I'm not sure if I understood your requirement correctly so please confirm if what I understood is correct or not.
We want that all the traffic originating from behind the remote PIX 501 should go through the tunnel. If that is the requirement then whether this can be done or not would depend on the device we are establishing the tunnel with. What does the PIX 501 establish VPN with? If it is a PIX and running 6.x then it is possible only in one condition : we MUST have a proxy server behind the central site that can do proxy for the remote networks. If it is a router, concentrator, ASA or PIX v7 then it is a different implementation on all the devices.
But one thing is for sure if you have a router, concentrator, ASA or PIX v7 then the crypto ACL on the remote PIX should be something like :
access-list vpn permit ip any
and on the central device it should be the reflection.
If the Internet Gateway for both the PIX 501 is the remote PIX FW, then the no nat ACL would be something like this :
access-list nonat permit ip any any
nat (inside) 0 access-list nonat
This way all the traffic from the PIX 501 LAN subnets will not be natted and will be sent through the tunnel to the remote PIX and then to Internet.
*Please rate if helped.
-Kanishka
Getting Started
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:
