Hub-Spoke IPSEC

[mounir.mohamed]

Dear All,

I have centeral Firewall (PIX535) in HQ peering via IPSEC tunnles with other 3 branches, all branches using Cisco 1700 with IOS feature set currently there is IPSEC tunnel between each branch and HQ FW, i need to configure the centeral FW to doing routing between all branches, so if branch x need to communicate with branch y it should establish it's IPSEC with HQ, then the HQ using the incoming traffic to initiate IPSEC tunnel with y (if idel) then routed the traffic between both branches.

Mainly i need to do Hub-Spoke IPSEC tunnels due to lack of hardware in the remote branches routers.

Is that allowed, If yes kindly advice.

--

Best Reagrds,

Mounir Mohamed

[attrgautam]

Use PIX Software ver 7 on the 535 and allow the traffic that comes in through an interface to go out through the same interface.

http://cisco.com/en/US/products/ps6120/products_tech_note09186a0080734db7.shtml

[mounir.mohamed]

Dear,

Yes,

i found the URL yesterday, thanks :)

[Wilson Samuel]

Hi Munir,

Just to add a short note to your environment, if you are presently using IPSec Direct Encapsulation (traditional IPSec Tunnels), you may encounter issues with respect to Multicasting Applications like Routing Protocols.

If not deployed already, you should consider migration from IPSec Direct Encap to Point to Point GRE over IPSec Tunnels.

Aleternatively you may consider implementing a DMVPN also which can take care of all the issues.

You may like to refer the following link for additional information:

http://www.cisco.com/application/pdf/en/us/guest/netsol/ns171/c649/ccmigration_09186a0080739fd3.pdf

HTH,

Kind Regards,

Wilson Samuel