cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
230
Views
0
Helpful
1
Replies

VPN3k and inter-spoke communication - Need official Cisco position

m.laporta
Level 1
Level 1

Hi Experts.

Will a Cisco VPN3k in the headend of a hub-and-spoke IPSEC network be able to route packets between spokes?

In the spokes I have Cisco Pix Firewalls.

Thank you

michele

1 Accepted Solution

Accepted Solutions

gfullage
Cisco Employee
Cisco Employee

Yes, provided that each spoke's subnet is included in the network lists sent to each other spoke. Remember that the PIX will only forward traffic over the tunnel that matches its crypto access-list, so this ACL has to include the subnets behind each other PIX. Consequently, the ACL's on the 3000 have to include all of these networks as the local network.

This is quite easy to do if you set up your spoke networks correctly. A good way to do this is make sure each spoke subnet is say, a subnet of 10.0.0.0/8. So spoke A is 10.1.1.0/24, spoke B is 10.2.2.0/24, spoke C is 10.3.3.0/24, etc.

Then your PIX ACL for spoke A just has to be:

access-list ipsec permit ip 10.1.1.0 255.255.255.0 10.0.0.0 255.0.0.0

PIX ACL for spoke B just has to be:

access-list ipsec permit ip 10.2.2.0 255.255.255.0 10.0.0.0 255.0.0.0

You then just have the reverse on the 3000 and everything get's routed accordingly.

View solution in original post

1 Reply 1

gfullage
Cisco Employee
Cisco Employee

Yes, provided that each spoke's subnet is included in the network lists sent to each other spoke. Remember that the PIX will only forward traffic over the tunnel that matches its crypto access-list, so this ACL has to include the subnets behind each other PIX. Consequently, the ACL's on the 3000 have to include all of these networks as the local network.

This is quite easy to do if you set up your spoke networks correctly. A good way to do this is make sure each spoke subnet is say, a subnet of 10.0.0.0/8. So spoke A is 10.1.1.0/24, spoke B is 10.2.2.0/24, spoke C is 10.3.3.0/24, etc.

Then your PIX ACL for spoke A just has to be:

access-list ipsec permit ip 10.1.1.0 255.255.255.0 10.0.0.0 255.0.0.0

PIX ACL for spoke B just has to be:

access-list ipsec permit ip 10.2.2.0 255.255.255.0 10.0.0.0 255.0.0.0

You then just have the reverse on the 3000 and everything get's routed accordingly.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: