PIX 501 <-> Concentrator remote client question

google@spiresfamily.com · Guest

I'm new to the world of PIX. I am learning quickly though, I think.

Anyway I purchased a 501 and what I would like to do; I believe it is
possible is the following.

Configure an IPSEC tunnel from my PIX to the office where I work. I do
not have admin rights to the equipment at work but I believe I have the
buy-in from the network administrator if I can come up with the
configuration.

At the office we have a Cisco VPN Conentrator that all of the existing
vpn tunnels terminate against (software vpn clients, 501 vpnclients,
etc).

Is it possible to configure up my 501 at home so that only 1 IP address
NATed inside my network would traverse the IPSEC tunnel to the office,
and the relevant data to return through the tunnel. I don't have a
problem with other traffic coming through the tunnel to my house; but
the only traffic that "should" be coming through the tunnel should
be reply traffic.

Any other data from my house would not go through the tunnel, but go
out the standard interface.

I know we have another user who has a 501 at his house; however he is
using the easyvpn client which causes all of his traffic to go through
the tunnel, this causes the traffic not bound for the office to
"double-dip" off of the office internet connection and I don't
want to do that, especially since my wife works from home. I would not
want all of her traffic to traverse the tunnel to my office to get out
to the internet (as I'm sure the network admin).

So the million dollar question is, is this possible, or am I asking for
too much.

In addition to the VPN concentrator at the office we have mostly cisco
hardware (routers, PIXes, swithes, etc...), so if its not possible to
terminate against the concentrator, could I terminate against another
device?

If it is possible, could I trouble you all for some help putting
together the commands to make it work on the PIX and the concentrator?

Merv · Guest

Take a look at Cisco doc "Configuring the VPN Hardware Client on PIX
501/506 Version 6.2 for Use With a VPN 3000 Concentrator"

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a0080094cf8.shtml

google@spiresfamily.com · Guest

That is a great reference but if I read it correctly it would tunnel
all of my traffic from home to work and then out to the internet.

Heres the best I can do at ASCII art:

HOME: WORK:

(192.168.1.31) PC1 --\

Mark Williams · Guest

What you are looking for is called a split-tunnel VPN. Only traffic
that needs to be encrypted is encrypted and tunneled into your office.
The policy for an EasyVPN split-tunnel would have to be defined by your
admin at the VPN Concentrator. It could be enabled for all EasyVPN
clients, or your admin could create a new vpngroup just for you.

Using split-tunnel vpns for clients is a security risk however;
probably why your admin has it turned off.

Merv · Guest

you could also configure the PIX VPN pass-thru amd just use the VPN
client on your PC.

http://www.ciscotaccc.com/kaidara-advisor/security/showcase?case=K29271786

Tyler · Guest

I already have this successfully working.

The main reason for this request is that

1) I work from home occasionally
2) My work VPN client does not allow local traffic (i.e. I would like
to be able to use local network printers & local file servers on this
side of the tunnel).
3) I just wanted to tinker with the pix and learn a little along the
way.
4) To access work email I either have to sign on to the web client (not
that big of a deal) or sign on to the VPN to use the client on my
laptop, thus forfeiting my local network access.

So the request is out of academic curiosity and convenience.

So if I understand correctly I'll need to convenes the Network Admin
to change the security policy for the vpngroup to be able to have local
access to my network while attached to the VPN?

Guest

The default when you create a group on the Concentrator is that all
remote traffic will go over the tunnel.

This can be modified, though, so that only traffic to(/from?) a
specific set of networks will be encrypted, while the rest will exit
the remote client unencrypted (thus accessing the Internet locally). As
was said previously in the thread, this is called split tunneling. And
it has nothing to do with the EasyVPN feature: EasyVPN *can* be used
with split tunneling.

And yes, this modification needs be done on the Concentrator.

HTH,

James

Martin Bilgrav · Guest

"Mark Williams" <webmaster@sdps-idpa.org> wrote in message
news:1145648744.048779.13070@i39g2000cwa.googlegroups.com...

Robert Bonomi · Guest

In article <1145566150.759574.104300@e56g2000cwe.googlegroups.com>,
google@spiresfamily.com <google@spiresfamily.com> wrote: