cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
454
Views
0
Helpful
5
Replies

lan-2-lan vpn via inside interface

peter2904
Level 1
Level 1

Hi

Is it possible to have a lan-2-lan VPN via the inside interface - PIX 525 running 6.3.5

Reason is we have 2 primary sites and need to have some traffic between the DMZ's. If possible it would allow traffic between the DMZ's via our internal network.

thanks

Peter

5 Replies 5

Kamal Malhotra
Cisco Employee
Cisco Employee

Hi,

The requirement is not very clear.

Kamal

kaachary
Cisco Employee
Cisco Employee

Hi..

Sure you can have VPN via inside interface. The configuration would be very similar to the "outside" vpn . Few changes in crypto would be like :

isakmp enable inside

cry map interface inside

and few changes in nat statements :

nat (dmz) 0 access-list X

HTH,

-Kanishka

Hi Kanishka

Thanks for the info. Think I may have the NAT wrong as the VPN did not try to establish. But then does 'NAT 0' work from a DMZ to inside interface? Thought NAT 0 was only for traffic going the other way?

Hi,

Nat 0 works bidirectionally. So, if you have

nat (dmz) 0 access-list X

It would work for traffic going to inside as well as for traffic going to outside interface. So, the VPN traffic entering the FW from DMZ and going to inside n/w needs to have a Nat (dmz) 0 or a static .

HTH,

-Kanishka

Thanks Kanishka. I will give it a go.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: