Networks

Ask something
Discussion Locked

Only CCIE's can answer this 1 help?

0 helpful
1 reply

by bcgreaves 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I can't believe that this is not possible, if anyone can give some direction and help---I would owe u 1 4 sure!
I have 2 Cisco 2621xm's. The end result I need is a simple site to site set up, but also must have the ability to have simultaneous connections for users to VPN to a client site. The software they must use is a Nortel client dialer (connects through our LAN) that simply has a dns name entry in it and the users basically only need to put in their issued user name and password to make the connection. I can have the site to site up but the users no longer can connect to our client or I can have the users able to connect (multiple simultaneous) with the Nortel client VPN but only if the site to site is down. The only requirements I must have is to be able to allow IPSec to pass through. Finally, I want to have the ability of allowing our employees to VPN into either on of our sites, but that is secondary at this time. Currently, we have a block of 8 ip addresses per site, but I've purchased a new block of 16 per site and my internet provider has set up a virtual connection for me so I can test the new block of addresses to see if the above can be done. I also have just purchased two Cisco PIX 501's to assist in this project which I would really like to use because the Cisco Routers are probably not necessary since each site has routing dsl box and T1 (Covad) box. Since the 2621xms don't really do any routing I suppose they are acting as firewalls and that's it. Waste of money! I am really looking for someone who would even let me call them to get details or who is honest enough to allow me to send configs of what I have, minus my passwords. If more info in necessary, just say the word. Thank you.

1 reply

by mshavrov

Ok, let me try to clarify and summarize. Correct me if I'm wrong:

1. You have 2 sites connected to Internet (T1 or DSL).

2. You need Site-to-site VPN connection between sites.

3. You need users in one LAN to establish VPN connection to another LAN using Nortel VPN Client.

4. You need to allow users to VPN into both your LANs from the Internet.

Possible solution:

1. You use your routers to build site-to-site VPN connection. You should use very strict access-lists, which will define which traffic should be protected and which should not. You should definetely EXCLUDE IPSec traffic from the Site-to-Site VPN.

2. You Nortel clients should be able to connect to another site since IPSec traffic is excluded from the Site-to-Site VPN tunnel and so, goes directly (unencrypted).

3. Your 'Internet' VPN users should be able to use either Nortel VPN Client with existing VPN Back-end, you may use your PIX501 firewalls to terminate VPN traffic (you will need to install Cisco VPN client on their laptops), or terminate your VPN traffic directly on your Cisco routers.

That's general picture. But I don't want to give you false hope that anybody besides you will do all configs for free. It's just a direction, and if you want to have this PROJECT done, most likely you should pay real money.

Good luck,

Michael Shavrov
CCIE R&S Written, CCNP, CCDP, CCSP, CheckPoint CCSA, Security+, MCSE W2K, Sun SCSA, ...

This discussion is closed to new replies.