Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

Can a PIX 501 handle both static and dynamic VPN at the same time?

I have a PIX 501 that is currently configured with a static IPSec tunnel to another remote site. This tunnel is verified as working properly. What I'd like to do is add VPN server functionality for me to remotely access the network. The configuration examples I've seen all included creating a dynamic crypto map...but since a static one is already in place, this poses a problem as only a single crypto map statement is allowed on an interface (unless I'm mistaken?). Anyone know an easy way around this?

Thanks,

Sean

3 REPLIES

Re: Can a PIX 501 handle both static and dynamic VPN at the same

Sean,

You can have multip[le crypto maps on an interface - they have differnet sequence numbers.

HTH>

Community Member

Re: Can a PIX 501 handle both static and dynamic VPN at the same

You can only have one crypto map applied to an interface, but you can have multiple static IPSec tunnels because the crypto maps have sequence numbers. So, what you have to do is use the same crypto map that is already in place, but add another instance of that crypto map with a different sequence number.

For example you have:

crypto map yourmap 10....

You just add:

crypto map yourmap 20....

If you want to add another static IPSec tunnel, then you continue:

crypto map yourmap 30...

Hope this helps.

Hall of Fame Super Blue

Re: Can a PIX 501 handle both static and dynamic VPN at the same

Sean

Yes you can run both dynamic and static, remote access and site-to-site VPN's on the same pix.

As already stated you have one crypto map but you can have multiple entries. All the configs i have used and seen make the dynamic crypto a higher index number than statically defined entries.

Jon

151
Views
0
Helpful
3
Replies
CreatePlease to create content