Connect nodes across Cisco Pix and Linksys befvp41 using a VPN

Posted on 2008-10-14
Last Modified: 2012-05-05
Hello everyone, I have two networks, for the time we will just call them network A and network B. Network A is behind a Cisco Pix 515e, and network B is behind a Linksys befvp41 VPN router. The PIX is the VPN server, and the Linksys is connecting to it. I know I have setup the VPN correctly on both ends because when I click connect on the Linksys it says connected, and when I look at the log it says connected sucessfully. My question now is, how would I make a node from network A talk to a node on network B. I have never setup a VPN connection like this before. I have used Microsoft's VPN before and am used to the client getting a local IP address, and a Tunnel IP address as well.
Question by:mdiee
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
LVL 33

Accepted Solution

MikeKane earned 500 total points
ID: 22716130
If you are certain you're VPN is connecting correctly across the public internet,  then you need to setup routing for the internal networks.  

On the pix side, I imagine you have an ACL catching interesting traffic to build the VPN.
The ACL would need to include the subnet of the destination network so that the cryptomap ACL catches it and 'routes' it to the peer (this being the linksys)  

something like:
access-list outside_cryptomap_10 extended permit ip <local ip subnet><local subnet mask> <remote subnet> <remote subnet mask>

That will grab any traffic destined for the remote subnet and send it to the peer.  

On the linksys side, you should find some routing info in the GUI, but I'm not certain..... maybe someone else can jump in here for the linksys side.

Author Comment

ID: 22722151
Here is my PIX configuration. I'm setting this up in a test environment, basically I have a PIX and the Linksys connected with a Cisco router in between to seperate the networks (the only reason i say this is because you are going to see some reserved IP ranges for Outisde interfaces.

BackPix# sh run
: Saved
PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password 2KFQnbNIdI.2KYOU encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname BackPix
domain-name MDI
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
access-list 100 permit icmp any any echo-reply
access-list 100 permit icmp any any time-exceeded
access-list 100 permit icmp any any unreachable
access-list 100 permit gre any any
access-list 100 permit icmp any any
access-list no_nat permit ip
access-list befvp41_acl permit ip

access-list 0 permit ip
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside
ip address inside
ip audit info action alarm
ip audit attack action alarm
ip local pool pptp
pdm history enable
arp timeout 14400
nat (inside) 0 access-list no_nat
route outside 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
crypto ipsec transform-set befvp41-set esp-des esp-md5-hmac
crypto map newmap 20 ipsec-isakmp
crypto map newmap 20 match address befvp41_acl
crypto map newmap 20 set peer
crypto map newmap 20 set transform-set befvp41-set
crypto map newmap interface outside
isakmp enable outside
isakmp key ******** address netmask
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 1
isakmp policy 10 lifetime 1000
telnet timeout 5
ssh timeout 5
management-access inside
console timeout 0
vpdn group 1 accept dialin pptp
vpdn group 1 ppp authentication mschap
vpdn group 1 ppp encryption mppe 40
vpdn group 1 client configuration address local pptp
vpdn group 1 client configuration dns
vpdn group 1 pptp echo 60
vpdn group 1 client authentication local
vpdn username admini password *********
vpdn username cfc password *********
vpdn username chuck password *********
vpdn enable outside
terminal width 80
: end

Like I said, when I put all the settings into the Linksys on the VPN tab and click connect it sucessfully connects. I'm just not sure where to go from there to get a device on each side to ping each other using my internal IPs

Author Comment

ID: 22771019
We decided to go a different route, but I award you with the points, MikeKane, for being the only one who replied.

Featured Post

Save the day with this special offer from ATEN!

Save 30% on the CV211 using promo code EXPERTS30 now through April 30th. The ATEN CV211 connects a laptop directly to any server allowing you instant access to perform data maintenance and local operations, for quick troubleshooting, updating, service and repair.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
BGP DUAL ISP with IP SLA 10 42
Network over eigrp 100 topology ? 3 53
Error after upgrade of 3850s 15 51
SSL-VPN Solution 8 16
This is an article about my experiences with remote access to my clients (so that I may serve them) and eventually to my home office system via Radmin Remote Control. I have been using remote access for over 10 years and have been improving my metho…
If you use NetMotion Mobility on your PC and plan to upgrade to Windows 10, it may not work unless you take these steps.
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …

735 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question