LVL 12

Expert Comment

by:Pugglewuggle
ID: 22602823
If you have enough RAM/Flash I highly recommend upgrading your PIX to the latest version (8.0.4). If not enough for 8.x, then at least upgrade to 7.x.
This will enable this feature and also provide you with more modern features and a more secure platform.
0
 

Author Comment

by:malboteju
ID: 22607735
thanks a lot for the info. I am not a full time pix guy but have experienced a few issues with PDM, and have upgraded a couple of boxes to support ASDM sometime ago, which works better, but its about finding downtime to do it.

According to lrmoore can this be certinaly done with Version 7, and possibly runing with ASDM.

RPPreacher mentioned Echo, but did not clarify, is there a solution without upgrading the box.

If possible I prefer to do this without having to stroll thru endless commands. I have always appreciated the solid performance of Pixes. Unfortunate that there are no better GIU support to help busy life of today's admins who has to deal with 100s of different systems everyday.

Cisco PIX Firewall Version 6.3(1)
Cisco PIX Device Manager Version 3.0(1)
0
 
LVL 20

Expert Comment

by:RPPreacher
ID: 22607762
I was saying lrmoore is right.

Here's the upgrade procedure, step by step
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a00804708d8.shtml
0
 

Author Comment

by:malboteju
ID: 22607792
ok, thanks :), thought that was some workaround using a command.
0
 

Author Comment

by:malboteju
ID: 22607813
in fact, could someone tell me the steps for doing this using Pix 7, so that I can try it on a different box before bringing down the one in question. That's my last request.

0
 
LVL 20

Expert Comment

by:RPPreacher
ID: 22607849
The above link was for upgrading 6.x to 7.x.
0
 
LVL 12

Expert Comment

by:Pugglewuggle
ID: 22607897
I still say go ahead and upgrade to the latest - 8.0.4 and ASDM 6.1.3
New features and security patches.
0
 

Author Comment

by:malboteju
ID: 22607956
Thanks Gents.

Just to clarify, I'm after a link or steps for setting up default gateway after upgrading to Pix 7.

Not for upgrading itself.

I have another box (running 7.04 and ASDM 5.04) on which I want to test this before upgrading.

0
 
LVL 12

Expert Comment

by:Pugglewuggle
ID: 22608004
ooohhh. if you mean the default gateway for you to get out to the internet it is simply:

route outside 0.0.0.0 0.0.0.0 DEFAULT_GATEWAY_IP 1
where DEFAULT_GATEWAY_IP = your ISP default gateway!
0
 
LVL 12

Expert Comment

by:Pugglewuggle
ID: 22608011
Wait - you mean for remote VPN users don't you.
The thing is that this cannot be done easily in the old software. You must upgrade if you want this to be simple and secure.
0
 
LVL 12

Expert Comment

by:Pugglewuggle
ID: 22608020
6.x just won't do it. Upgrade to 8 if you've got enough flash/RAM.
0
 
LVL 79

Accepted Solution

by:
lrmoore earned 2000 total points
ID: 22608118
Here's how to configure it once you've upgraded:
http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00805734ae.shtml

Boils down to two simple config lines:
same-security-traffic permit intra-interface
nat (outside) 1 192.168.10.0 255.255.255.0  <==where 1921.68.10.0 = VPN client ip pool subnet

0
 
LVL 12

Expert Comment

by:Pugglewuggle
ID: 22608500
lrmoore's config lines look good and will do it but you must upgrade as stated.
0
 
LVL 12

Expert Comment

by:Pugglewuggle
ID: 22608510
Just make sure you use the NAT command and not static - statics will the FORCE all traffic through where you say and you won't be able to access either the web or internal resources.
0

Featured Post

[Webinar] Lessons on Recovering from Petya

Skyport is working hard to help customers recover from recent attacks, like the Petya worm. This work has brought to light some important lessons. New malware attacks like this can take down your entire environment. Learn from others mistakes on how to prevent Petya like worms.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Many of the companies I’ve worked with have embraced cloud solutions due to their desire to “get out of the datacenter business.” The ability to achieve better security and availability, and the speed with which they are able to deploy, is far grea…
Considering cloud tradeoffs and determining the right mix for your organization.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

719 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question