Wireless Access Point in DMZ - then connect to VPN 1

[u080570]

I am setting up a wireless network - I am using Cisco Aironet access points placed in our DMZ. My goal is to have my mobile users connect to these access points then use their Cisco VPN clients to connect to our VPN for internal network access.

I have everything working except the last step...my users can connect to the access points, they can get to the internet....I cant get them to connect to the VPN.

I think the problem is the wireless users are being NATed to an address that is on the same network as the VPN connection (they can connect to VPN connection at my other locations - different networks - with no problem).

Im missing something in my VPN connection settings on my firewall - but I havent been able to figure out what...

Any suggestions what to look for?

Thanks,
MM

 

[horus42]

As I see it you can make it work, I have configured something similar for my home network and I don't see why this shouldn't work, I would do the following;

I would setup the AP to be in the DMZ just like you and make sure this segment uses unique IP block.

I would then configure the PIX for VPN client and make sure I enable that on the DMZ interface, I would also make sure that I create unique DHCP pool for the VPN client users, I would then make sure all the NAT and access rules allow users to access the network..


Hope that helps.

 

[Supergrrover]

Without seeing the config - If you have your VPN already working from the outside, all you should need to add is

isakmp enable dmz
and make sure that they are connecting to the interface IP on the DMZ.


Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[u080570]

Thanks guys!!! I got it working....I didnt have IKE enabled on my DMZ interface - that was all I needed...

Thanks again!
MM