[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now


Connect nodes across Cisco Pix and Linksys befvp41 using a VPN

Posted on 2008-10-14
Medium Priority
Last Modified: 2012-05-05
Hello everyone, I have two networks, for the time we will just call them network A and network B. Network A is behind a Cisco Pix 515e, and network B is behind a Linksys befvp41 VPN router. The PIX is the VPN server, and the Linksys is connecting to it. I know I have setup the VPN correctly on both ends because when I click connect on the Linksys it says connected, and when I look at the log it says connected sucessfully. My question now is, how would I make a node from network A talk to a node on network B. I have never setup a VPN connection like this before. I have used Microsoft's VPN before and am used to the client getting a local IP address, and a Tunnel IP address as well.
Question by:mdiee
  • 2
LVL 33

Accepted Solution

MikeKane earned 1500 total points
ID: 22716130
If you are certain you're VPN is connecting correctly across the public internet,  then you need to setup routing for the internal networks.  

On the pix side, I imagine you have an ACL catching interesting traffic to build the VPN.
The ACL would need to include the subnet of the destination network so that the cryptomap ACL catches it and 'routes' it to the peer (this being the linksys)  

something like:
access-list outside_cryptomap_10 extended permit ip <local ip subnet><local subnet mask> <remote subnet> <remote subnet mask>

That will grab any traffic destined for the remote subnet and send it to the peer.  

On the linksys side, you should find some routing info in the GUI, but I'm not certain..... maybe someone else can jump in here for the linksys side.

Author Comment

ID: 22722151
Here is my PIX configuration. I'm setting this up in a test environment, basically I have a PIX and the Linksys connected with a Cisco router in between to seperate the networks (the only reason i say this is because you are going to see some reserved IP ranges for Outisde interfaces.

BackPix# sh run
: Saved
PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password 2KFQnbNIdI.2KYOU encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname BackPix
domain-name MDI
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
access-list 100 permit icmp any any echo-reply
access-list 100 permit icmp any any time-exceeded
access-list 100 permit icmp any any unreachable
access-list 100 permit gre any any
access-list 100 permit icmp any any
access-list no_nat permit ip
access-list befvp41_acl permit ip

access-list 0 permit ip
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside
ip address inside
ip audit info action alarm
ip audit attack action alarm
ip local pool pptp
pdm history enable
arp timeout 14400
nat (inside) 0 access-list no_nat
route outside 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
crypto ipsec transform-set befvp41-set esp-des esp-md5-hmac
crypto map newmap 20 ipsec-isakmp
crypto map newmap 20 match address befvp41_acl
crypto map newmap 20 set peer
crypto map newmap 20 set transform-set befvp41-set
crypto map newmap interface outside
isakmp enable outside
isakmp key ******** address netmask
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 1
isakmp policy 10 lifetime 1000
telnet timeout 5
ssh timeout 5
management-access inside
console timeout 0
vpdn group 1 accept dialin pptp
vpdn group 1 ppp authentication mschap
vpdn group 1 ppp encryption mppe 40
vpdn group 1 client configuration address local pptp
vpdn group 1 client configuration dns
vpdn group 1 pptp echo 60
vpdn group 1 client authentication local
vpdn username admini password *********
vpdn username cfc password *********
vpdn username chuck password *********
vpdn enable outside
terminal width 80
: end

Like I said, when I put all the settings into the Linksys on the VPN tab and click connect it sucessfully connects. I'm just not sure where to go from there to get a device on each side to ping each other using my internal IPs

Author Comment

ID: 22771019
We decided to go a different route, but I award you with the points, MikeKane, for being the only one who replied.

Featured Post

New Tabletop Appliances Blow Competitors Away!

WatchGuard’s new T15, T35 and T55 tabletop UTMs provide the highest-performing security inspection in their class, allowing users at small offices, home offices and distributed enterprises to experience blazing-fast Internet speeds without sacrificing enterprise-grade security.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this article, we’ll look at how to deploy ProxySQL.
As managed cloud service providers, we often get asked to intervene when cloud deployments go awry. Attracted by apparent ease-of-use, flexibility and low computing costs, companies quickly adopt leading public cloud platforms such as Amazon Web Ser…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Suggested Courses

872 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question