| Summary

| This chapter introduced the concept of VPNs and how they can be used for the greatest advantage. Configuration steps for both PIX-to-PIX and PIX-to-VPN Client were reviewed. The first step in VPN configuration is planning. Because VPNs are the key to obtaining a secure communications path, working out the details for each particular installation is the first priority. This process is broken down into tasks concerning IKE, IPSec, and when to work around IPSec with an IPSec bypass. All of these steps are a reflection of the security policy, which should be established before any configuration work begins.

Before configuration of a security measure like VPN begins, it is important to do one more measurement. Learn the answer to the question “Does the network work?” Make certain that the network works properly. Countless hours can be spent troubleshooting network security, when it is actually the underlying network that is at fault.

After configuration comes test and verification. This step must not be skipped, because to do so may leave some users disconnected. Verification involves checking that the settings are correct for ACLs that filer interesting traffic, IKE settings, IPSec settings, and crypto map settings. Debug tools are often utilized during the test and verification phase.

VPN configuration was also discussed, including activities for configuring the ends of the PIX Security Appliance and the VPN Client. This module concluded with information about scaling VPNs based on the PIX Security Appliances, so that the VPNs can accommodate networks of a larger size.