[c-nsp] Routing packets between two VPNs terminating on the same PIX

[Mark Kelly]

Depends on what version of PIX OS your running.  Versions prior to 7.0
cannot do what you require.


-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Matti Saarinen
Sent: 01 July 2005 08:35
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] Routing packets between two VPNs terminating on the
same PIX



We have difficulties in configuring PIX to do following.


Here is a ASCII representation of the setup:

  net A                                   net B
   |                                       |
   |                                       |
---------                              ----------
| PIX A |                              |  PIX B |
---------                              ----------
   \                                       /
    \                                     /
     \  VPN A                            /  VPN B
      \--------------------------------/
                     |
                     |  (outside)               
                     |
        ----------------------------
         |           PIX C          |
         ----------------------------
                     |
                     |  (inside)
                     |
          our internal net / Internet



There are two VPNs terminating on the same PIX, VPN A and B. The provide
connectivity for nets A and Bto our net and to the rest of the internet
and back. Now, we want that nets A and B also could see each other, too.
Pakcets coming from net A via VPN A should pass through PIX C and then
to VPN B and finally to net B. This does not seem to work. PIX C
processes only those packets that go through it (from inside to outside
or vice versa).

Is there a way to configure PIX to do what we want it to do?


Cheers,

--
- Matti -
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/