Re: Pix to Pix VPN Question

when setting up the access-list to specify the phase 2 selectors (proxy
identities in cisco terms), you need to specify all possible traffic
that need to go across the tunnel(s). For exemple:

A ----------- B
net1          net10
net2          net20

you need to speficy the following access-list

on A:
permit net1-net10
permit net1-net20
permit net2-net10
permit net2-net20

and reversed on B

You can already see that network summarisation and vlsm is usefull to
setup those entries.

Finally, if you have a lot of network like that, it may be interesting
to use GRE based ipsec tunnels and let the firewall do the policy for
traffic filtering (i dunno though if the PIX support GRE. (transport
mode ipsec protected GRE traffic)

hope this help,

J.

On Wed, 2003-10-29 at 12:35, Laneille&Joe wrote:
> Hi
> 
>  
> 
> Ok where to start. We have three corporate network sites all connected
> using Pix 515’s via a VPN. I have had no problems getting all this
> working for example I can ping the inside zone of network B from the
> inside zone in network A. Within network A I have an Internal zone
> 192.168.1.0 and a Webzone 192.168.2.0 and within network B I have an
> Internal zone 192.168.10.0 and a Webzone 192.168.11.0. I am as stated
> above able to connect from 192.168.1.0 to 192.168.10.0 via the usual
> crypto map setup. 
> 
>  
> 
> What I would like to do is connect from Network A 192.168.1.0
> (Internal) to Network B 192.168.11.0 (Webzone). I have not been able
> to get this working. 
> 
>  
> 
> Please let me know if you have any ideas.
> 
>  
> 
> Regards
> 
> Joe Rossi
> 
> 
> 
> ______________________________________________________________________
> _______________________________________________
> VPN mailing list
> [email protected]
> http://lists.shmoo.com/mailman/listinfo/vpn
-- 

-> Jean-Francois Dive
--> [email protected]

I think that God in creating Man somewhat overestimated his ability.
-- Oscar Wilde