Re: Pix to Pix VPN IPSec w/ PAT

[John Adams <jna () retina net>]

On Sun, 23 Mar 2003, Paul Matuszewski wrote:

> Hey all.. newbie to the list here.. but I have a question for you all.
>
> I've looked everywhere, and my cisco rep has yet to get back to me..
>
> Is it possible to perform a CISCO pix501 to pix501 VPN w/ IPSec while still
> utilizing PAT.  The scenario is = Business Cable Modem to Business Cable
> Modem... thoughts?

If you mean running a PAT to the outside world while maintaining the 
internal (RFC1918) addressing between the two locations, this is 
entirely possible. 

Let's say the two networks are 10.20.1.0 and 10.10.1.0:

Location 1) (the one with the 10.60.1.0 network) 

# first create the access lists for the VPN:
access-list 10 permit ip 10.20.1.0 255.255.255.0 10.10.1.0 255.255.255.0 

# You'll have to ensure that you're not natting users through the VPN:
access-list nonat permit ip 10.20.1.0 255.255.255.0 10.10.1.0 255.255.255.0 

# Set up your PAT (replace x.x.x.x with your outside PAT address)
global (outside) 1 x.x.x.x
nat (inside) 0 access-list nonat
nat (inside) 1 0.0.0.0 0.0.0.0 0 0

# build your vpn, replace y.y.y.y with your peer's address

crypto ipsec transform-set regular esp-des esp-sha-hmac 
crypto map VPN 10 ipsec-isakmp
crypto map VPN 10 match address 10
crypto map VPN 10 set peer y.y.y.y
crypto map VPN 10 set transform-set regular
isakmp key <your key goes here> address y.y.y.y netmask 255.255.255.255 
isakmp identity address
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash sha
isakmp policy 10 group 1
sysopt connection permit-ipsec

# always apply the maps last. 
isakmp enable outside
crypto map VPN interface outside

Now, invert the access lists for the remote site, and it'll work. 

-john

-- 
J. Adams                                        http://www.retina.net/~jna

The secret of knowing where you are, is knowing what time it is. -- Anonymous



_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards