Question for LAN/WAN Guru's

Discussion in 'OT Technology' started by Keyzs, Feb 24, 2004.

  1. Keyzs

    Keyzs OT Supporter

    Joined:
    Nov 3, 2003
    Messages:
    814
    Likes Received:
    0
    Location:
    Charlotte, MI
    I have an interesting VPN/Network/Firewall within a network issue to figure out and I am looking for suggestions.

    A machine service contract states that I need to give the manufacture access to their machine. They have a Cisco PIX that they want to create a VPN to their main location. The problem is the device is 1000 feet away from any direct incoming line. There is network in the area (though I will still need a hardwired drop since its wireless in te area) but that’s all behind my firewall with non-routable addresses.

    I thought of forwarding ports, but that means they will be on our network, or does it??? If I foward the ports needed from their static IP to their PIX and setting the PIX on its own subnet...

    22.22.22.22 - Manufacture's external IP
    33.33.33.33 - My external IP address
    10.1.1.1 - Internal side of my firewall
    forwarded to
    10.1.1.2 - external side of PIX
    192.168.1.1 Inside side of PIX
    (Obviously IP's are faked for example and only needed ports will be forwarded)

    The other idea is to segment a port on the switches but its 3 hops within my network. Having one port down the route on the switches. But I really do not want to manage that... (I have enough trouble keeping track of the ports on the switches - 9 major switches(Cisc0 6500, 4500's) - 3 minors(2950 class) 500+/- ports) Not to mention I have never done an isolated port on these switches and I do not have any spare ports to use...

    Thoughts/Ideas???
     
  2. Rob

    Rob OT Supporter

    Joined:
    Jul 6, 2002
    Messages:
    88,621
    Likes Received:
    39
    Location:
    Atlanta, GA
    If you are doing a hardwire drop anyways just put the PIX by an incoming connection and run the drop back to the PIX. :dunno: 1,000 ft. isnt far for a run.

    Then it will be completly isolated from your network without having to worry about port forwarding/VLANs or the such.

    EDIT: You work in charlotte, if you pay me I will come over and do the run. :o
     
  3. Keyzs

    Keyzs OT Supporter

    Joined:
    Nov 3, 2003
    Messages:
    814
    Likes Received:
    0
    Location:
    Charlotte, MI
    That's a great idea but the T's router is 1000 feet away through offices and another warehouse etc. The drop is literaly a wire from the 30 foot ceiling, there is an wireless access point and extra port directly above the machine... (I am still keeping the option open if needed, but its not my first or second choice)
     
  4. Rob

    Rob OT Supporter

    Joined:
    Jul 6, 2002
    Messages:
    88,621
    Likes Received:
    39
    Location:
    Atlanta, GA
    Bah, just get the maintenance department to do it. Running through a factory/warehouse is no problem, and the offices probably have drop cealings.
     
  5. Keyzs

    Keyzs OT Supporter

    Joined:
    Nov 3, 2003
    Messages:
    814
    Likes Received:
    0
    Location:
    Charlotte, MI
    If it was only that easy! Its probably the option I am going with.
     
  6. Balzz

    Balzz N54 Elitist OT Supporter

    Joined:
    Mar 30, 2000
    Messages:
    22,467
    Likes Received:
    0
    As long as they're in the same VTP domain, all you need to configure is the new VLAN #, set 2 ports as access ports to the VLAN, and allow it through the trunks.
     

Share This Page