[ LiB ]

Practical Exercise 14-7: PIX to Cisco Secure VPN Client with a Preshared Key

Complete the tasks outlined in this Practical Exercise. Also review the Practical Exercise solution to see how you did and to see what concepts you might need to review.

In this Practical Exercise, you are the administrator of a PIX firewall that will be the terminating endpoint for VPNs from a VPN client.

Background Information

You will configure a VPN client to connect to a PIX firewall using wildcards, mode-config, and the sysopt connection permit-ipsec command. This is used to implicitly permit any packet that came from an IPSec tunnel. It bypasses the checking of an associated access list, conduit, or access group command statement for IPSec connections. The user will have access to everything on your network. You will use the topology illustrated in Figure 14-10.

Task 1: Configure PIX

Step 1. At the PIX console, provide all the configuration required to configure the PIX firewall:

- Define traffic for the mode pool.

- Define the mode pool.

- Prevent NAT for the pool.

- Enable IPSec sysopt.

- Enable ISAKMP.

- Define IKE parameters.

- Define IPSec parameters.

Task 2: Define the Client Parameters

Step 1. On the client PC, provide all the configuration required to create the connection IPSec settings:

- Create the connection.

- Identify the remote peer.

- Identify the Phase 1 information.

- Identify the Phase 2 information.

- Identify the other connection information.

[ LiB ]