Virtual private networks are great! You can get on the network at your office from almost anywhere with an internet connection. But you run into problems when you have 1 public IP and 2 of the same VPN users behind that public address. Here comes the need for a site to site VPN solution. A site to site VPN solution allows you to connect 2 remote private networks, SECURELY, over the internet. In this specific instance, we were connecting a Cisco PIX 501 Security appliance (at the main office) to a Linksys RVS4000 (at the user's home)....

    The process is pretty straight forward. Setup your IKE keys, then define your IPSEC tunnel. Since the RVS4000 only uses 3DES Encryption, we knew what kind of tunnel we were going to use already. We created a rule with a higher priority than the Cisco VPN client software. Cisco VPN client only uses DES encryption. The RVS4000 will not keep trying to reconnect if the encryption is not supported. We put a rule in the firewall to exempt address translation between the 2 networks, and allow all traffic, after all, we do trust the user's on that remote network. After we had the pix configured, it was time for the RVS4000. On the VPN page, we created a new VPN and named it "Work". The local security group was SUBNET 192.168.0.0/24. The remote security group was SUBNET 192.168.1.0/24. For the remote security gateway, select IP and type in the address of your PIX. Below that, leave it on IKE(auto), select 3DES and either MD5 or SHA. We used MD5. Type in your pre-shared key. We left PFS DISABLED, and used D-H group 2 (1024). Set those options in your advanced settings to correspond with the settings on the PIX. If you mess these settings up, you will not be able to complete your secure IP tunnel.

    We got through all the configuration, but still no traffic was flowing back and forth. We could ping all hosts on the 0.0/24 network, but nothing from inside the PIX network, or anything FROM the RVS4000 network.

    After a few support calls to Linksys, and some mediocre answers, we finally arrived at the problem... The MTU! To compensate for the IPSEC tunnel overhead, we had to drop the MTU from the default of 1500 to the new setting of 1400 on the RVS4000. After this setting, and a router reset -- all is well!