Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

Pix to Multiple IOS VPN (IOS get IP by DHCP

I have a central Pix and 3 sites that are expanding to 10 I want to have Spoke to Spoke communication. The PIX is running 7.0. Since the Pix doesn't support DMVPN how can I enable Spoke to Spoke effectively since the Spokes are doing DHCP for their outside interface address. I see lots of examples where for static tunnels but none for dynamic crypto maps.

5 REPLIES
New Member

Re: Pix to Multiple IOS VPN (IOS get IP by DHCP

You are correct about the spoke to spoke limitations in your current design. The two ways around this issue is to move your VPN to something that can do this (Such as a VPN concentrator, or IOS router), or implement a full mesh topology). The problem with a full mess topology, is your dynamic IPs. For IPSec to work, it has to negotiate tunnel settings, etc. The router has to have some way of knowing what the other end of the tunnel is. For this reason you must have one end of the tunnel have a static IP (Likely the reason you were doing a hub and spoke architecture anyway).

Unfortunately, I don't see any way around changing your VPN device at the central site to something other than a PIX.

Silver

Re: Pix to Multiple IOS VPN (IOS get IP by DHCP

You could setup a mix of ezVPN (for the spoke-hub traffic) and static tunnels (for the spoke-spoke traffic) where the static tunnels use Real-Time Resolution for IPSec Peers:

http://www.cisco.com/en/US/products/ps6350/products_configuration_guide_chapter09186a0080455b05.html

You should take care to let the DNS-resolution be done by you central DNS-server (maybe using the dyndns-faeture of the IOs-routers) to avoid any spoofing/hijacking attempts..:

http://www.cisco.com/en/US/products/ps6350/products_command_reference_chapter09186a00804461ba.html#wp1105531

Did it help?

New Member

Re: Pix to Multiple IOS VPN (IOS get IP by DHCP

So am I correct in thinking that I can have the IOS routers register in DNS using DDNS and then have the PIX resolve their IP address from DNS as a way to get around the non static IP addresses?

New Member

Re: Pix to Multiple IOS VPN (IOS get IP by DHCP

From the PIX perspective, nothing would change, hub and spoke only. But it sounds like with the prior hyperlinks, you could set up a FULL MESH of tunnels between all your remote routers to accomplish what you are looking for with a combination of dynamic dns, and dynamic resolution of peers as previously posted.

You take care with this solution, as each time you add a remote you must modify the configs of every remote and the central site to keep spoke to spoke communications working. Full mesh topologies require lots of management overhead.

Silver

Re: Pix to Multiple IOS VPN (IOS get IP by DHCP

Hi again,

The hub-spoke traffic will not change, it will still be using easy VPN which will always be initiated by the remote sites to get into your PIX.

The spoke-spoke traffic will be a full mesh setup where every router then has 9 tunnels configured, one to each of the other spokes (a total of 10 spokes which you mentioned). You should at least run a routing-protocol over this of course.

The PIX will never do any resolving (as it doesn't have the option to do this in this context yet).

Did it help? If so, please rate the relevant posts.

130
Views
0
Helpful
5
Replies
CreatePlease to create content