Connect nodes across Cisco Pix and Linksys befvp41 using a VPN

Posted on 2008-10-14
Last Modified: 2012-05-05
Hello everyone, I have two networks, for the time we will just call them network A and network B. Network A is behind a Cisco Pix 515e, and network B is behind a Linksys befvp41 VPN router. The PIX is the VPN server, and the Linksys is connecting to it. I know I have setup the VPN correctly on both ends because when I click connect on the Linksys it says connected, and when I look at the log it says connected sucessfully. My question now is, how would I make a node from network A talk to a node on network B. I have never setup a VPN connection like this before. I have used Microsoft's VPN before and am used to the client getting a local IP address, and a Tunnel IP address as well.
Question by:mdiee
  • 2
LVL 33

Accepted Solution

MikeKane earned 500 total points
ID: 22716130
If you are certain you're VPN is connecting correctly across the public internet,  then you need to setup routing for the internal networks.  

On the pix side, I imagine you have an ACL catching interesting traffic to build the VPN.
The ACL would need to include the subnet of the destination network so that the cryptomap ACL catches it and 'routes' it to the peer (this being the linksys)  

something like:
access-list outside_cryptomap_10 extended permit ip <local ip subnet><local subnet mask> <remote subnet> <remote subnet mask>

That will grab any traffic destined for the remote subnet and send it to the peer.  

On the linksys side, you should find some routing info in the GUI, but I'm not certain..... maybe someone else can jump in here for the linksys side.

Author Comment

ID: 22722151
Here is my PIX configuration. I'm setting this up in a test environment, basically I have a PIX and the Linksys connected with a Cisco router in between to seperate the networks (the only reason i say this is because you are going to see some reserved IP ranges for Outisde interfaces.

BackPix# sh run
: Saved
PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password 2KFQnbNIdI.2KYOU encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname BackPix
domain-name MDI
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
access-list 100 permit icmp any any echo-reply
access-list 100 permit icmp any any time-exceeded
access-list 100 permit icmp any any unreachable
access-list 100 permit gre any any
access-list 100 permit icmp any any
access-list no_nat permit ip
access-list befvp41_acl permit ip

access-list 0 permit ip
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside
ip address inside
ip audit info action alarm
ip audit attack action alarm
ip local pool pptp
pdm history enable
arp timeout 14400
nat (inside) 0 access-list no_nat
route outside 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
crypto ipsec transform-set befvp41-set esp-des esp-md5-hmac
crypto map newmap 20 ipsec-isakmp
crypto map newmap 20 match address befvp41_acl
crypto map newmap 20 set peer
crypto map newmap 20 set transform-set befvp41-set
crypto map newmap interface outside
isakmp enable outside
isakmp key ******** address netmask
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 1
isakmp policy 10 lifetime 1000
telnet timeout 5
ssh timeout 5
management-access inside
console timeout 0
vpdn group 1 accept dialin pptp
vpdn group 1 ppp authentication mschap
vpdn group 1 ppp encryption mppe 40
vpdn group 1 client configuration address local pptp
vpdn group 1 client configuration dns
vpdn group 1 pptp echo 60
vpdn group 1 client authentication local
vpdn username admini password *********
vpdn username cfc password *********
vpdn username chuck password *********
vpdn enable outside
terminal width 80
: end

Like I said, when I put all the settings into the Linksys on the VPN tab and click connect it sucessfully connects. I'm just not sure where to go from there to get a device on each side to ping each other using my internal IPs

Author Comment

ID: 22771019
We decided to go a different route, but I award you with the points, MikeKane, for being the only one who replied.

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Cisco ASA 5512 LAN Config 16 77
Cisco VPN client v5 migration to Anyconnect VPN? 8 52
Cisco 3650 switch 7 45
Change name on 7940 Cisco UM 10 21
OpenVPN is a great open source VPN server that is capable of providing quick and easy VPN access to your network on the cheap.  By default the software is configured to allow open access to your network.  But what if you want to restrict users to on…
For months I had no idea how to 'discover' the IP address of the other end of a link (without asking someone who knows), and it drove me batty. Think about it. You can't use Cisco Discovery Protocol (CDP) because it's not implemented on the ASAs.…
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…

789 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question