Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

PIX VPN , Win2K, Active Directory---Where to start?

Hi Everyone.

I am a waiting the arrival of a PIX 515 and 501 for firewalling and creating VPN between my main site and a remote location. The remote location is having a LAN installed but will not have an actual Win2k domian while the main site is a full win2k domain with exchange and AD. Both site will connect to the INet w/ cable modems.

Here is the question:

Is it possible to have that remote site become part of my main site domain over the VPN? Can I set up a server at the remote site to replicate AD to in case the VPN is shut down for any reason. Do I need to open any ports on the firewall or not because it will be over a VPN?

Is this an easy thing to do? Is a newbie in over his head?

Thanks in advance for any advice.

Marc

1 ACCEPTED SOLUTION

Accepted Solutions
Silver

Re: PIX VPN , Win2K, Active Directory---Where to start?

No routers needed - basically, everything will be static routed - your clients, regardless of site, will have the pix as their default gateway. each pix will have a default gateway configured too, by you, by a "route" statement. Each pix's crypto ACLs will also act as a static route through the tunnel to the other pix

6 REPLIES
Silver

Re: PIX VPN , Win2K, Active Directory---Where to start?

1. Yes it is possible to have that remote site become part of your main site domain

2. yes you can have a AD DC at the remote site - in fact it is recommended.

3. No ports to open - when you set up the point to point tunnel, there should be unfettered access via the encrypted tunnel between the two networks.

4. It is not too painful

5. Nah

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a0080094761.shtml

Should walk you through it. You will want to use isakmp, and use pre shared keys.

Community Member

Re: PIX VPN , Win2K, Active Directory---Where to start?

Thanks mostiguy, that article is great. That will definitly get me on the right path. What do I need to do set up the DC at the remote site? Just a normally joined to the domain DC? Once I set that up how do i get the replication going? Do the two LANs have to addressed the same? Can I use the DHCP server in my main site to address the LAN at the remote site?

This is one area where I have no experience, thanks again for you advice!!

Silver

Re: PIX VPN , Win2K, Active Directory---Where to start?

Basically, you could create the DC at your main site, and drive it over. Or, on any win2k server that is a member of the domain, you could run DCPROMO to make it a DC. There is nothing exotic about it - you will want to read up on AD sites however - sites are a replication construct. I believe AD replication will be setup automagically for you.

The sites will not be addressed the same - they will effictively act as separate subnets with a router between them. FOr setting up the point to point tunnel, it is pretty much imperative that you properly address the sites separately.

So, you will want the remote site to be, say, 192.168.1.0/24, and the main site to be 192.168.0.0/24. This way, routing will work properly - effectively, when your hosts on the 192.168.0.0 network send packets to its default gateway (probably the pix in your scenario), the pix knows to forward them, they need to be sent through the ipsec tunnel.

AD sites are based on IP netblocks to - when they are properly setup, your clients on 192.168.1.0/24 (remote site) will know that remote.AD.DC.servernamehere is its local DC, and will authentication against that, before trying to authenticate against a DC across the VPN (wasting bandwidth).

I would set up the remote DC, or the PIX as the DHCP server. I would strongly recommend using the remote DC so you can properly implement dynamic DNS. I would also setup wins, and replication between the two DCs for it, to ensure that Network Neighborhood is properly populated for all hosts.

Community Member

Re: PIX VPN , Win2K, Active Directory---Where to start?

Mostiguy,

Looks like I have my work cut out for me then. This is exactly the direction I am looking for.

I think I will start by re-addressing my network, as it was addressed with 128.100.0.0 class B for some reason before I got here. As I just started my CCNA studying, I am still weak in subnetting and addressing but this will give me some good practice.

One question though, do I need a router on each network or can I get away with the PIX doing the 'routing' on each network? Thanks again for all the help!

Marc

Silver

Re: PIX VPN , Win2K, Active Directory---Where to start?

No routers needed - basically, everything will be static routed - your clients, regardless of site, will have the pix as their default gateway. each pix will have a default gateway configured too, by you, by a "route" statement. Each pix's crypto ACLs will also act as a static route through the tunnel to the other pix

Community Member

Re: PIX VPN , Win2K, Active Directory---Where to start?

Thanks,

Well now I am mix of excited and scared sh*@less. I will just do one thing at a time, as I have no real way of testing this before deployment. I think I will get the PIXes up and running as firewalls, then configure the VPN then work on the AD part. I still hope I am not biting off more then I can chew ! LOL. Thanks again, marc

117
Views
5
Helpful
6
Replies
CreatePlease to create content