Changing network IP address scheme - Newbie here

[bobbybryant]

We have a client that we are going to create a VPN between our 2 offices through PIX firewalls. Their PIX is already set up for their use, but we need to change their network address scheme prior to setting up the vpn. We need to change the ip's on all machines and anything else in about 1.5 hours (we could take longer, but the network should not be down from the Internet > 1.5 hrs). Can someone point me in the right direction for what changes to look for in their current config to ease the process? Any suggestions will be appreciated. I am new with PIX's, so I'm not sure where to find the info I need. Thanks.

 

[melowery]

Kind of a vague description...

Why are you changing their IP scheme?

When you say they arlready are setup for vpn, are you talking about accepting connections from vpn clients, or site-site vpns?

Are you just wanting to know how to change the IP on the PIX?

Thanks,
Michael

 

[bobbybryant]

They are using an ip scheme that is included in our network. That is why we are changing. When I said the pix is set up for their use, that is b/c there is not a vpn currently set up. That is our goal after changing their ip scheme. So, initially, we will change their ip scheme and make pix changes to allow their network to work as it currently does now. Then, after that is set up, we can tackle the VPN. Hope that helps! Any more suggestions will be appreciated.

 

[308win]

Depending on the number of devices with static ip configuration, changing your scheme is pretty easy. Plan on doing it over the weekend. Someone should be at that remote site that has access to every device.
During the period prior to the change, shorten your DHCP lease interval down to less than a day, so that every machine using DHCP will be expired come that weekend. Then on the weekend of the change, modify the static hosts, change the firewall, change the DHCP scope, modify the internal DNS. Pretty quick and painless if you only have a few static devices. The major catch will be if they are using hard coded IP address for any applications/configurations. If they do, you are in for some anguish.


There is a way to have overlapping subnets, but things might get more complicated doing that way.

http://www.cisco.com/en/US/customer...s_configuration_example09186a00800949f1.shtml