Solved

Pix Default Gateway

Posted on 2008-09-29
17
611 Views
Last Modified: 2012-05-05
Using Cisco VPN client we are establishing a secure IPSEC connection to a PIX box. We want the remote users to then (i.e when on the VPN) to browse the internet. We dont want to use split tunnelling.

Could someone tell us how to setup the default gateway paramter on the pix box so that it is the same as any client within the LAN. I undersatand the overhead of doublde bandwidth but this is ok.

Please provide instructions to use PDM.
0
Comment
Question by:malboteju
  • 7
  • 4
  • 3
  • +2
17 Comments
 
LVL 11

Expert Comment

by:billwharton
ID: 22601798
I strongly suggest you stay away from pdm as it doesn't work as good as command line. You can also paste commands directly into the pdm console

Follow steps from this link
http://www.cisco.com/en/US/docs/security/pix/pix63/configuration/guide/basclnt.html
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 22601896
What version PIX? If using 6.x you cannot do it without split-tunneling. You have to be running 7.x or above.
0
 
LVL 20

Expert Comment

by:RPPreacher
ID: 22601996
Echo lrmoore.
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 12

Expert Comment

by:Pugglewuggle
ID: 22602823
If you have enough RAM/Flash I highly recommend upgrading your PIX to the latest version (8.0.4). If not enough for 8.x, then at least upgrade to 7.x.
This will enable this feature and also provide you with more modern features and a more secure platform.
0
 

Author Comment

by:malboteju
ID: 22607735
thanks a lot for the info. I am not a full time pix guy but have experienced a few issues with PDM, and have upgraded a couple of boxes to support ASDM sometime ago, which works better, but its about finding downtime to do it.

According to lrmoore can this be certinaly done with Version 7, and possibly runing with ASDM.

RPPreacher mentioned Echo, but did not clarify, is there a solution without upgrading the box.

If possible I prefer to do this without having to stroll thru endless commands. I have always appreciated the solid performance of Pixes. Unfortunate that there are no better GIU support to help busy life of today's admins who has to deal with 100s of different systems everyday.

Cisco PIX Firewall Version 6.3(1)
Cisco PIX Device Manager Version 3.0(1)
0
 
LVL 20

Expert Comment

by:RPPreacher
ID: 22607762
I was saying lrmoore is right.

Here's the upgrade procedure, step by step
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a00804708d8.shtml
0
 

Author Comment

by:malboteju
ID: 22607792
ok, thanks :), thought that was some workaround using a command.
0
 

Author Comment

by:malboteju
ID: 22607813
in fact, could someone tell me the steps for doing this using Pix 7, so that I can try it on a different box before bringing down the one in question. That's my last request.

0
 
LVL 20

Expert Comment

by:RPPreacher
ID: 22607849
The above link was for upgrading 6.x to 7.x.
0
 
LVL 12

Expert Comment

by:Pugglewuggle
ID: 22607897
I still say go ahead and upgrade to the latest - 8.0.4 and ASDM 6.1.3
New features and security patches.
0
 

Author Comment

by:malboteju
ID: 22607956
Thanks Gents.

Just to clarify, I'm after a link or steps for setting up default gateway after upgrading to Pix 7.

Not for upgrading itself.

I have another box (running 7.04 and ASDM 5.04) on which I want to test this before upgrading.

0
 
LVL 12

Expert Comment

by:Pugglewuggle
ID: 22608004
ooohhh. if you mean the default gateway for you to get out to the internet it is simply:

route outside 0.0.0.0 0.0.0.0 DEFAULT_GATEWAY_IP 1
where DEFAULT_GATEWAY_IP = your ISP default gateway!
0
 
LVL 12

Expert Comment

by:Pugglewuggle
ID: 22608011
Wait - you mean for remote VPN users don't you.
The thing is that this cannot be done easily in the old software. You must upgrade if you want this to be simple and secure.
0
 
LVL 12

Expert Comment

by:Pugglewuggle
ID: 22608020
6.x just won't do it. Upgrade to 8 if you've got enough flash/RAM.
0
 
LVL 79

Accepted Solution

by:
lrmoore earned 500 total points
ID: 22608118
Here's how to configure it once you've upgraded:
http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00805734ae.shtml

Boils down to two simple config lines:
same-security-traffic permit intra-interface
nat (outside) 1 192.168.10.0 255.255.255.0  <==where 1921.68.10.0 = VPN client ip pool subnet

0
 
LVL 12

Expert Comment

by:Pugglewuggle
ID: 22608500
lrmoore's config lines look good and will do it but you must upgrade as stated.
0
 
LVL 12

Expert Comment

by:Pugglewuggle
ID: 22608510
Just make sure you use the NAT command and not static - statics will the FORCE all traffic through where you say and you won't be able to access either the web or internal resources.
0

Featured Post

Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Juniper VPN devices are a popular alternative to using Cisco products. Last year I needed to set up an international site-to-site VPN over the Internet, but the client had high security requirements -- FIPS 140. What and Why of FIPS 140 Federa…
If you use NetMotion Mobility on your PC and plan to upgrade to Windows 10, it may not work unless you take these steps.
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question