RE: Help in VPN setup

Hi,
I'm not the VPN expert of  Cisco PIX, but normally yes, you need 2 Pub IP to 
setup the connection. Except your VPN clients support NAT, in this case you can 
use the private IP's. As I'm writing this email, I'm using a VPN client to 
connect to my Corporate VPN server, but my laptop has only  a private IP, 
because I'm Using a DSL router for NAT.

VPN Client---------- DSL-Router-------------------VPN-FW
     priv. IP    priv. IP    Pub IP             pub IP

One side Private IP works for sure, but on 2 sides you should give it a try or 
ask Cisco, if the PIX VPN SW supports such a scenario.
The problem is actually in the IPsec header using client and FW IP addresses 
for authentication, but when you have NAT in between, then the Authentication 
fails, if the client is not NAT ready.

CU
Moulay
CISSP
_________________________________________________________________

-----Original Message-----
From: David [mailto:dalmada@sisp.cv] 
Sent: Dienstag, 26. Oktober 2004 19:13
To: firewalls@securityfocus.com
Subject: Help in VPN setup



Hello everyone,

I pretend to setup a gateway-to-gateway VPN throug internet using two PIX.
My question is, do I have to use more than one public IP address for each site? 
if it is possible to use one public address for each site, how do I route the 
private IP through the internet? The scheme should like this one:

Hostt<--->PIX<--->RouterA<--->Internet Cloud<--->RouterB<--->PIXB<--->HostB
 privIP   privIP       pubIP    |VPN|         pubIP       privIP   privIP

Thanks in advance

David

SISP