Routing to multiple networks over ipsec tunnel with pix 501
I have a cisco pix 501 with a vpn setup between networks 192.168.210.0 (local) and 192.168.200.0 (remote). This works fine. But more networks than 192.168.200.0 exist on the remote end, there are also 10.10.10.0 192.168.33.0 and 172.16.20.0. Is it possible to set up routing so that I can route to these other subnets with just one VPN tunnel? Here is the important vpn stuff in my pix config:
access-list inside_access_in permit icmp any any
access-list inside_access_in permit ip any any
access-list outside_access_in permit icmp any any
access-list nonat permit ip 192.168.210.0 255.255.255.0 192.168.200.0 255.255.254.0
access-list ipsec_traffic permit ip 192.168.210.0 255.255.255.0 192.168.200.0 255.255.254.0
Re: Routing to multiple networks over ipsec tunnel with pix 501
I had tried this before with no luck. It seems as though it should work...maybe I configured it wrong. I'll try it again. Would I need to add a corresponding:
pdm location 192.168.200.0 255.255.254.0 outside
line for the other networks? I seem to have needed this for the vpn to work. Another concern I have is that I think this would work no problem if the VPN on the remote end was set up the same way as the pix. But it is set up as a tunnel interface on the 3600 router. It seems like maybe this is hosing me. Thanks though, I'll try again.
local crypto endpt.: x.x.x.x, remote crypto endpt.: x.x.x.x
path mtu 1500, ipsec overhead 0, media mtu 1500
current outbound spi: 0
inbound esp sas:
inbound ah sas:
inbound pcp sas:
outbound esp sas:
outbound ah sas:
outbound pcp sas:
So it is definately trying to protect the right traffic...it just isn't successful in creating an sa.
oops, I just realized it was a different pix that I was trying to get to work. That is why the subnets look different from my first post. This is what I got on the other one as well, when trying to add another subnet to the VPN. This particular pix is actually connection to a smoothwall firewall. The VPN works great but only with one subnet. Is there a way to set up this multiple routing with a smoothwall, since you can't set it up with a crypto map.
BenefitsDocumentationPrerequisiteImage Download LinksLimitationsSupported PlatformsLicense RequirementsTopologyStep-By-Step ConfigurationConfigure Virtual ServiceActivate the virtual service and configure guest IPsConfiguring UTD (Service Plane)Configurin...
Login to the FXOS chassis manager.
Direct your browser to https://hostname/, and log-in using the user-name and password.
Go to Help > About and check the current version:
Check the current version availa...
We have configured the outside and inside Interface with official ipv6 adresses, set a default route on outside Interface to our router, we also have definied a rule , which also gets hits, to permit tcp from inside Interface to any6.
In Syslog I also se...