Cisco "Easy VPN" Driving me nuts.

[MysticLlama]

I'm hoping someone can point me in the right direction here.

I'm trying to set up my PIX 515E as an Easy VPN Server to use for a PIX 501 Client.

The client setup seems easy enough, I've found several docs on it, and they all come down to using the same <10 lines.

The problem I'm having is with the headunit. I have found lots of documentation that says it can be used for and Easy VPN server, but not explicity which portions you need to set up and which you don't. The problem is that every time I get into documentation that eludes to this, it just goes on to explain out to set up two peers, which isn't the same thing.

Does anyone know where to find some concise docs on teh Easy VPN Server setup??

I've established connectivity all the way through, built the vpngroup, made a crypto map, assigned access-lists (which I'm not sure if they are used with Easy VPN or not, but I did them anyway), set pre-shared keys, and explicitly allowed ipsec traffic.

I really feel like I'm just missing something small, but can't figure out what it is.

-----

Conversely, who has experience building these things, how many hours would it take you to right some short directions (line by line for a minumum setup, plus a couple of notes per line on reasoning, so I get the whole concept, not just copying it), and what is your billable rate?

 

[SR]

The easy vpn server is "suppose" to be setup the same as configuring the pix for 3.X vpn clients. I'm guessing this since one page on cisco's web site refers to the easy vpn remote as easy vpn client. If you have the PDM enabled just to to tools- vpn wizzard and create a client vpn setup for 3.x ot higher.

This is what I got in about 10 minutes of reading and 5 minutes of configuring... This is an untested config so take it for what it is worth.



(this is the server portion)
access-list inside_outbound_nat0_acl permit ip 192.168.200.0 255.255.255.0 192.168.201.0 255.255.255.0
access-list 100 permit ip 192.168.200.0 255.255.255.0 any
access-list outside_cryptomap_dyn_20 permit ip any 192.168.201.0 255.255.255.0
ip address inside 192.168.200.254 255.255.255.0
ip local pool ippool 192.168.201.1-192.168.201.254
nat (inside) 0 access-list 100
sysopt connection permit-ipsec
no sysopt route dnat
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac <--- keep this here only if some pix only have des
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
isakmp enable outside
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash sha
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400

(the pix1 is your group name for your first remote pix)

vpngroup pix1 address-pool ippool
vpngroup pix1 dns-server 192.168.200.1
vpngroup pix1 wins-server 192.168.200.1
vpngroup pix1 default-domain yourfqdn.com
vpngroup pix1 split-tunnel 100
vpngroup pix1 idle-time 1800
vpngroup pix1 password "enterapasswordhere"

(this could be the 2nd easy vpn remote)

vpngroup pix#2 address-pool ippool
vpngroup pix#2 dns-server 192.168.200.1
vpngroup pix#2 wins-server 192.168.200.1
vpngroup pix#2 default-domain yourfqdn.com
vpngroup pix#2 split-tunnel 100
vpngroup pix#2 idle-time 1800
vpngroup pix#2 password "enterapasswordhereforsecondpix"

I'd changed the stupid nat 0 name of the access list to 100 instead of inside_outbound_nat0_acl but it doesn't matter for functionality.

 

[MysticLlama]

Okay, I guess I didn't read that right, because I wasn't getting that.

I thought it was some sort of different configuration or something. I do definately see a couple of lines in that config that weren't things I was setting, so hopefully it'll get me closer to the right track.

Sometimes when you look at something too long you start looking for a harder solution than what's right there.

Thanks!