Many PIX 501's to a VPN3000 or to PIX 515?? what is better?

[jreimer]

I have a scenario where I have multiple (20) remote users at their homes that need a VPN into the home office. I have a PIX 515E and a VPN 3005.

I am thinking that I want to have the remote PIX 501's connect using a "vpnclient" to the VPN 3005. This I cannot get to work smooth. So I'm thinking of using my PIX515 instead for the head end.

Which is better? I thought I would have better user controll with the VPN 3005.

Thanks.

[umedryk]

When you have many dial up users, it is better ( theoretically ) to use concentrator. But, ( I feel ), in your case, there are just 20 remote users, so, there wont be any phenomenol difference that you can observer whether you use concentrator or pix.

[engel]

I will go with VPN3005 as the head-end. We deployed the same topology, the PIX is using v6.3 and the Concentraor is version 3.6.7 . With PIX515 as the head-end, I don`t know if it is capable to terminate hardware client type from the remote sites.

Regards,

Engel

[atdhingr]

You may find you answer here:

Q : Can the Cisco VPN 3002 Hardware Client do a LAN-to-LAN tunnel to any device?

Ans :No, at this time the VPN 3002 Hardware Client can only be used to do tunnel to a VPN 3000 Concentrator (in network extension mode or client mode) and to the PIX Firewall (in client mode, not in network mode). The VPN 3002 Hardware Client cannot terminate connections from VPN Clients (software clients). It cannot connect to any third-party devices at this time.

Ref : http://www.cisco.com/en/US/partner/products/hw/vpndevc/ps2286/products_qanda_item09186a00801c2dc1.shtml