Solved

pix 515 vpn site to site tunnelopne but no network or web access

Posted on 2008-09-30
22
261 Views
Last Modified: 2010-04-21
I have 2 pix 515 in a  tunnel up but cannot see the other network of inside interfaces.

192.168.1.0                  |                                                               |        192.168.2.0

                               A-Network                                            B-Network
                               ________                                              _________
  PC-A    <------->   | PIX 515   |  <--------------------------->   | PIX 515    | <---------------> PC-B
                               ------------                                              -------------
192.168.1.11         202  |                                                               | 1                                192.168.2.11


what can i do to allow access to each network?
how can a allow access to pc-b from pc-a (both ways) on A and B network?
0
Comment
Question by:b_man_2001
  • 10
  • 8
  • 4
22 Comments
 
LVL 33

Assisted Solution

by:MikeKane
MikeKane earned 210 total points
Comment Utility
You will need routing between the 192.168.1 and 192.168.2   Unless the pixs are each other's default gateway.  

On pix A  you will need to add an ip rout command to send traffic bound for 192.168.2.0 to the PIX B, and vice versa from the other network as well  unless you have something else doing the routing.....  


0
 

Author Comment

by:b_man_2001
Comment Utility
yes they are default route on both.

can you show me a sample ip route statement?
0
 
LVL 33

Assisted Solution

by:MikeKane
MikeKane earned 210 total points
Comment Utility
A firewall route command would look like this

route Outside 0.0.0.0 0.0.0.0 10.10.10.1 1


Route <interface> <foreign Network> <foreign network subnet mask> <Gateway that network can be reached through> Metric
0
 

Author Comment

by:b_man_2001
Comment Utility
this will allow access though tunnel end to end (A network to B network) right?

new question?

can i allow access to B-Network like RDP/80/443 to access pc-b from the internet? not though the tunnel.
0
 
LVL 12

Assisted Solution

by:Pugglewuggle
Pugglewuggle earned 290 total points
Comment Utility
Yes it will. ...
Just use the public IP address those ports are mapped to if it's on the other PIX. If it's on the same PIX you need to configure "hairpinning"
0
 

Author Comment

by:b_man_2001
Comment Utility
hairpinning
what is that?

notes below
=========================================================================


192.168.1.0                  |                                                               |        192.168.2.0

                               A-Network                                            B-Network
                               ________                                              _________
  PC-A    <------->   | PIX 515   |  <--------------------------->   | PIX 515    | <---------------> PC-B
                               ------------                                         |    -------------
192.168.1.11         202  |                                                 |           | 1                                192.168.2.11
                                                                                        |
                                                                                        |  
                                                                                     internet access

--so on the out side int on B-Network cab be config as a tunnel site to site and allow rdp/80/443 traffic from the internet?
--could this connect handle about 300 to 600 kb of traffic on internet inf at the same time tunnel is up?
0
 
LVL 12

Assisted Solution

by:Pugglewuggle
Pugglewuggle earned 290 total points
Comment Utility
You said you want to access it without tunnel, didn't you?
The amount of traffic on the connection depends purely on how fast your internet connection is. Please make sure that both your upload and download are fast enough.
BTW, did you mean KB or Kb?
0
 
LVL 33

Assisted Solution

by:MikeKane
MikeKane earned 210 total points
Comment Utility
Accessing ports from the internet on pc b will depend on where your internet connection is located at.   If its on PIX-B then you need to add either a static map or a port forward from outside to inside for those ports to an internal server.    
0
 

Author Comment

by:b_man_2001
Comment Utility
both if a can.

I looking in to DR co-location site. setup to send data secure site to site and allow rdp/80/443 traffic from the internet
0
 
LVL 12

Assisted Solution

by:Pugglewuggle
Pugglewuggle earned 290 total points
Comment Utility
That's what I said. The static map is known as a "hairpin" in industry lingo. It is only necessary when accessing server from the same PIX.
Otherwise you'd use port forwarding from the outside of the remote PIX.
0
 
LVL 12

Assisted Solution

by:Pugglewuggle
Pugglewuggle earned 290 total points
Comment Utility
It is not going to be possible to do it with both unless you use multiple IP addresses on the server.
Please check bandwidth allowance (sustained) when evaluating a good colo site. Also, make sure you get info in Kilobits so that way there's no confusing Kilobits vs Kilobytes.
0
How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

 

Author Comment

by:b_man_2001
Comment Utility
OK

how do i config a port forward on a pix that is configured as a site to site tunnel? (B-Network - hairpin)
0
 
LVL 12

Assisted Solution

by:Pugglewuggle
Pugglewuggle earned 290 total points
Comment Utility
So say PC-A is going to PC-B through the tunnel? You don't need port forward. The default route will take care of this.
0
 

Author Comment

by:b_man_2001
Comment Utility
can i assign multiple IP addresses on  B-Network PIX? I have 2 public ip addresses for that location.
0
 
LVL 12

Assisted Solution

by:Pugglewuggle
Pugglewuggle earned 290 total points
Comment Utility
Sure you can! Why?
0
 

Author Comment

by:b_man_2001
Comment Utility
because to i'm looking for a way to have B-Network serve as a total backup site for web access to our backup data for DR.
0
 

Author Comment

by:b_man_2001
Comment Utility

            MikeKane:

               Accessing ports from the internet on pc b will depend on where your internet connection is            located at.   If its on PIX-B then you need to add either a static map or a port forward from outside   to inside for those ports to an internal server.  
---------------------------------------------
What is the command and how is it done?
0
 
LVL 33

Accepted Solution

by:
MikeKane earned 210 total points
Comment Utility
With a scenario like this where you want a colo to run the exact services in the event Net-A is destroyed, You would want some basic disaster recovery procesdure.  


192.168.1.0                  |                                                               |        192.168.2.0

                               A-Network                                            B-Network
                               ________                                              _________
  PC-A    <------->   | PIX 515   |  <--------------------------->   | PIX 515    | <---------------> PC-B
www services         ------------                                               -------------                               copy of www services
192.168.1.11                |                                                        |                                            192.168.2.11
                                     |                                                        |
                                     |                                                        |  
                                   internet access                     internet access


#1) Check with your ISP provider.  Most, like ATT, can offer a service that allows for IP failover to another location in the event of a disaster.   That mean the same IP range would be re-routed to the colo .    This would mean your DNS can remain unchanged since the resolution is still to the same IP.   These solution can be discussed with your provider.  

#2) For www Service, for example, you would create a static map or port forward at network a to pc-s running www services.     You would do the same on network b, static map or port forward that network's Ip address to your internal address for PC-b running the services.       On you public facing DNS, you would create 2 A record for the same host for a round robin solution.   In the event of a disaster that wipes out Network A, every other www request would time out until you can get your DNS updates and propagated through the public dns structure.
0
 

Author Comment

by:b_man_2001
Comment Utility
OK
seeing that tunnel is up. what are the steps for net-b hairpin. because ATT DNS i understand but will the hairpin a net-b work with www before, during, and after DR.
0
 
LVL 12

Assisted Solution

by:Pugglewuggle
Pugglewuggle earned 290 total points
Comment Utility
What I have several customers doing for redundant web services that rely on DNS is using round-robin DNS with a low TTL. This is called DNS failover. Then if one IP goes offline within a few minutes all traffic is sent to the other IP because the one that is down is taken out of the RR pool. DNS Made Easy offers a good DNS failover service.
http://www.dnsmadeeasy.com/s0306/prod/dnsfosm.html
For datacenter/server redundancy across sites this can be very complex. If you have AD you need to setup some sort of replication between two servers - one at each site - configured as DCs.
For file storage, you need to setup servers with similar storage capacities at both sites. I recommend using RAID arrays on both servers for data protection in case a hard drive fails. Then, you need to enable a data mirroring protocol across the VPN tunnel, RDC if available, and if not BITs. This is called DFS replication. You need to configure the same DFS namespace on both storage servers and set them up to mirror. And much, much, more.
This is really a very complex setup and cannot be dealt with all at once - it requires multiple complex components and good planning.
This type of configuration is very complex ands is really way outside the scope of this question. I recommend you open another question to ask about specifics of this plan.
0
 
LVL 12

Assisted Solution

by:Pugglewuggle
Pugglewuggle earned 290 total points
Comment Utility
The thing with hairpinning is that it's really just mean to give your local network access to an internal web services server. It's not meant to be used for DR, although some network configurations required to make DR work might require it in some form.
Cheers! I hope all this info helps!
0
 

Author Closing Comment

by:b_man_2001
Comment Utility
Thanks for all the information.This will get me on the right path.

thx
0

Featured Post

Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

Join & Write a Comment

Suggested Solutions

Have you experienced traffic destined through a Cisco ASA firewall disappears and you do not know if the traffic stops in the firewall or somewhere else? The solution is the capture feature. This feature was released in 6.2(1) and works in all firew…
From Cisco ASA version 8.3, the Network Address Translation (NAT) configuration has been completely redesigned and it may be helpful to have the syntax configuration for both at a glance. You may as well want to read official Cisco published AS…
Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…
This demo shows you how to set up the containerized NetScaler CPX with NetScaler Management and Analytics System in a non-routable Mesos/Marathon environment for use with Micro-Services applications.

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now