PIX DMZ - VPN Question

[uucutech]

Hello There,

I have a quick question that hopefully one of you experts will have an answer to

I have a PIX 515 and have setup one of the interfaces on it for a wireless DMZ. Everything in this regard is working fine. People are able to connect to the WLAN and get out to the internet. I am restricting access to the inside interface of the PIX for security reasons. Here is my problem:

Users can VPN to the PIX from home just fine, but I would like them to be able to VPN through the wireless interface on the PIX to gain access to network resources on the internal network while connected to the WLAN. Is this even possible and does it make sense?

Let me know your thoughts.

Thanks in advance for any comments or suggestions,

Dustin

 

[NetworkGhost]

Are you saying you want an additional VPN termination to the DMZ interface for wireless users? If so, then yes it will work.


Which version OS? 6.x 7.x?

http://www.wr-mem.com

 

[Supergrrover]

Add these lines

isakmp enable dmz
crypto map [map_name] interface dmz

Now just change the destination on the client config and you should be up and running.




Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[uucutech]

Thanks for the replies!

NetworkGhost:

PIX OS v7.0

I just want people on the "wireless" DMZ to be able to VPN into the internal network through the PIX.

Supergrrover:

With your suggestion, if the name of the interface we are talking about is named "wireless" would the following be correct?:

isakmp enable wireless
crypto map [wireless_VPN] interface wireless

Thanks again for the info,

Dustin

 

[Supergrrover]

Yep, that's it.
You basically set everything up just as if you were doing it to the outside interface but then sub in your other interface's name. You can use the same crypto map if all you have is remote access vpn. If you have a site-2-site, then I would create a whole new pair of isakmp and crytpo map settings and apply them to the wireless interfac.


Brent
Systems Engineer / Consultant
CCNP, CCSP