VPN Question

[minoad]

I have a PIX-501 Firewall version 6.3(3) Device Manager version 3.0(1) with licsence features VPN-DES enabled and VPN-3DES-AES enabled.
I would like to turn this device into a VPN server provideing service to remote users through a software client and am looking for any documentation on how this could be done.

Thanks

Micah A. Norman

 

[vtgman]

Here are the commands I used and it works great.

names

access-list inside_outbound_nat0_acl permit ip any 172.17.2.0 255.255.255.0
access-list outside_cryptomap_dyn_20 permit ip any 172.17.2.0 255.255.255.0

ip local pool VPNpool 172.17.2.1-172.17.2.254
nat (inside) 0 access-list inside_outbound_nat0_acl


sysopt connection permit-ipsec
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map client authentication LOCAL
crypto map outside_map interface outside
isakmp enable outside
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup mygroup address-pool VPNpool
vpngroup mygroup dns-server 192.168.1.50 192.168.1.53
vpngroup mygroup wins-server 192.168.1.50 192.168.1.53
vpngroup mygroup default-domain csi
vpngroup mygroup idle-time 1800
vpngroup mygroup password password

 

[stevenriz]

it looks like you are using a third party program for authentication. Is that true?

 

[minoad]

No. I am trying to keep this completely contained within the pix. I have found tons of information of configuring the client side. but i cannot seem to find much on configureing the vpn server on a PIX 501.

Micah A. Norman

 

[lgarner]

Googling for "cisco pix vpn configuration" gave me

http://www.cisco.com/en/US/products...configuration_guide_book09186a0080172852.html

as the first link. It looks pretty good.

The Pix model isn't important. The FOS is the same on all, subject to license restrictions.

 

[minoad]

I assume that the below statement should contain the IP address of the remote users?
access-list inside_outbound_nat0_acl permit ip any 172.17.2.0 255.255.255.0

What if the users are not on any particular subnet. I tried this with the "permit any any" and have had no luck with that