IPSec VPN termination question

[scottdware]

Hello to all.

I am in the process of designing a new DMZ that will go into place in a new facility that our company is building. This facility will act as our "headquarters".

I plan on setting up IPSec VPN tunnels between our HQ and our 4 remote offices. Now, I have so far planned on having in the HQ:

2651XM for the T1 coming in from the Internet. A PIX 515E as the firewall.

So, my question is where should I have the IPSec VPN tunnels terminate? On the router (2651) or on the PIX. And if I have them terminate on the router (2651), then do I just need static routes in the router (2651) forwarding the remote office subnets to the pix's outside address (public), and access-lists on the pix permitting the remote offices' subnets.

Sorry if this sounds stupid, but I have never really setup a DMZ before from scratch by myself. Thanks

 

[lgarner]

I'd definitely terminate on the Pix- that's one of things that it's good at. Then, just have the default route on the 2651 point to the Pix inside interface and you should be set.

 

[scottdware]

By saying the default route on the 2651, do you mean the default route for all of the remote office subnets.

Say for instance:

remote office 1, subnet 192.168.6.0/24

2651 - ip route 192.168.6.0 10.1.1.1 1 <- (say 10.1.1.1 is the inside address of the pix)

and do that for each of the remote office subnets?

 

[lgarner]

Actually the *default* route is all that's needed:
&quot;ip route 0.0.0.0 0.0.0.0 10.1.1.1&quot;.

Part of the Pix setup is to exempt the VPN-reachable networs from NAT, and to send them out via the tunnel. This way, the Pix decides which addresses to tunnel and which to simply send out to the internet. The 2651 doesn't have to deal with that.

 

[scottdware]

I see. The default route on my pix would be the ip address (public) of my 2651 right? Assuming that both the serial interface (to the internet) obviously has a public ip, and also the ethernet interface of the 2651, which would also have a public ip...(along with the outside interface of the pix)

 

[lgarner]

Ah, I misread your second question. It makes just a little change in my answer, though. Since &quot;public&quot; can be confusing, I'll refer to the interfaces as &quot;inside&quot; and &quot;outside&quot;.

The Pix default route would be to the inside address of your router. 2651's inside address, and the Pix outside address, would be public and in the range assigned by your ISP.

So the routing is:

workstations: default route to the Pix
Pix: default route to the 2651
2651: default route to the ISP

 

[scottdware]

Great! The workstations however, will be on seperate VLAN's, so I plan on setting the default route of the workstations to the address of the Layer 3 switch, and in turn, the default route of the L3 switch to the pix's inside address.

Thanks alot for your help!