Cisco PIX 515E

P

PHUNBALL

Gawd
Joined
Sep 28, 2001
Messages
743
Does anyone know if the latest version of software (7.2) for the PIX 515E will support VPN hairpining?
 
Blitzrommel said:
Check out Cisco's white papers on that OS, oughta tell you.
Click to expand...

I already checked, that's why I ask. By nature PIX's are not routers so they have not supported this in the past, but according to some folks the latest version of software will perform this function (similar to the VPN3k and ASA). I just wanted to see if anyone has been able to get this to work or knows more about it.
 
You're talking about redirecting VPN traffic out the same interface it came in on?

Yes. The command you're looking for is the 'same-security-traffic permit intra-interface' command. It has been supported on the PIX 515 and 515E since 7.0(1).
 
Excellent, wanted to get some more feedback before I went through all the trouble...

Thanks-
 
No prob. It works great too. You can use an ACL to define who can go back out the interface and what they can connect to on their way back out. Example: a remote VPN site needed to be able to access public addresses over a specific port to control satellite modems, and our policy was "NO split-tunneling. Period." So we were able to use an ACL to allow their traffic back out to the Internet only if it met certain source and destination port requirements. Everything else was proxied through our central proxy. So in effect, they had filtered web access, and access to the satellite modems.
 
Your right, it does work great. Tonight I upgraded the code on this particular PIX to 7.2 and it is doing exactly what I need it to do. After you provided that command I was able to find the information I was looking for on Cisco's site...

Thanks Again!!!
 
Have you used the 7.x code before? If not, I'd HIGHLY recommend that you look over the "Caveats" section of the release notes. I haven't used 7.2, but I remember from previous 7.x versions, I was loading a new "special engineering release" into our PIX and ASA about once a month because they were fixing bugs so quickly.
 
Boscoh said:
Have you used the 7.x code before? If not, I'd HIGHLY recommend that you look over the "Caveats" section of the release notes. I haven't used 7.2, but I remember from previous 7.x versions, I was loading a new "special engineering release" into our PIX and ASA about once a month because they were fixing bugs so quickly.
Click to expand...

I have used 7.x on the ASA, just not on the PIX. I may have stumbled upon one of these bugs already. That location was having some problems this AM with SIP signaling from a CallManager Express to a soft switch and it turns out the same-security-traffic... command is what caused the problem although I can't figure out why since none of that traffic traverses a VPN tunnel.

I can see my invite messages being sent to the soft switch, but I only get unauthorized messages in return and never try to acknowledge them with the correct credentials. Strange...
 
You must log in or register to reply here.
Back
Top