R: PIX encryption interface

If you have a default route pointing to the outside interface you have to
add a specific route in order for the interesting packets to go out to the
desired interface as ipsec encrypts packets on the fly at the outgoing
interface.
For instance, if the remote lan is 192.168.1.0/24 you have to add the
following route to your pix:
Route dmz(or whatever the name is) 192.168.1.0 255.255.255.0
address-of-the-dmz-gateway
Bye,
    Max.

-----Messaggio originale-----
Da: Andrew Shore [mailto:andrew.shore@holistecs.com] 
Inviato: mercoledì 13 luglio 2005 11.32
A: firewalls@securityfocus.com
Oggetto: PIX encryption interface





Hi all,


I have been having issues with a PIX 515 UR OS 6.3(4) VAC+.

The problem is that when I terminate a VPN on any interface other than the
outside the PIX does not identify any traffic as interesting and does not
encrypt it.

Simply by change the terminating interface to outside causes the PIX to
realise the traffic is destined for the VPN.

Has anyone else seen this behaviour with a PIX before.
 
In this instance it was not too much of a problem as I swapped the
interfaces around but I have other projects where I need to terminate VPNs
on other interfaces.

Regards,

Andy