Solved

Connect nodes across Cisco Pix and Linksys befvp41 using a VPN

Posted on 2008-10-14
3
846 Views
Last Modified: 2012-05-05
Hello everyone, I have two networks, for the time we will just call them network A and network B. Network A is behind a Cisco Pix 515e, and network B is behind a Linksys befvp41 VPN router. The PIX is the VPN server, and the Linksys is connecting to it. I know I have setup the VPN correctly on both ends because when I click connect on the Linksys it says connected, and when I look at the log it says connected sucessfully. My question now is, how would I make a node from network A talk to a node on network B. I have never setup a VPN connection like this before. I have used Microsoft's VPN before and am used to the client getting a local IP address, and a Tunnel IP address as well.
0
Comment
Question by:mdiee
  • 2
3 Comments
 
LVL 33

Accepted Solution

by:
MikeKane earned 500 total points
ID: 22716130
If you are certain you're VPN is connecting correctly across the public internet,  then you need to setup routing for the internal networks.  

On the pix side, I imagine you have an ACL catching interesting traffic to build the VPN.
The ACL would need to include the subnet of the destination network so that the cryptomap ACL catches it and 'routes' it to the peer (this being the linksys)  

something like:
access-list outside_cryptomap_10 extended permit ip <local ip subnet><local subnet mask> <remote subnet> <remote subnet mask>

That will grab any traffic destined for the remote subnet and send it to the peer.  


On the linksys side, you should find some routing info in the GUI, but I'm not certain..... maybe someone else can jump in here for the linksys side.
0
 

Author Comment

by:mdiee
ID: 22722151
Here is my PIX configuration. I'm setting this up in a test environment, basically I have a PIX and the Linksys connected with a Cisco router in between to seperate the networks (the only reason i say this is because you are going to see some reserved IP ranges for Outisde interfaces.

BackPix# sh run
: Saved
:
PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password 2KFQnbNIdI.2KYOU encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname BackPix
domain-name MDI
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list 100 permit icmp any any echo-reply
access-list 100 permit icmp any any time-exceeded
access-list 100 permit icmp any any unreachable
access-list 100 permit gre any any
access-list 100 permit icmp any any
access-list no_nat permit ip 10.115.0.0 255.255.0.0 10.114.0.0 255.255.0.0
access-list befvp41_acl permit ip 10.114.0.0 255.255.0.0 10.115.0.0 255.255.0.0

access-list 0 permit ip 10.114.0.0 255.255.0.0 10.115.0.0 255.255.0.0
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 10.0.0.2 255.255.0.0
ip address inside 10.114.0.1 255.255.0.0
ip audit info action alarm
ip audit attack action alarm
ip local pool pptp 10.115.150.1-10.115.150.50
pdm history enable
arp timeout 14400
nat (inside) 0 access-list no_nat
route outside 0.0.0.0 0.0.0.0 10.0.0.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 10.114.0.29 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
crypto ipsec transform-set befvp41-set esp-des esp-md5-hmac
crypto map newmap 20 ipsec-isakmp
crypto map newmap 20 match address befvp41_acl
crypto map newmap 20 set peer 192.168.2.2
crypto map newmap 20 set transform-set befvp41-set
crypto map newmap interface outside
isakmp enable outside
isakmp key ******** address 192.168.2.2 netmask 255.255.255.0
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 1
isakmp policy 10 lifetime 1000
telnet timeout 5
ssh timeout 5
management-access inside
console timeout 0
vpdn group 1 accept dialin pptp
vpdn group 1 ppp authentication mschap
vpdn group 1 ppp encryption mppe 40
vpdn group 1 client configuration address local pptp
vpdn group 1 client configuration dns 10.114.2.11 10.114.2.12
vpdn group 1 pptp echo 60
vpdn group 1 client authentication local
vpdn username admini password *********
vpdn username cfc password *********
vpdn username chuck password *********
vpdn enable outside
terminal width 80
Cryptochecksum:bc799c1dd9712e4ffee5b3a4a606174a
: end
BackPix#




Like I said, when I put all the settings into the Linksys on the VPN tab and click connect it sucessfully connects. I'm just not sure where to go from there to get a device on each side to ping each other using my internal IPs
0
 

Author Comment

by:mdiee
ID: 22771019
We decided to go a different route, but I award you with the points, MikeKane, for being the only one who replied.
0

Featured Post

Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

Join & Write a Comment

Secure VPN Connection terminated locally by the Client.  Reason 442: Failed to enable Virtual Adapter. If you receive this error on Windows 8 or Windows 8.1 while trying to connect with the Cisco VPN Client then the solution is a simple registry f…
In the world of WAN, QoS is a pretty important topic for most, if not all, networks. Some WAN technologies have QoS mechanisms built in, but others, such as some L2 WAN's, don't have QoS control in the provider cloud.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

23 Experts available now in Live!

Get 1:1 Help Now