pix 515 vpn site to site tunnelopne but no network or web access

I have 2 pix 515 in a  tunnel up but cannot see the other network of inside interfaces.

192.168.1.0                  |                                                               |        192.168.2.0

                               A-Network                                            B-Network
                               ________                                              _________
  PC-A    <------->   | PIX 515   |  <--------------------------->   | PIX 515    | <---------------> PC-B
                               ------------                                              -------------
192.168.1.11         202  |                                                               | 1                                192.168.2.11


what can i do to allow access to each network?
how can a allow access to pc-b from pc-a (both ways) on A and B network?
b_man_2001Asked:
Who is Participating?

Improve company productivity with a Business Account.Sign Up

x
 
MikeKaneConnect With a Mentor Commented:
With a scenario like this where you want a colo to run the exact services in the event Net-A is destroyed, You would want some basic disaster recovery procesdure.  


192.168.1.0                  |                                                               |        192.168.2.0

                               A-Network                                            B-Network
                               ________                                              _________
  PC-A    <------->   | PIX 515   |  <--------------------------->   | PIX 515    | <---------------> PC-B
www services         ------------                                               -------------                               copy of www services
192.168.1.11                |                                                        |                                            192.168.2.11
                                     |                                                        |
                                     |                                                        |  
                                   internet access                     internet access


#1) Check with your ISP provider.  Most, like ATT, can offer a service that allows for IP failover to another location in the event of a disaster.   That mean the same IP range would be re-routed to the colo .    This would mean your DNS can remain unchanged since the resolution is still to the same IP.   These solution can be discussed with your provider.  

#2) For www Service, for example, you would create a static map or port forward at network a to pc-s running www services.     You would do the same on network b, static map or port forward that network's Ip address to your internal address for PC-b running the services.       On you public facing DNS, you would create 2 A record for the same host for a round robin solution.   In the event of a disaster that wipes out Network A, every other www request would time out until you can get your DNS updates and propagated through the public dns structure.
0
 
MikeKaneConnect With a Mentor Commented:
You will need routing between the 192.168.1 and 192.168.2   Unless the pixs are each other's default gateway.  

On pix A  you will need to add an ip rout command to send traffic bound for 192.168.2.0 to the PIX B, and vice versa from the other network as well  unless you have something else doing the routing.....  


0
 
b_man_2001Author Commented:
yes they are default route on both.

can you show me a sample ip route statement?
0
What Kind of Coding Program is Right for You?

There are many ways to learn to code these days. From coding bootcamps like Flatiron School to online courses to totally free beginner resources. The best way to learn to code depends on many factors, but the most important one is you. See what course is best for you.

 
MikeKaneConnect With a Mentor Commented:
A firewall route command would look like this

route Outside 0.0.0.0 0.0.0.0 10.10.10.1 1


Route <interface> <foreign Network> <foreign network subnet mask> <Gateway that network can be reached through> Metric
0
 
b_man_2001Author Commented:
this will allow access though tunnel end to end (A network to B network) right?

new question?

can i allow access to B-Network like RDP/80/443 to access pc-b from the internet? not though the tunnel.
0
 
PugglewuggleConnect With a Mentor Commented:
Yes it will. ...
Just use the public IP address those ports are mapped to if it's on the other PIX. If it's on the same PIX you need to configure "hairpinning"
0
 
b_man_2001Author Commented:
hairpinning
what is that?

notes below
=========================================================================


192.168.1.0                  |                                                               |        192.168.2.0

                               A-Network                                            B-Network
                               ________                                              _________
  PC-A    <------->   | PIX 515   |  <--------------------------->   | PIX 515    | <---------------> PC-B
                               ------------                                         |    -------------
192.168.1.11         202  |                                                 |           | 1                                192.168.2.11
                                                                                        |
                                                                                        |  
                                                                                     internet access

--so on the out side int on B-Network cab be config as a tunnel site to site and allow rdp/80/443 traffic from the internet?
--could this connect handle about 300 to 600 kb of traffic on internet inf at the same time tunnel is up?
0
 
PugglewuggleConnect With a Mentor Commented:
You said you want to access it without tunnel, didn't you?
The amount of traffic on the connection depends purely on how fast your internet connection is. Please make sure that both your upload and download are fast enough.
BTW, did you mean KB or Kb?
0
 
MikeKaneConnect With a Mentor Commented:
Accessing ports from the internet on pc b will depend on where your internet connection is located at.   If its on PIX-B then you need to add either a static map or a port forward from outside to inside for those ports to an internal server.    
0
 
b_man_2001Author Commented:
both if a can.

I looking in to DR co-location site. setup to send data secure site to site and allow rdp/80/443 traffic from the internet
0
 
PugglewuggleConnect With a Mentor Commented:
That's what I said. The static map is known as a "hairpin" in industry lingo. It is only necessary when accessing server from the same PIX.
Otherwise you'd use port forwarding from the outside of the remote PIX.
0
 
PugglewuggleConnect With a Mentor Commented:
It is not going to be possible to do it with both unless you use multiple IP addresses on the server.
Please check bandwidth allowance (sustained) when evaluating a good colo site. Also, make sure you get info in Kilobits so that way there's no confusing Kilobits vs Kilobytes.
0
 
b_man_2001Author Commented:
OK

how do i config a port forward on a pix that is configured as a site to site tunnel? (B-Network - hairpin)
0
 
PugglewuggleConnect With a Mentor Commented:
So say PC-A is going to PC-B through the tunnel? You don't need port forward. The default route will take care of this.
0
 
b_man_2001Author Commented:
can i assign multiple IP addresses on  B-Network PIX? I have 2 public ip addresses for that location.
0
 
PugglewuggleConnect With a Mentor Commented:
Sure you can! Why?
0
 
b_man_2001Author Commented:
because to i'm looking for a way to have B-Network serve as a total backup site for web access to our backup data for DR.
0
 
b_man_2001Author Commented:

            MikeKane:

               Accessing ports from the internet on pc b will depend on where your internet connection is            located at.   If its on PIX-B then you need to add either a static map or a port forward from outside   to inside for those ports to an internal server.  
---------------------------------------------
What is the command and how is it done?
0
 
b_man_2001Author Commented:
OK
seeing that tunnel is up. what are the steps for net-b hairpin. because ATT DNS i understand but will the hairpin a net-b work with www before, during, and after DR.
0
 
PugglewuggleConnect With a Mentor Commented:
What I have several customers doing for redundant web services that rely on DNS is using round-robin DNS with a low TTL. This is called DNS failover. Then if one IP goes offline within a few minutes all traffic is sent to the other IP because the one that is down is taken out of the RR pool. DNS Made Easy offers a good DNS failover service.
http://www.dnsmadeeasy.com/s0306/prod/dnsfosm.html
For datacenter/server redundancy across sites this can be very complex. If you have AD you need to setup some sort of replication between two servers - one at each site - configured as DCs.
For file storage, you need to setup servers with similar storage capacities at both sites. I recommend using RAID arrays on both servers for data protection in case a hard drive fails. Then, you need to enable a data mirroring protocol across the VPN tunnel, RDC if available, and if not BITs. This is called DFS replication. You need to configure the same DFS namespace on both storage servers and set them up to mirror. And much, much, more.
This is really a very complex setup and cannot be dealt with all at once - it requires multiple complex components and good planning.
This type of configuration is very complex ands is really way outside the scope of this question. I recommend you open another question to ask about specifics of this plan.
0
 
PugglewuggleConnect With a Mentor Commented:
The thing with hairpinning is that it's really just mean to give your local network access to an internal web services server. It's not meant to be used for DR, although some network configurations required to make DR work might require it in some form.
Cheers! I hope all this info helps!
0
 
b_man_2001Author Commented:
Thanks for all the information.This will get me on the right path.

thx
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.