Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

VPN Tunnel to Checkpoint NGX Firewall - Help needed.

Happy New Year to All...

I need to setup the following on my PIX running 6.3 (5) code -

VPN Tunnel to a partner company who is using Checkpoint NGX, now the partner requires that I "hide" my internal IP address when communicating with them and to use a public routable IP address.

My ISP has provided to me a internet routable IP address, say - 213.251.x.x my private network address is 10.x.x.x/24

Basically, my partner requires that when traffic originates from my network they need to see an internet routable IP address rather then my private IP address.

So my question is - How do I configure my PIX for the above VPN requirement?

If you need any further information then please let me know.

I would be most grateful if someone can guide me on this as this is very urgent.

New Member

Re: VPN Tunnel to Checkpoint NGX Firewall - Help needed.

Follow up question(s). Are you given only 1 public IP from your ISP? And are communications to originate from both yourside and their side -- or from one side only?

Hall of Fame Super Blue

Re: VPN Tunnel to Checkpoint NGX Firewall - Help needed.

Are you comfortable with configuring a site-to-site VPN tunnel on a Pix and you just need to know how to NAT your source IP addresses.

Is this firewall just for the VPN connection and is the ISP address (213.251.x.x) allocated to the external interface of your Pix firewall or is it an additional address out of the same subnet range or a different subnet range.

Assuming you are comfortable with basic VPN setup and NAT, in essence you need to make sure that the access-list tied to your crypto map references the Natted address and not your source addresses ie.

if the remote network you were accessing was your crypto map access-list would look like

access-list vpn permit ip host 213.251.x.x

if you need more info let me know


New Member

Re: VPN Tunnel to Checkpoint NGX Firewall - Help needed.

Hi Jon - thanks for the reply,

I have the following setup, does this look OK to you?

access-list nat_to_customer permit ip host 195.172.x.0

access-list crypto_map_customer permit ip host 213.249.x.x 195.172.x.0

ip address outside 213.249.x.x

ip address inside 10.1.x.x

global (outside) 2 213.249.x.x

global (outside) 1 interface

nat (inside) 2 access-list nat_to_customer 0 0

nat (inside) 1 0 0

route outside 213.249.x.x 1

sysopt connection permit-ipsec

crypto ipsec transform-set esp-3des esp-md5-hmac

crypto map testmap 1 ipsec-isakmp

crypto map testmap 1 match address crypto_map_customer

crypto map testmap 1 set peer 81.155.x.x

crypto map testmap 1 set transform-set

crypto map testmap interface outside

isakmp enable outside

isakmp key address 81.155.x.x netmask

isakmp identity address

isakmp policy 10 authentication pre-share

isakmp policy 10 encryption 3des

isakmp policy 10 hash md5

isakmp policy 10 group 2

isakmp policy 10 lifetime 3600

I have seperate IP address allocated to my outside interface for the PIX - from the same IP range, as I have 10 public IP address to play with.

Can you confirm for me if this looks good - this is my first go on setting up VPN tunnel!

Wait to hear from you.

Hall of Fame Super Blue

Re: VPN Tunnel to Checkpoint NGX Firewall - Help needed.

Looks okay to me.

Basically you are allowing one IP address ( to access the remote 195.172.x.0/24 and Natting that client to 213.249.x.x

Have yout tried connecting yet ?

New Member

Re: VPN Tunnel to Checkpoint NGX Firewall - Help needed.

Thanks for the sanity check Jon - All working!!

CreatePlease login to create content