I have a 2621 connecting my company to the net. It currently statically routes all traffic to the main server that controls web filtering etc. I also have a 1841 that I want to set up as a VPN server and a site to site tunnel to our cloud off site backup.
The topology is as follows;
Static route from outside interface on 2621 to 10.0.0.2
Internet ----- 216.x.x.x -- 2621—10.0.0.254 -- 10.0.0.2—Server—192.168.1.2—LAN
Would it be better to place the VPN inside the network and forward all VPN traffic from the 2621 to it or simply replace the 2621? Are there any benefits to doing it either way?
I tried to get the VPN router to work in place of the 2621 and could connect to it but could not ping inside the network. I think it had to do with the address pool which I had set the same as the internal LAN – 192.168.1.x. I have read that the pool should be different from the LAN addresses…
I am not sure how to proceed! Any advice would be greatly appreciated.
Replacing the 2621 with the 1841 has a couple of benefits:
1) your setup is less complex and easier to maintain and configure
2) the 1841 still gets software-updates. I wouldn't keep a device directly connected to the internet if there are no updates for the device any more. But for this I'm probably more paranoid then the average admin ... ;-)
3) only one single point of failure instead of two when looking at your VPN-clients.
For your LAN-pool: It's perfectly ok to take an unused range from your inside LAN. That makes the routing much easier if VPNs and Internet-traffic is handled by different devices. But with a dedicated Pool you are much more flexible so that's the way which is most often recommended.
If you feel comfortable with that setup, just keep it that way. I personally don't like to send all traffic through a server as that limits the flexibility. You could get the same with a proxy in the subnet and WCCP which transparently redirects the traffic to the proxy. But nevertheless, the setup is nothing that is harmfull.
Login to the FXOS chassis manager.
Direct your browser to https://hostname/, and log-in using the user-name and password.
Go to Help > About and check the current version:
Check the current version availa...
We have configured the outside and inside Interface with official ipv6 adresses, set a default route on outside Interface to our router, we also have definied a rule , which also gets hits, to permit tcp from inside Interface to any6.
In Syslog I also se...