The configuration is a monster, I have a site-to-site vpn tunnel set up with IPSEC, group 20, etc, and client vpn running from the internet. Debug crypto isakmp on the pix outputs produce nothing, I'm sniffing between my wireless network access point and the PIX and getting ICMP Port unreachables, so I don't have something right. The client tries 3 times, logs the attemtps, and says the peer didn't respond (this is a laptop, cisco aironet 350 card, etc).
I'm doing encryption and authentication, in fact with RADIUS on the wireless devices. WEP isn't secure enough, and we are in a busy office area where people like to snoop around. I also have a linux device in the middle (a router, iptables, etc.) that only allows trusted MAC addresses, and does some tricks with DHCP and DNS, and allows me to sniff the traffic on wires. That way if someone associates, just to peek, I will know it in seconds. Heh heh. It's all a pilot project, anyway.
There are lots of philosophical approaches to wireless, so there's lots to discuss. I'd like to keep the config the same so my roaming employees with laptops can use the Cisco client to connect from home the same way in the office (same methodology). Many are already using wireless devices on their home net, passing through an AP/Router with NAT, and doing IPsec into our network. (many = a dozen).
I'm curious about doing transport mode on an interface while maintaining the non-transport mode on the other interfaces. Possible? Then Microsoft VPN clients might work, but I unfortunately don't have a good test bed. That's right folks, we're playing on the production boxes, so I'm treading lightly.
The wireless devices are PocketPC 2002 devices, with 802.11b and ethernet (yes, wired) interfaces (CF cards we pop in and out, depending on where they are at--ethernet means inside the network, wireless means AP outside the firewall on it's own inteface and someday VPN back in). I'm using MovianVPN and it works like a charm--just like the Cisco VPN client on Windows in fact. Cost is a little heavy ($50 USD), but I'm inside the network pulling up intranet applications, etc just like I'm hard wired in. Yes, it handles the RADIUS request and prompts username and password as well. I'm quite impressed with it. My understanding is MovianVPN is available for Palm devices as well, but we've been slowly moving away from Palms because the raw functionality of PocketPCs is so great.
In the not-too-distant future, we'll be doing PDA with bluetooth to bluetooth data cellular phones (like a t-mobile or AT&T SonyEricsson T68i)--hopefully our US carriers will catch up with performance. I might be experimenting with wired phones (adapter cable to SprintPCS phone), but 16kbps throughput is pretty painful. Right now I'm using public access points (the local coffee shop) to VPN in.
I'll see what I can job out of the config and post it on Monday. I'm definitely curious what I'm missing.
