Ping and PIX VPN

Similar Questions

• PIX and ASA static, dynamic and RA VPN does not

  Hello

  I am facing a very interesting problem between a PIX 515 and an ASA 5510.

  The PIX is in HQ and has several dynamic VPN connections (around 130) and IPsec vpn remote works very well. I had to add a PIX to ASA L2L VPN static and it does not work as it is supposed to be. The ASA 5510, at the remote end, connects and rest for a small period of time, however, all other VPN connections stop working.

  The most interesting thing is that ASA is associated with the dynamic map and not the static map that I created (check by sh crypto ipsec his counterpart x.x.x.x). However, if I make any changes in the ACL 'ACL-Remote' it affects the tunnel between the PIX and ASA.

  Someone saw something like that?

  Here is more detailed information:

  HQ - IOS 8.0 (3) - PIX 515

  ASA 5510 - IOS 7.2 (3) - remote provider

  Several Huawei and Cisco routers dynamically connected via ADSL

  Several users remote access IPsec

  A VPN site-to site static between PIX and ASA - does not.

  Here is the config on the PIX:

  Crypto ipsec transform-set ESP-3DES-ESP-SHA-HMAC-IPSec esp-3des esp-sha-hmac

  Dyn - VPN game 100 Dynamics-card crypto transform-set ESP-3DES-ESP-SHA-HMAC-IPSec

  Crypto dynamic-map Dyn - VPN 100 the value reverse-road

  VPN - card 30 crypto card matches the ACL address / remote

  card crypto VPN-card 30 peers set 20 x. XX. XX. XX

  card crypto VPN-card 30 the transform-set ESP-3DES-ESP-SHA-HMAC-IPSec value

  VPN crypto card - 100 - isakmp dynamic Dyn - VPN ipsec

  interface card crypto VPN-card outside

  crypto ISAKMP allow outside

  crypto ISAKMP policy 10

  preshared authentication

  3des encryption

  md5 hash

  Group 2

  life 86400

  crypto ISAKMP policy 65535

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 86400

  access list ACL-remote ext ip 10.0.0.0 allow 255.255.255.0 192.168.1.0 255.255.255.0

  Thank you.

  Marcelo Pinheiro

  The problem is that the ASA has a crypto acl defined between host and network, while the remote end has to the network.

  Make sure that the acl is reversed.

• PIX, VPN, PAT and static

  I want to activate an incoming and outgoing VPN on a PIX configured with PAT. I enabled ESP and UDP/500 on the appropriate access to the lists, but must provide a static for inbound traffic. I already use a static for incoming SMTP traffic, and I don't see how to do the same thing for udp/500, but how do I ESP traffic?

  Any suggestions gratefully received.

  If you are referring to a static port, you can create one for ESP since static port can only be created for TCP/UDP and ESP is located just above the intellectual property, it is NOT a TCP/UDP protocol. You will need to create a one-to-one static for this internal VPN server and have your clients to connect to this address. This will chew global IP address to another one, sorry.

• VPN between a PIX and a VPN 3000

  I'm trying to set up a VPN between PIX and a VPN 3000. All configurations are complete, but the tunnel has not been established. On the PIX, to 'see the crypto engine' and ' show isakmp his ' orders, I do not see the tunnel. Of "show ipsec his ' command, I can see the mistakes"#send"continues to increase when I try to connect to the remote network. Here is the copy - paste command:

  Tag crypto map: myvpnmap, local addr. 10.70.24.2

  local ident (addr, mask, prot, port): (10.70.24.128/255.255.255.128/0/0)

  Remote ident (addr, mask, prot, port): (10.96.0.0/255.224.0.0/0/0)

  current_peer: 10.70.16.5:0

  LICENCE, flags is {origin_is_acl},

  #pkts program: encrypt 0, #pkts: 0, #pkts 0 digest

  #pkts decaps: 0, #pkts decrypt: 0, #pkts check 0

  compressed #pkts: 0, unzipped #pkts: 0

  #pkts uncompressed: 0, #pkts compr. has failed: 0, #pkts decompress failed:

  #send 12, #recv errors 0

  local crypto endpt. : 10.70.24.2, remote Start crypto. : 10.70.16.5

  Path mtu 1500, fresh ipsec generals 0, media, mtu 1500

  current outbound SPI: 0

  SAS of the esp on arrival:

  the arrival ah sas:

  SAS of the CFP on arrival:

  outgoing esp sas:

  outgoing ah sas:

  outgoing CFP sas:

  Obviously, the PIX identifies protected traffic but failed to establish the tunnel. I was wondering what could be the reason for these kind of mistakes? That means them growing '#send errors?

  Thank you very much!

  Sending error mean simply the PIX is grateful to encrypt this traffic, but there is no built tunnel and so it must drop the package.

  you will need to look at why the tunnel is not under construction however, "sending error" are just a byproduct of some other configuration issue. On the PIX, it looks like you would have something like:

  Crypto ip 10.70.24.128 access list allow 255.255.255.128 10.96.0.0 255.224.0.0

  On the 3000 under the L2L section and the Local and remote network, you need the exact opposite of the latter, then it would be:

  / Local network mask = 10.96.0.0/0.31.255.255

  / Remote network mask = 10.70.24.128/0.0.0.127

  If you have something else the tunnel will fail to come. Otherwise, we see that the Cryptography debugs the PIX and the trunk of the 3000 when the tunnel is built.

• VPN between cisco unified customer 3.6.3 and Pix 501 6.2 (1) with the MS CA server

  Hello

  I have Microsoft CA server with the latest support CEP and pix 501 that gets the digital certificate. I also have the client certificate of Cisco, but VPN doesn't work

  In the IPSec Log Viewer, I constantly "CM_IKE_ESTABLISH_FAIL."

  It worked well prior to Win2k server has been completely updated with the latest patches.

  The pix configuration is identical to that of article http://www.cisco.com/warp/public/471/configipsecsmart.html

  I reinstall the stand-alone CA and support CEP server but not had any luck.

  What could be wrong?

  It looks like IKE implementation problem. Make DH group 2 policy ISAKMP.

  Visit this link:

  http://www.Cisco.com/univercd/CC/TD/doc/product/iaabu/PIX/pix_v53/IPSec/exvpncl.htm

• PIX - PIX VPN and Client VPN - cannot access core network

  I hub and spoke PIX and a VPN Client that connects to speak it PIX, much the same as the example configuration here: -.

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a00800948b8.shtml

  This example shows the client VPN access to the network behind PIX RADIUS. I want the client to also be able to access the central network, i.e. the client connects to the pix speaks via vpn, and traffic is routed through the vpn to PIX - PIX to the central site.

  How this would change the configuration contained in the example?

  See you soon,.

  Jon

  You can not do this, the PIX cannot route a package back on the same interface, it is entered in the. The only way to do that is to have the client connect to the hub PIX, but then they would not be able to get to the network behind PIX distance either.

  Or that the customer would connect on a different interface in the PIX of distance, but this would mean another connection ISP on this PIX. Example of config is here: http://www.cisco.com/warp/public/110/client-pixhub.html

• Site2Site and remote VPN

  I have a site2site between PIX506 and 877 router VPN. Site A has PIX506 and Site B router a in 877. I configured site2site VPN and it worked fine. I also configured remote VPN on PIX 506 so that the remote user can access A site. But when I configure remote VPN on PIX506 site2site VPN works and both sides can ping each other. But site B users cannot access any resource network or application of the SiteA while site A can access resources of site B. After removing remote VPN site configuration B can access the resources of the Site I joined the configuration of the two sites. Someone help me please site2site and remote VPN work at the same time.

  Please forgive me for not reading every line.

  an add-on quick about the pix configuration:

  change "isakmp key * address 213.181.169.8 netmask 255.255.255.255" at "isakmp key * address 213.181.169.8 netmask 255.255.255.255 No.-xauth No. config-mode.

• With PAT on Cisco PIX VPN client

  Dear all,

  I have a PIX 515 to the main site with the IPSec security is enabled. Homepage user using 3.x VPN client connects to the PIX for VPN access. When user Home use real IP, I can ping to the local network of the main site. However, when the Home user using a router with PAT, the VPN can be established.

  Is there a setting I should put on PIX, VPN client or router?

  Thank you.

  Doug

  And if you still have problems, upgrade your pix, 6.3 and usage:

  ISAKMP nat-traversal

  But the first thing would be to check the IPSEC passthrough as Ade suggested. If the device is a linksys check the version of the firmware as well.

  Kind regards

• Through a PIX VPN client

  Hello

  It seems to me having confused TAC with this question:

  I have a client who has two firewalls PIX 501. One in DC (pix - a) and one in San Diego (pix - b). They are both connected via a static IPSec VPN. Works fine, no problem. I also set up two of them to accept connections from Cisco VPN Clients for these people who are on the road a bit. It also seems to work in most situations.

  However, when you try to connect to one of these two firewalls with the Cisco VPN Client when I'm behind other PIX (resembling a third party site that is not attached to a pix - a or pix - b by all means of transport), establishes the tunnel, but I can't move the traffic to the Remote LAN. At first I thought it was due to the NAT on my home PIX (pix - c). Then, I tried to work, behind a PIX who don't use NAT (pix - d) and got the same results. I should mention that trundle making IPSec is enabled on pix - c and pix - d.

  Establishes the VPN connection very well from outside pix - c or pix - d. I can connect and ping perfectly.

  I thought this would be a simple "oh yes, this turns ' or"this is is not supported", but the TAC engineer who picked up my case does not seem to grasp the concept, nor understand how to read my .gif image of visio four firewalls PIX drawn in the exact scenario described above.

  Thank you

  evt

  What version of IOS is there on pix - a, pix - b?

  What game of transformation for vpn clients do you use?

  In all cases, you must enable NAT traversal on pix - a, pix - b.

• QuickVPN - could not do a ping the remote VPN router!

  Hello

  I have a RV042 (VPN router) and I have some problems to run properly using the QuickVPN client.

  Here is the Log of the QuickVPN client.

  2008-10-15 20:14:38 [STATUS] a network interface detected with 192.168.0.104 IP address
  2008-10-15 20:14:38 [STATUS] connection...
  2008-10-15 20:14:38 [STATUS] connection to a remote gateway with IP address: 96.20.174.84
  2008-10-15 20:14:38 [WARNING] server certificate does not exist on your local computer.
  2008-10-15 20:14:44 remote gateway [STATE] has been reached with https...
  2008-10-15 20:14:44 [STATUS] commissioning...
  2008-10-15 20:14:51 [STATUS] Tunnel is connected successfully.
  2008-10-15 20:14:51 [STATUS] verification of network...
  2008-10-15 20:14:55 [WARNING] failed to do a ping the remote VPN router!
  2008-10-15 20:14:58 [WARNING] failed to do a ping the remote VPN router!
  2008-10-15 20:15:01 [WARNING] failed to do a ping the remote VPN router!
  2008-10-15 20:15:05 [WARNING] failed to do a ping the remote VPN router!
  2008-10-15 20:15:08 [WARNING] failed to do a ping the remote VPN router!
  2008-10-15 20:15:11 [WARNING] Ping has been blocked, which can be caused by an unexpected disconnection.
  2008-10-15 20:15:19 [STATUS] disconnection...
  2008-10-15 20:15:25 [STATUS] Tunnel is disconnected successfully.

  I don't know how it is implemented, but if WuickVPN wait a form ping my router, it will not happen. I was never able to ping my router ouside of my ISP network.

  There is a way to disable the Ping process and continue with the VPN connection?

  QuickVPN try ping on the router via the VPN tunnel to check the connection. It should work without worrying about whether your ISP filters ICMP messages or not. The tunnel is encrypted your ISP won't know what you're doing.

  Please post the corresponding on the RV042 VPN log. That is expected to see how far you get.

  You have a firewall running on the computer? I think that some firewalls have difficulty with the traffic of ESP.

  What is the router that is connected to the computer? How is it that is configured?

• PIX PIX VPN - error log

  I created a VPN between our PIX and PIX customers but receives the following error message when I try to activate tunnnel. I checked the ACL on both ends. Any ideas?

  ISADB: Reaper checking HIS 0x80da9618, id_conn = 0IPSEC (sa_initiate): ACL = deny;

  No its created

  IPSec (sa_initiate): ACL = deny; No its created

  IPSec (sa_initiate): ACL = deny; No its created

  IPSec (sa_initiate): ACL = deny; No its created

  I've seen a few times. Usually remove the interface of the card encryption and re - apply solves it, sometimes it is necessary to remove the card encryption and the "enable isakmp outside" and put them both back in.

  This message is also sometimes to do with something wrong in the configuration, in order to double-check your ACL and your transformation games, etc.

• Cisco and Checkpoint VPN clients on a single PC

  Hello

  I'm in the following fix:

  I had used customer Checkpoint SecuRemote 4.1 SP - 5 VPN in the past.

  Now, I have installed the Cisco VPN client version 4.0.4 on my PC to access IPSec VPN for the PIX in our headquarters.

  According to Cisco VPN release notes http://www.cisco.com/univercd/cc/td/doc/product/vpn/client/rel404/404clnt.htm#wp1346340 , it should be possible to have clients both Cisco and Checkpoint VPN installed on the same machine.

  But I am not able to connect to my PIX, I receive the following error message:

  "Secure the complete VPN connection locally by the Client.

  Reason 403: failed to contact the security gateway. »

  When I'm looking for signs of PC control-> system-> hardware-> device Administration-> network cards, I can see Cisco Systems VPN Adapter disabled.

  After you activate manually, I always get the same error when you try to connect to the Cisco VPN client.

  After PC restart the Cisco VPN adapter is disabled later.

  I tried to uncheck Check Point SecuRemote form my Dial-up connection (bypassing CSCea31192 of bug, but the bug does not affect NAT - T connection which I use).

  I noticed the same situation on three different computers, one running Windows XP, both running Windows 2000.

  After uninstalling the client Checkpoint completely (including Windows registry manual removal), the Cisco VPN client works very well.

  It seems to me, therefore, that there is a profound mismatch between Cisco and Checkpoint VPN clients.

  Does anyone know of a workaround?

  Thank you

  Milan

  We had the same problem with some of our users who need to use the two clients to connect to customer sites.

  If I remember the cisco client does not start automatically, but the client of checkpoint 4.1 don't.

  We by-passed by deleting the registry entry point control that starts the client at startup. fwenc.exe is the entrance and it is in

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

  After that make a shortcut to the executable file that is stored in the directory \bin to relevant checkpoint on the client (it is different from NT & 9 client x) and then only start when it is necessary.

  Hope that's a help

• Simple PIX PIX VPN issues

  I'm trying to implement a simple PIX PIX VPN using the simple PIX - PIX VPN documentation for the sample config page. I have a lot of VPN tunnels with other very happy other PIX devices so it's quite annoying. Anyway, on the source PIX config is as follows:-

  access-list 101 permit ip 172.18.138.0 255.255.255.0 172.18.133.0 255.255.255.0

  access-list 101 permit ip 172.18.133.0 255.255.255.0 172.18.138.0 255.255.255.0

  NAT (phoenix_private) 0-access list 101

  Permitted connection ipsec sysopt

  No sysopt route dnat

  Crypto ipsec transform-set esp - esp-md5-hmac chevelle

  ntlink 1 ipsec-isakmp crypto map

  1 ipsec-isakmp crypto map TransAm

  correspondence address 1 card crypto transam 101

  card crypto transam 1 set peer 172.18.126.233

  card crypto transam 1 transform-set chevelle

  interface inside crypto map transam

  ISAKMP allows inside

  ISAKMP key * address 172.18.126.233 netmask 255.255.255.255

  ISAKMP identity address

  part of pre authentication ISAKMP policy 1

  of ISAKMP policy 1 encryption

  ISAKMP policy 1 md5 hash

  1 1 ISAKMP policy group

  ISAKMP policy 1 lifetime 1000

  and if I generate the traffic logs show this: -.

  9 August 18:40:15 10.60.6.247% PIX-3-305005: no translation not found for icmp src phoenix_private:172.18.138.111 dst domestic group: 172.18.133.51 (type 8, code 0)

  9 August 18:40:17 10.60.6.247% PIX-3-305005: no translation not found for icmp src phoenix_private:172.18.138.111 dst domestic group: 172.18.133.51 (type 8, code 0)

  9 August 18:40:18 10.60.6.247% PIX-3-305005: no group of translation not found for udp src phoenix_private:172.18.138.111/3832 dst inside:172.18.133.51/53

  9 August 18:40:18 10.60.6.247% PIX-3-305005: no translation not found for icmp src phoenix_private:172.18.138.111 dst domestic group: 172.18.133.51 (type 8, code 0)

  9 August 18:40:19 10.60.6.247% PIX-3-305005: no group of translation not found for udp src phoenix_private:172.18.138.111/3832 dst inside:172.18.133.51/53

  No isakmp and ipsec debugging message appears, but you who wait that the PIX does not even link the traffic with the access list or a NAT.

  I do something obviously stupid, can someone tell me what it is, thank you.

  Jon.

  Hello

  1. you create a second access as list:

  outside_cryptomap ip 172.18.138.0 access list allow 255.255.255.0 172.18.133.0 255.255.255.0

  and

  2. instead of

  correspondence address 1 card crypto transam 101

  You must configure

  card crypto transam 1 match address outside_cryptomap

  the problem is that you configure an ACL for nat and crypto - that does not work

  concerning

  Alex

• Pass the trunk between catalyst and PIX

  Hello

  Yesterday I had very good response on the forum how to create the VLAN on PIX, I created the subinterfaces and VLAN which their responsibilities. I configured the IP addresses as well. Did the same on the switch of Cat - created SVI and assined their IP add back. Cat shows switch port trunking is correctly but I can't ping from PIX to the switch and vice versa. Help, please.

  RVR

  Is it possible for you to view the configuration of the PIX? At least the configuration of the interface?

  And configuration of the trunk on the switch interface?

  Concerning

  Farrukh

• PIX to PIX VPN using Ipsec Tunnel. Need help please.

  Hello everyone,

  I have a connection of two sites using 506th PIX and PIX 501. The one on the central site (WATBCINX1 - 506th PIX) sends the packet correctly and one on the remote site (CTXPOINX1 - PIX 501) receives (checked using icmp backtrace on the two PIX). The problem is that PIX 501 at remote site return packages. I have to say that the two PIX hace a 3com OfficeConnect ADSL router as gateway Internet 812. If someone could help me I would appreciate it a lot. Thank you!

  PIX 506th Configuration (central site):

  WATBCINX1 # sh conf

  : Saved

  : Written by enable_15 to the CEDT 08:36:50.090 Friday, June 20, 2003

  6.2 (2) version PIX

  ethernet0 nameif outside security0

  nameif ethernet1 inside the security100

  activate qU51Wrx8ggFHLusK encrypted password

  qU51Wrx8ggFHLusK encrypted passwd

  hostname WATBCINX1

  NEOKEM domain name. LAN

  clock timezone THATS 1

  clock to summer time CEDT recurring last Sun Mar 02:00 last Sun Oct 03:00

  fixup protocol ftp 21

  fixup protocol http 80

  fixup protocol h323 h225 1720

  fixup protocol h323 ras 1718-1719

  fixup protocol they 389

  fixup protocol rsh 514

  fixup protocol rtsp 554

  fixup protocol smtp 25

  fixup protocol sqlnet 1521

  fixup protocol sip 5060

  fixup protocol 2000 skinny

  no names

  name 80.37.246.195 POLINYÀ

  access-list outside_access_in allow accord any host 10.0.0.10

  outside_access_in list access permit tcp any host 10.0.0.10 eq 1723

  outside_access_in list access permit tcp any host 10.0.0.10 eq smtp

  outside_access_in list access permit tcp any host 10.0.0.10 eq pop3

  access-list outside_access_in allow icmp a whole

  inside_access_in ip access list allow a whole

  access-list inside_access_in allow a tcp

  access-list inside_access_in allow icmp a whole

  Allow Access-list inside_access_in a whole udp

  access-list 101 permit ip 192.168.0.0 255.255.255.0 192.168.11.0 255.255.255.0

  pager lines 24

  opening of session

  interface ethernet0 10full

  interface ethernet1 10full

  Outside 1500 MTU

  Within 1500 MTU

  outdoor IP 10.0.0.3 255.0.0.0

  IP address inside 192.168.0.1 255.255.255.0

  alarm action IP verification of information

  alarm action attack IP audit

  location of PDM 192.168.0.100 255.255.255.255 inside

  location of PDM 192.168.0.0 255.255.0.0 inside

  location of PDM 192.168.0.128 255.255.255.255 inside

  location of PDM 192.168.0.135 255.255.255.255 inside

  location of PDM 192.168.11.0 255.255.255.0 outside

  location of PDM 192.168.11.0 255.255.255.0 inside

  location of PDM 80.37.246.195 255.255.255.255 outside

  location of PDM 192.168.0.254 255.255.255.255 outside

  PDM 100 debug logging

  history of PDM activate

  ARP timeout 14400

  Global 1 interface (outside)

  (Inside) NAT 0-list of access 101

  NAT (inside) 1 0.0.0.0 0.0.0.0 0 0

  static (inside, outside) 10.0.0.10 192.168.0.100 netmask 255.255.255.255 0 0

  Access-group outside_access_in in interface outside

  inside_access_in access to the interface inside group

  Route outside 0.0.0.0 0.0.0.0 10.0.0.2 1

  Timeout xlate 0:05:00

  Conn Timeout 0:00:00 half closed 0: 10:00 udp 0:02:00 CPP 0: h323 from 10:00 0: 05:00 sip 0:30:00

  sip_media 0:02:00

  Timeout, uauth 0:00:00 absolute

  GANYMEDE + Protocol Ganymede + AAA-server

  RADIUS Protocol RADIUS AAA server

  AAA-server local LOCAL Protocol

  authenticate the NTP

  NTP server 192.43.244.18 source outdoors

  NTP server 128.118.25.3 prefer external source

  Enable http server

  http 192.168.0.100 255.255.255.255 inside

  http 192.168.0.128 255.255.255.255 inside

  http 192.168.0.135 255.255.255.255 inside

  http 192.168.11.0 255.255.255.0 inside

  No snmp server location

  No snmp Server contact

  SNMP-Server Community public

  No trap to activate snmp Server

  enable floodguard

  Permitted connection ipsec sysopt

  No sysopt route dnat

  Crypto ipsec transform-set esp - esp-md5-hmac COMUN_BCN

  Polinyà 1 ipsec-isakmp crypto map

  correspondence address 1 card crypto Polinyà 101

  card crypto Polinyà 1 set peer 80.37.246.195

  card crypto Polinyà 1 the transform-set COMUN_BCN value

  interface to crypto map outdoors Polinyà

  ISAKMP allows outside

  ISAKMP key * address 80.37.246.195 netmask 255.255.255.255

  ISAKMP identity address

  part of pre authentication ISAKMP policy 1

  of ISAKMP policy 1 encryption

  ISAKMP policy 1 md5 hash

  1 1 ISAKMP policy group

  ISAKMP policy 1 lifetime 1000

  Telnet 192.168.0.128 255.255.255.255 inside

  Telnet 192.168.0.135 255.255.255.255 inside

  Telnet 192.168.11.0 255.255.255.0 inside

  Telnet timeout 10

  SSH timeout 5

  username password QSECOFR privilege ELFfg8t/K5UMO89z encrypted 15

  Terminal width 80

  Cryptochecksum:74cd0cf16ef2c35804dffaeee924efdf

  WATBCINX1 #.

  PIX 501 Setup (remote site):

  CTXPOINX1 # sh conf

  : Saved

  : Written by enable_15 to the CEDT 09:27:14.439 Friday, June 20, 2003

  6.2 (2) version PIX

  ethernet0 nameif outside security0

  nameif ethernet1 inside the security100

  activate qU51Wrx8ggFHLusK encrypted password

  qU51Wrx8ggFHLusK encrypted passwd

  hostname CTXPOINX1

  NEOKEM domain name. LAN

  clock timezone THATS 1

  clock to summer time CEDT recurring last Sun Mar 02:00 last Sun Oct 03:00

  fixup protocol ftp 21

  fixup protocol http 80

  fixup protocol h323 h225 1720

  fixup protocol h323 ras 1718-1719

  fixup protocol they 389

  fixup protocol rsh 514

  fixup protocol rtsp 554

  fixup protocol smtp 25

  fixup protocol sqlnet 1521

  fixup protocol sip 5060

  fixup protocol 2000 skinny

  no names

  name 80.32.132.188 BCN

  access-list inside_access_in allow a tcp

  Allow Access-list inside_access_in a whole udp

  access-list inside_access_in allow icmp a whole

  inside_access_in ip access list allow a whole

  access-list outside_access_in allow icmp a whole

  access-list 101 permit ip 192.168.11.0 255.255.255.0 192.168.0.0 255.255.255.0

  pager lines 24

  opening of session

  interface ethernet0 10baset

  interface ethernet1 10full

  Outside 1500 MTU

  Within 1500 MTU

  IP 10.0.0.1 address outside 255.0.0.0

  IP address inside 192.168.11.2 255.255.255.0

  alarm action IP verification of information

  alarm action attack IP audit

  location of PDM 192.168.0.0 255.255.0.0 inside

  location of PDM 192.168.11.0 255.255.255.255 inside

  PDM 100 debug logging

  history of PDM activate

  ARP timeout 14400

  Global 1 interface (outside)

  (Inside) NAT 0-list of access 101

  NAT (inside) 1 0.0.0.0 0.0.0.0 0 0

  Access-group outside_access_in in interface outside

  inside_access_in access to the interface inside group

  Route outside 0.0.0.0 0.0.0.0 10.0.0.2 1

  Timeout xlate 0:05:00

  Conn Timeout 0:00:00 half closed 0: 10:00 udp 0:02:00 CPP 0: h323 from 10:00 0: 05:00 sip 0:30:00

  sip_media 0:02:00

  Timeout, uauth 0:00:00 absolute

  GANYMEDE + Protocol Ganymede + AAA-server

  RADIUS Protocol RADIUS AAA server

  AAA-server local LOCAL Protocol

  authenticate the NTP

  NTP server 192.5.41.209 prefer external source

  Enable http server

  HTTP 80.32.132.188 255.255.255.255 outside

  http 192.168.0.0 255.255.0.0 inside

  http 192.168.11.0 255.255.255.255 inside

  No snmp server location

  No snmp Server contact

  SNMP-Server Community public

  No trap to activate snmp Server

  enable floodguard

  Permitted connection ipsec sysopt

  No sysopt route dnat

  Crypto ipsec transform-set esp - esp-md5-hmac COMUN

  BCN 1 ipsec-isakmp crypto map

  card crypto bcn 1 set peer 80.32.132.188

  card crypto bcn 1 the transform-set COMMON value

  bcn outside crypto map interface

  ISAKMP allows outside

  ISAKMP key * address 80.32.132.188 netmask 255.255.255.255

  ISAKMP identity address

  part of pre authentication ISAKMP policy 1

  of ISAKMP policy 1 encryption

  ISAKMP policy 1 md5 hash

  1 1 ISAKMP policy group

  ISAKMP policy 1 lifetime 1000

  Telnet 80.32.132.188 255.255.255.255 outside

  Telnet 192.168.0.0 255.255.0.0 inside

  Telnet timeout 10

  SSH timeout 5

  username password QSECOFR privilege ELFfg8t/K5UMO89z encrypted 15

  Terminal width 80

  Cryptochecksum:dc8d08655d07886b74d867228e84f70f

  CTXPOINX1 #.

  Hello

  You left out of your config VPN 501 correspondence address... put this in...

  correspondence address 1 card crypto bcn 101

  Hope that helps...