pix 515 to 502

[jimbuddy]

I know this can be done quite easily but not sure were to start, so here goes

515 at office
501 at residence

currently connecting thru cisco vpn os from the 501 to the 515 using secure tunnel. and then using pcanywhere to navigate to individual workstation. this works well most of the time but, there has to be something better.

any thoughts

 

[lgarner]

What are you trying to improve? VPN gives you a sort of WAN connection to the office, from there you should be able to run any network apps. It'll be slower, of course, than sitting on the LAN.

 

[jimbuddy]

Agree, but was curios if i could create a dedicated session were the 501 is always connected to the 515. like a remote office thats always available. users connect using clientA-E .


(pix 515 office below)

PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password KsMfeMXmQf6fOZNS encrypted
passwd 4BTB54tWpUIXn3Z/ encrypted
hostname pixfirewall
domain-name myname.com
clock timezone CST -6
clock summer-time CDT recurrin
fixup protocol dns maximum-length 512
fixup protocol ftp 2
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 192.168.100.0 Inside_Network
access-list inside_outbound_nat0_acl permit ip Inside_Network 255.255.255.0 192.
168.101.0 255.255.255.248
access-list inside_outbound_nat0_acl permit ip host 192.168.100.1 10.10.0.0 255.
255.255.252
access-list inside_outbound_nat0_acl permit ip host 192.168.100.21 10.10.0.0 255
.255.255.252
access-list inside_outbound_nat0_acl permit ip host 192.168.100.41 10.10.0.4 255
.255.255.252
access-list inside_outbound_nat0_acl permit ip host 192.168.100.40 10.10.0.8 255
.255.255.252
access-list inside_outbound_nat0_acl permit ip host 192.168.100.26 10.10.0.12 25
5.255.255.252
access-list inside_outbound_nat0_acl permit ip host 192.168.100.24 10.10.0.16 25
5.255.255.252
access-list inside_outbound_nat0_acl permit ip host 192.168.100.1 192.168.102.0
255.255.255.0
access-list in_bound permit icmp any any echo-reply
access-list myname_splitTunnelAclA permit ip host 192.168.100.1 10.10.0.0 255.
255.255.252
access-list myname_splitTunnelAclA permit ip host 192.168.100.21 10.10.0.0 255
.255.255.252
access-list myname_splitTunnelAclB permit ip host 192.168.100.41 10.10.0.4 255
.255.255
access-list myname_splitTunnelAclC permit ip host 192.168.100.40 10.10.0.8 255
.255.255.252
access-list myname_splitTunnelAclD permit ip host 192.168.100.26 10.10.0.12 25
5.255.255.252
access-list myname_splitTunnelAclE permit ip host 192.168.100.24 10.10.0.16 25
5.255.255.252
pager lines 24
logging on
logging monitor debugging
logging buffered debugging
logging trap debugging
logging host inside 192.168.100.21
mtu outside 1500
mtu inside 1500
ip address outside x.x.x.x 255.255.255.192
ip address inside 192.168.100.8 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool ciscovpn 192.168.101.2-192.168.101.6
ip local pool pptp 192.168.102.2-192.168.102.6
ip local pool clientsA 10.10.0.1-10.10.0.2
ip local pool clientsB 10.10.0.5-10.10.0.6
ip local pool clientsC 10.10.0.9-10.10.0.10
ip local pool clientsD 10.10.0.13-10.10.0.14
ip local pool clientsE 10.10.0.17-10.10.0.18
pdm location 192.168.100.1 255.255.255.255 inside
pdm location 192.168.100.21 255.255.255.255 inside
pdm location 192.168.100.24 255.255.255.255 inside
pdm location 192.168.100.26 255.255.255.255 inside
pdm location 192.168.100.40 255.255.255.255 inside
pdm location 68.156.76.10 255.255.255.255 outside
pdm location 192.168.102.0 255.255.255.248 outside
pdm location 192.168.101.0 255.255.255.248 outside
pdm location 68.156.76.11 255.255.255.255 outside
pdm location 68.156.76.1 255.255.255.255 outside
pdm location 192.168.100.41 255.255.255.255 inside
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 Inside_Network 255.255.255.0 0 0
apply (inside) 11 outgoing_src
route outside 0.0.0.0 0.0.0.0 68.156.79.65 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http 68.156.76.10 255.255.255.255 outside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
sysopt connection permit-pptp
sysopt connection permit-l2tp
crypto ipsec transform-set strong esp-3des esp-md5-hmac
crypto dynamic-map remote 20 set transform-set strong
crypto dynamic-map remote 40 set transform-set strong
crypto dynamic-map remote 60 set transform-set strong
crypto map remoteusers 20 ipsec-isakmp dynamic remote
crypto map remoteusers interface o
isakmp enable outside
isakmp identity address
isakmp nat-traversal 20
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
vpngroup myname idle-time 1800
vpngroup mynameA address-pool clientsA
vpngroup mynameA dns-server 68.156.77.5 68.156.77.6
vpngroup mynameA default-domain myname.com
vpngroup mynameA split-tunnel myname_splitTunnelAclA
vpngroup mynameA idle-time 1800
vpngroup mynameA password ********
vpngroup mynameB address-pool clientsB
vpngroup mynameB dns-server 68.156.77.5 68.156.77.6
vpngroup mynameB default-domain myname.com
vpngroup mynameB split-tunnel myname_splitTunnelAclB
vpngroup mynameB idle-time 1800
vpngroup mynameB password ********
vpngroup mynameC address-pool clientsC
vpngroup mynameC dns-server 68.156.77.5 68.156.77.6
vpngroup mynameC default-domain myname.com
vpngroup mynameC split-tunnel myname_splitTunnelAclC
vpngroup mynameC idle-time 1800
vpngroup mynameC password ********
vpngroup mynameD address-pool clientsD
vpngroup mynameD dns-server 68.156.77.5 68.156.77.6
vpngroup mynameD default-domain myname.com
vpngroup mynameD split-tunnel myname_splitTunnelAclD
vpngroup mynameD idle-time 1800
vpngroup mynameD password ********
vpngroup mynameE address-pool clientsE
vpngroup mynameE dns-server 68.156.77.5 68.156.77.6
vpngroup mynameE default-domain myname.com
vpngroup mynameE split-tunnel myname_splitTunnelAclE
vpngroup mynameE idle-time 1800
vpngroup mynameE password ********
telnet Inside_Network 255.255.255.0 inside
telnet 192.168.100.21 255.255.255.255 inside
telnet 192.168.100.8 255.255.255.255 inside
telnet timeout 5
ssh timeout 15
console timeout 0
vpdn group PPTP-VPDN-GROUP accept dialin pptp
vpdn group PPTP-VPDN-GROUP ppp authentication pap
vpdn group PPTP-VPDN-GROUP ppp authentication chap
vpdn group PPTP-VPDN-GROUP ppp authentication mschap
vpdn group PPTP-VPDN-GROUP ppp encryption mppe auto
vpdn group PPTP-VPDN-GROUP client configuration address local pptp
vpdn group PPTP-VPDN-GROUP client configuration dns 68.156.77.5 68.156.77.6
vpdn group PPTP-VPDN-GROUP pptp echo 60
vpdn group PPTP-VPDN-GROUP client authentication local
vpdn enable outside
dhcpd address 192.168.100.150-192.168.100.200 inside
dhcpd dns 68.156.77.5 68.156.77.6
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd domain myname.com
dhcpd auto_config outside
dhcpd enable inside
terminal width 80
Cryptochecksum:6da45ba214aecb46e6d638a2ad02d9c4
: end
[OK]
pixfirewall(config)#