3015 behind PIX

Similar Questions

• Several outbound VPN connections behind PIX-515E

  I will take a PIX-515E off-site for a provision of access internet location. I have several people behind this PIX, who will have to return to the same Office VPN. One person can VPN through the PIX very well, but if someone else tries to VPN they cannot. Once the first person has disconnected for 10 minutes, then the next person can connect. I activated the NAT - T and added fixup protocol esp-ike. What can I do it wrong? Thank you.

  fixup protocol esp-ike - allows PAT to (ESP), one tunnel.

  Please remove this correction.

  If the remote site has NAT - T enabled, then you should be able to use NAT - T and more than 1 user should be able to use behind the PIX VPN client.

  See you soon

  Gilbert

• Cisco VPN Client behind PIX 515E,-> VPN concentrator

  I'm trying to configure a client as follows:

  The user is running Cisco VPN Client 4.0. They are behind a 6.1 PIX 515E (4), and I need to connect to a VPN concentrator located outside of our network. We use PAT for address translation. As far as I know, to allow ipsec through Firewall 1 tunnel, I need to upgrade the pix to 6.3 and activate "fixup protocol esp-ike.

  Is there another way to do this? I am also curious to know how much more easy/better this will work if we were dealing with pptp.

  You don't necessarily need to fixup protocol esp-ike active. The remote Hub there encapsulation NAT - T enabled so that clients behind the NAT can run?

• Place a FIOS for VPN router behind PIX 501

  I have a Verizon FIOS internet connection and one of their routers wide wireless broadband, and this is a configuration of base completely... their router DHCP and firewalls, and the connection has a dynamic address.  I would put the PIX 501 behind the Verizon router as one of its clients and make the VPN PIX of other PIX 501 at other locations, such as my entire network has access to remote networks.

  Is this possible, and if yes, any who could some suggest configurations (how to address internal and external, static routes ports that may be required somewhere, etc.)?

  Thanks for any help.

  When installing my FiOS, I had already asked that it be installed on the Ethernet cable. Don't know they need to do something for you to spend the coax to Ethernet.

  The best way to test it would be to find the Media Converter (follow the coaxial cable between your FiOS router to the demarc and there should be a box with a coaxial port, some phone Sockets and an Ethernet port). If you unplug the coaxial cable and plug a laptop computer on the Ethernet port, see if your laptop takes a public IP address. If Yes, then you just have to run to your PIX501 Ethernet cable and you should be ready.

  Just to note that Verizon, according to your region, reserved DHCP assignments. This means that you may need to call Verizon and ask them to release the previous assignment of DHCP-MAC addresses. I had this happen recently. They must release the assignment then your PIX will pull a new IP address and they will book your new IP - MAC address assignment. They do this to speed up the connection to a cold start time on the router.

  Basically, they are filtering by MAC address, but rather through a sticky ARP where they clear the entry, and then the next device that connects records his MAC address and then only that device is permitted to connect to this leg of the cable. So there is a bit of work you have to do, but the most difficult part would be sitting on hold waiting for a tech, if you call to Verizon.

• DMVPN - Hub Hub behind PIX, rays on the outside

  Hi all

  Someone at - it examples of configuration with DMVPN, where the hub is behind a PIX and the rays are on the outside. Inside of ownership intellectual of the hub must be NAT' static ed to the hub inside.

  THX

  «Also added in Cisco IOS release 12.3(9a) and 12.3 (11) T is the ability to make router DMVPN hub behind static NAT.» It was a change in the support of ISAKMP NAT - T. For this feature to use DMVPN spoke all routers and routers hub must be upgraded and IPSec must use the mode of transport. "

  http://www.Cisco.com/en/us/products/SW/iosswrel/ps1839/products_feature_guide09186a0080110ba1.html#wp1060911

  I would like to know if this link helps

• The user is unable to use a PPTP VPN behind PIX 506

  My client uses a SW that sends medical claims over the internet using PPTP. They use a 506 and cannot do. the provider said their clients use generally linksys and all they do is allow pptp passthrough check and all is well.

  Why the habit of this work on the PIX? I have addached the config.

  Thanks in advance

  You can use the fixup protocol 1723 pptp Protocol

  I hope this helps.

  Amin

• Several VPN clients behind PIX

  Multiple users in our company have establish a VPN client connection to a VPN Internet gateway. The connection must go through our PIX. I already active correction for esp - ike Protocol and this allows a user to get out. When following users try to configure a VPN connection to the VPN gateway on the internet, the following syslog error appears:

  3 PIX-305006%: failed to create translation portmap for udp src inside:192.168.0.102/500 dst outside:1x5.x17.x54.x10/500

  It seems to me that the PIX only supports an outbound VPN client connection at the time. Is this true?

  When I perform a clear xlate, first user disconnects, but new users is able to establish a VPN connection.

  Kind regards

  Tom

  That's right, Tom - in the release notes for 6.3 (1), the PAT for ESP section says "PIX Firewall version 6.3 provides protocol PAT IP 50 capacity to support unique outbound IPSec user."

  If you have enough public IP addresses and the remote VPN gateway supports PPTP, then a means to achieve multiple outbound VPN connections would be to set up a separate pool of the NAT for users who require outbound access and assign internal IP addresses of those users to use these addresses.

  Having had just a quick look around, if PPTP is an option, then the PPTP PAT 6.3 support can help.

• PIX - Access behind full PAT

  Hello

  Is it possible to have full access to the machine within the network (behind PIX using PAT) from outside? Not only a specific port, but all the ports for all machines within the network? If so, please guide me.

  Thank you

  Iltiaz

  No, by its very definition is PAT * Port * address translation. If you need to have full access to a mailbox, you need to set up a static NAT 1 to 1 with a command

• The VPN client VPN connection behind other PIX PIX

  I have the following problem:

  I wanted to establish the VPN connection the client VPN to PIX on GPRS / 3G, but I didn t have a bit of luck with PIX IOS version 6.2 (2).

  So I upgraded PIX to 6.3 (4) to use NAT - T and VPN client to version 4.0.5

  I have configured PIX with NAT-T(isakmp nat-traversal 20), but I still had a chance, he would not go through the 1st phase. As soon as I took nat-traversal isakmp off he started working, and we can connect to our servers.

  Now, I want to connect to the VPN client behind PIX to our customer PIX network. VPN connection implements without problem, but we can not access the servers. If I configure NAT - T on the two PIX, or only on the customer PIX or only on our PIX, no VPN connection at all.

  If I have to connect VPN client behind PIX to the customer's network and you try to PING DNS server for example, on our PIX, I have following error:

  305006: failed to create of portmap for domestic 50 CBC protocol translation: dst outside:194.x.x.x 10.10.1.x

  194.x.x.x is our customer s address IP PIX

  I understand that somewhere access list is missing, but I can not understand.

  Of course, I can configure VPN site to site, but we have few customers and take us over their servers, so it'd just connect behind PIX VPN and client connection s server, instead of the first dial-in and then establish a VPN connection.

  Can you please help me?

  Thank you in advan

  The following is extracted from ASK THE DISCUSSION FORUM of EXPERTS with Glenn Fullage of Cisco.

  I've cut and pasted here for you to read, I think that the problem mentioned below:

  Question:

  Hi Glenn,.

  Following is possible?

  I have the vpn client on my PC, my LAN is protected by a pix. I can launch the vpn client to connect to remote pix. Authenticates the vpn client and the remote pix makes my PC with the assigned ip appropriate to its pool of ip address.

  The problem that I am facing is that I can not anything across the pix remote ping from my PC which is behind my pix. Can you please guide me what I have to do to make this work, if it is possible?

  My PC has a static ip address assigned with the default gateway appropriate pointing to my s pix inside interface.

  Thank you very much for any help provided in advance.

  Response from Glenn:

  First of all, make sure that the VPN connection works correctly when the remote PC is NOT behind a PIX. If that works fine, but then breaks when put behind a PIX, it is probably that the PIX is PAT, which usually breaks IPSec. Add the following command on your PIX VPN client is behind:

  fixup protocol esp-ike

  See http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/cmdref/df.htm#wp1067379 for more details.

  If it still has issues, you can turn on NAT - T on the remote PIX that ends the VPN, the client and the remote PIX must encapsulate then all IPSec in UDP packets that your PIX will be able to PA correctly. Add the following command on the remote PIX:

  ISAKMP nat-traversal

  See http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/cmdref/gl.htm#wp1027312 for more details.

  NAT - T is a standard for the encapsulation of the UDP packets inot IETF IPSec packets.

  ESP IPSec (Protocol that use your encrypted data packets) is an IP Protocol, it is located just above IP, rather than being a TCP or UDP protocol. For this reason, it has no TCP/UDP port number.

  A lot of features that make the translation of address of Port (PAT) rely on a single to PAT TCP/UDP source port number ' ing. Because all traffic is PAT would be at the same source address, must be certain uniqueness to each of its sessions, and most devices use the port number TCP/UDP source for this. Because IPSec doesn't have one, many features PAT fail to PAT it properly or at all, and the data transfer fails.

  NAT - T is enabled on both devices of the range, they will determine during the construction of the tunnel there is a PAT/NAT device between them, and if they detect that there is, they automatically encapsulate every IPSec packets in UDP packets with a port number of 4500. Because there is now a port number, PAT devices are able to PAT it correctly and the traffic goes normally.

  Hope that helps.

• SonicWall VPN PIX - does not, could someone help?

  Hi all

  I'm trying to set up an a 506th PIX VPN tunnel (firmware 6.3 (2)), a firewall SonicWall Pro. It does not at the moment. Phase 1 is ok but the phase 2 is not, the VPN tunnel has not been established, and the security association is removed after a minute or two. I enclose below the PIX config and an attempt to create VPN tunnel debugging output (slightly modified and cut for reasons of confidentiality). The PIX already has other two VPN configured which work perfectly.

  I would be very grateful to anyone who could help me answer the following questions about this VPN configuration:

  1. to debug output, which means the next?

  ISAKMP (0): retransmission of the phase 2 (0/0)... mess_id 0xafc08a94

  crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

  ISAKMP: error msg not encrypted

  2. in the config, I don't know if the 3 static controls are necessary and how it might interact... What do you think?

  3. in what order things happen in the PIX when traffic is from the local network to remote network by VPN? What is NAT then treatment then setting up VPN to access list? or or treatment, then NAT and VPN to access list? or another possibility?

  4. How can I get it work?

  Thank you very much in advance for any help provided,

  A.G.

  ########### NAMING #################################

  vpnpix1 - is the local cisco PIX

  remotevpnpeer - is the Sonicwall firewall remote

  Intranet - is the local network behind PIX

  remotevpnLAN - is the remote network behind the SonicWall

  ################ CONFIG #############################

  6.3 (2) version PIX

  interface ethernet0 10full

  interface ethernet1 10full

  ethernet0 nameif outside security0

  nameif ethernet1 inside the security100

  .../...

  hostname vpnpix1

  .../...

  names of

  name A.B.C.D vpnpix1-e1

  name X.Y.Z.T vpnpix1-e0

  name E.F.G.H defaultgw

  intranet name 10.0.0.0

  name 192.168.250.0 nat-intranet

  name J.K.L.M internetgw

  name 10.M.N.P server1

  name Server2 10.M.N.Q

  name 10.M.N.R server3

  name 192.168.252.0 remotevpnLAN

  name 10.1.71.0 nat-remotevpnLAN

  .../...

  object-group network server-group

  description servers used by conencted to users remote LAN through a VPN tunnel

  network-host server1 object

  host Server2 network-object

  network-host server3 object

  .../...

  access allowed INCOMING tcp nat-remotevpnLAN 255.255.255.0 list object-group server-eq - ica citrix

  .../...

  OUTBOUND ip intranet 255.0.0.0 allowed access list nat-remotevpnLAN 255.255.255.0

  access list permits INTRANET-to-remotevpnLAN-VPN ip intranet 255.0.0.0 255.255.255.0 remotevpnLAN

  access-list SHEEP, remotevpnLAN permits intranet ip 255.0.0.0 255.255.255.0 nat-remotevpnLAN

  .../...

  IP address outside the vpnpix1-e0 255.255.255.240

  IP address inside the vpnpix1-e1 255.255.252.0

  .../...

  Global 192.168.250.1 1 (outside)

  NAT (inside) 0 access-list SHEEP-to-remotevpnLAN

  NAT (inside) 1 intranet 255.0.0.0 0 0

  .../...

  static (inside, outside) server1 server1 netmask 255.255.255.255 0 0

  public static server2 (indoor, outdoor) server2 netmask 255.255.255.255 0 0

  public static server3 (indoor, outdoor) server3 netmask 255.255.255.255 0 0

  static (exterior, Interior) nat-remotevpnLAN remotevpnLAN netmask 255.255.255.0 0 0

  .../...

  Access-group ENTERING into the interface outside

  Access-group OUTGOING in the interface inside

  Route outside 0.0.0.0 0.0.0.0 internetgw 1

  Route inside the intranet 255.0.0.0 defaultgw 1

  .../...

  Permitted connection ipsec sysopt

  .../...

  Crypto ipsec transform-set esp-3des esp-md5-hmac VPN - TS1

  .../...

  map BusinessPartners 30 ipsec-isakmp crypto

  card crypto BusinessPartners 30 matches the INTRANET-to-remotevpnLAN-VPN address

  card crypto BusinessPartners 30 set peer remotevpnpeer

  card crypto BusinessPartners 30 game of transformation-VPN-TS1

  BusinessPartners outside crypto map interface

  ISAKMP allows outside

  .../...

  ISAKMP key * address remotevpnpeer netmask 255.255.255.255

  ISAKMP identity address

  part of pre authentication ISAKMP policy 10

  ISAKMP policy 10 3des encryption

  ISAKMP policy 10 md5 hash

  10 2 ISAKMP policy group

  ISAKMP life duration strategy 10 28800

  part of pre authentication ISAKMP policy 20

  ISAKMP policy 20 3des encryption

  ISAKMP policy 20 chopping sha

  20 2 ISAKMP policy group

  ISAKMP duration strategy of life 20 28800

  part of pre authentication ISAKMP policy 30

  ISAKMP policy 30 3des encryption

  ISAKMP policy 30 md5 hash

  30 1 ISAKMP policy group

  ISAKMP duration strategy of life 30 28800

  .../...

  : end

  ################## DEBUG ############################

  vpnpix1 # debug crypto isakmp

  vpnpix1 #.

  ISAKMP (0): early changes of Main Mode

  crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

  Exchange OAK_MM

  ISAKMP (0): treatment ITS payload. Message ID = 0

  ISAKMP (0): audit ISAKMP transform 1 against the policy of priority 10

  ISAKMP: 3DES-CBC encryption

  ISAKMP: MD5 hash

  ISAKMP: default group 2

  ISAKMP: preshared auth

  ISAKMP: type of life in seconds

  ISAKMP: duration of life (basic) of 28800

  ISAKMP (0): atts are acceptable. Next payload is 0

  ISAKMP (0): ITS been pre-shared key, using id ID_IPV4_ADDR type authentication

  to return to the State is IKMP_NO_ERROR

  crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

  Exchange OAK_MM

  ISAKMP (0): processing KE payload. Message ID = 0

  ISAKMP (0): processing NONCE payload. Message ID = 0

  ISAKMP (0): load useful treatment vendor id

  ISAKMP (0): ID payload

  next payload: 8

  type: 1

  Protocol: 17

  Port: 500

  Length: 8

  ISAKMP (0): the total payload length: 12

  to return to the State is IKMP_NO_ERROR

  crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

  Exchange OAK_MM

  ISAKMP (0): processing ID payload. Message ID = 0

  ISAKMP (0): HASH payload processing. Message ID = 0

  ISAKMP (0): SA has been authenticated.

  ISAKMP (0): start Quick Mode Exchange, M - ID - 1346336108:afc08a94

  to return to the State is IKMP_NO_ERROR

  ISAKMP (0): send to notify INITIAL_CONTACT

  ISAKMP (0): sending message 24578 NOTIFY 1 protocol

  Peer VPN: ISAKMP: approved new addition: ip:remotevpnpeer / 500 Total VPN peer: 3

  Peer VPN: ISAKMP: Peer ip:remotevpnpeer / 500 Ref cnt incremented: 1 Total VPN peer: 3

  crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

  ISAKMP (0): processing NOTIFY payload Protocol 14 1

  SPI 0, message ID = 476084314

  to return to the State is IKMP_NO_ERR_NO_TRANS

  ISAKMP (0): retransmission of the phase 2 (0/0)... mess_id 0xafc08a94

  crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

  ISAKMP: error msg not encrypted

  ISAKMP (0): start Quick Mode Exchange, M - ID 1919346690:7266e802

  crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

  ISAKMP: error msg not encrypted

  ISAKMP (0): retransmission of the phase 2 (1: 1)... mess_id 0xafc08a94

  crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

  ISAKMP: error msg not encrypted

  ISAKMP (0): retransmission of the phase 2 (0/2)... mess_id 0x7266e802

  crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

  ISAKMP: error msg not encrypted

  ISAKMP (0): retransmission of the phase 2 (2/3)... mess_id 0xafc08a94

  crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

  ISAKMP: error msg not encrypted

  ISAKMP (0): retransmission of the phase 2 (1/4)... mess_id 0x7266e802

  crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

  ISAKMP: error msg not encrypted

  ISAKMP (0): start Quick Mode Exchange, M - ID - 1475513565:a80d7323

  ISAKMP (0): delete SA: CBC vpnpix1-e0, dst remotevpnpeer

  crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

  ISAKMP: drop msg deleted his

  ISADB: Reaper checking HIS 0x10ff1ac, id_conn = 0 DELETE IT!

  Peer VPN: ISAKMP: Peer ip:remotevpnpeer / 500 Ref cnt decremented for: 0 Total of VPN peer: 3

  Peer VPN: ISAKMP: deleted peer: ip:remotevpnpeer / 500 Total VPN peers: 2

  ISADB: Reaper checking HIS 0 x 1100984, id_conn = 0

  ISADB: Reaper checking HIS 0x10fcddc, id_conn = 0

  crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

  ISAKMP: its not located for ike msg

  #####################################################

  Get rid of:

  static (exterior, Interior) nat-remotevpnLAN remotevpnLAN netmask 255.255.255.0 0 0

  You don't need it. Change:

  OUTBOUND ip intranet 255.0.0.0 allowed access list nat-remotevpnLAN 255.255.255.0

  access-list SHEEP, remotevpnLAN permits intranet ip 255.0.0.0 255.255.255.0 nat-remotevpnLAN

  TO:

  access list permits OUTGOING ip intranet 255.0.0.0 255.255.255.0 remotevpnLAN

  access-list SHEEP, remotevpnLAN permits intranet ip 255.0.0.0 255.255.255.0 remotevpnLAN

  This indicates the PIX not NAT IPSec traffic. NAT happens BEFORE IPSec in the PIX, so if you the traffic IPSec nat it will never match your crypto access list and will not be encrypted.

  This, however, should not stop the tunnel of Phase 2 of the course of construction, they would stop flowing above the tunnel, traffic, so you still have a problem somewhere. What I'm guessing, is that the Sonicwall (SW) has a different encryption-defined list access, it must be the EXACT OPPOSITE of what is configured on the PIX. In other words, the SW should be encrypting the traffic of "remotevpnLAN-24" "intranet/8", make sure that the subnet mask ar ETHE same too. "

  To answer your questions:

  1. it simply means that the PIX has not received a response and is to retransmit the last ISAKMP packet. The process_block simply means that the PIX has dropped a package that was to be encrypted because the IPSec tunnel has not been built. If you get the tunnel built, these messages will disappear.

  2. the 3 first static does not appear to be linked to the tunnel IPSec, if they are simply to access a server inside, then they will not affect this VPN tunnel. The last of them should be deleted, as I already said.

  3. for traffic initiated from inside the PIX, the order is incoming ACL, then NAT, IPSec processing. That's why your OUTGOING ACL must allow traffic first, then your NAT 0 statement refuses to be NAT had, then the encryption function is the traffic and the number.

  4 do what I said above :-)

  If you still have no luck, re - run debugs, but initiate traffic behind the Sonicwall, in this way the Sonicwall will try and debug of build that the tunnel and you will get more information on the PIX. Mainly, we'll see what traffic model the SonicWall is configured to encrypt (you don't see if the PIX initiates the tunnel).

• PIX: Dialin routing through a different VPN VPN

  Here's the scenario: I have 2 PIX firewall on various sites connected to the internet with public (PIX A and B PIX) IP addresses.

  There is a permanent VPN site to site between the two and there is a clear separation between subnets between the two sites (internal network behind PIX is 10.10.4.0/24 and the internal network behind PIX B 192.168.0.0/16).

  I created dialin VPDN access to PIX for laptops to dialin via VPN - it currently allows access to the subnet 10.10.4.0/24 without problem.

  Now - I need these users of portable computers, when connects via the VPN to PIX has to be able to access the other remote site and access the subnet 192.168.0.0/16 of routing through the VPN site to site of PIX B.

  Is this possible? I would be grateful to anyone who helps with that. Thank you...

  This is currently not possible on the PIX as the PIX will not route traffic back on the same interface, it is entered in the.

  This feature will be available in the upcoming v7.0 version, which is currently in beta, so look out for it and you're ready to go.

• PIX - PIX VPN and Client VPN - cannot access core network

  I hub and spoke PIX and a VPN Client that connects to speak it PIX, much the same as the example configuration here: -.

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a00800948b8.shtml

  This example shows the client VPN access to the network behind PIX RADIUS. I want the client to also be able to access the central network, i.e. the client connects to the pix speaks via vpn, and traffic is routed through the vpn to PIX - PIX to the central site.

  How this would change the configuration contained in the example?

  See you soon,.

  Jon

  You can not do this, the PIX cannot route a package back on the same interface, it is entered in the. The only way to do that is to have the client connect to the hub PIX, but then they would not be able to get to the network behind PIX distance either.

  Or that the customer would connect on a different interface in the PIX of distance, but this would mean another connection ISP on this PIX. Example of config is here: http://www.cisco.com/warp/public/110/client-pixhub.html

• VPN site-to-site between two PIX 501 with Client VPN access

  Site A and site B are connected with VPN Site to Site between two PIX 501.

  Also, site A is configured for remote access VPN client. If a remote client connects to Site A, it can only get access to the LAN of Site A, it cannot access anything whatsoever behind PIX on Site B.

  How is that possible for a VPN client connected to Site A to Site B?

  Thank you very much.

  Alex

  Bad and worse news:

  Bad: Not running the 7.0 series PIX cannot route traffic on the same interface, the traffic is recived. Version 7.0 solves this ipsec traffic.

  Even worse: PIX 501 can not be upgraded to 7.0...

  A couple of things to think about would be the upgrade to hardware that can run the new IOS or allowing a VPN R.A. on site B.

  HTH Please assess whether this is the case.

  Thank you

• Cisco router 892 IPSec initiator?

  Hi all!

  I have the IPSec tunnel between Cisco router 892 (c890-universalk9 - mz.154 - 3.M4.bin) and Cisco PIX 515E (ver. 8.0 (4) 28) with 5 subnets behind PIX.

  PIX configured to deal with two-way-type of connection, but router support not =)

  So, when I generate intresting hosts behind the router traffic IPSec does not work. When I generate traffic hosts behind PIX , everything works, but I need to be initiator on the side of the router :-(

  Is there a way to make my initiator 892 tunnel Cisco IPSec router to work with Cisco PIX / ASA?

  I'm afraid I should replace the router to another device = (())

  Thank you!

  Hi Yura Kazakevich,

  Try to enable pfs on the router:

  map SDM_CMAP_1 1 ipsec-isakmp crypto

  Set of pfs

  Hope this info helps!

  Note If you help!

  -JP-

• VPN Client problem

  A remote user on our network has problems with the Cisco VPN. They are using Win XP, Cisco Client 3.5.2 and connect via a router of Compaq Ipaq into a modem cable. When they VPN in our 3000 VPN concentrator works very well. When they try to VPN in the PIX on our network, it indicates that the client is no longer. If they use a Microsoft VPN to connect to the network with the 3000 (we run both MS and Cisco VPN) with it set to use the remote control, the default gateway, the Cisco VPN will connect to the PIX, see the network behind PIX, ping stuff behind the PIX, but not map a drive. The remote user can ping the PIX of their unVPNed in the remote location. No other user is a problem connecting to the PIX (except those with the bad remote access or broadband satellite which cannot VPN into anything anyway). We have even a few AOLer connect to it. Help me please.

  If the compaq ipaq router makes a PAT, that might be the problem. PIX is unable to manage the ipsec clients who crossed pat. The vpn3000 has some mechanism to deal with this. PPTP is different to ipsec.

  You must ensure that the ipsec client has its own public routable ip address.

  Kind regards