PIX to PIX VPN using Ipsec Tunnel. Need help please.

Hello everyone,

I have a connection of two sites using 506th PIX and PIX 501. The one on the central site (WATBCINX1 - 506th PIX) sends the packet correctly and one on the remote site (CTXPOINX1 - PIX 501) receives (checked using icmp backtrace on the two PIX). The problem is that PIX 501 at remote site return packages. I have to say that the two PIX hace a 3com OfficeConnect ADSL router as gateway Internet 812. If someone could help me I would appreciate it a lot. Thank you!

PIX 506th Configuration (central site):

WATBCINX1 # sh conf

: Saved

: Written by enable_15 to the CEDT 08:36:50.090 Friday, June 20, 2003

6.2 (2) version PIX

ethernet0 nameif outside security0

nameif ethernet1 inside the security100

activate qU51Wrx8ggFHLusK encrypted password

qU51Wrx8ggFHLusK encrypted passwd

hostname WATBCINX1

NEOKEM domain name. LAN

clock timezone THATS 1

clock to summer time CEDT recurring last Sun Mar 02:00 last Sun Oct 03:00

fixup protocol ftp 21

fixup protocol http 80

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol they 389

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol sip 5060

fixup protocol 2000 skinny

no names

name 80.37.246.195 POLINYÀ

access-list outside_access_in allow accord any host 10.0.0.10

outside_access_in list access permit tcp any host 10.0.0.10 eq 1723

outside_access_in list access permit tcp any host 10.0.0.10 eq smtp

outside_access_in list access permit tcp any host 10.0.0.10 eq pop3

access-list outside_access_in allow icmp a whole

inside_access_in ip access list allow a whole

access-list inside_access_in allow a tcp

access-list inside_access_in allow icmp a whole

Allow Access-list inside_access_in a whole udp

access-list 101 permit ip 192.168.0.0 255.255.255.0 192.168.11.0 255.255.255.0

pager lines 24

opening of session

interface ethernet0 10full

interface ethernet1 10full

Outside 1500 MTU

Within 1500 MTU

outdoor IP 10.0.0.3 255.0.0.0

IP address inside 192.168.0.1 255.255.255.0

alarm action IP verification of information

alarm action attack IP audit

location of PDM 192.168.0.100 255.255.255.255 inside

location of PDM 192.168.0.0 255.255.0.0 inside

location of PDM 192.168.0.128 255.255.255.255 inside

location of PDM 192.168.0.135 255.255.255.255 inside

location of PDM 192.168.11.0 255.255.255.0 outside

location of PDM 192.168.11.0 255.255.255.0 inside

location of PDM 80.37.246.195 255.255.255.255 outside

location of PDM 192.168.0.254 255.255.255.255 outside

PDM 100 debug logging

history of PDM activate

ARP timeout 14400

Global 1 interface (outside)

(Inside) NAT 0-list of access 101

NAT (inside) 1 0.0.0.0 0.0.0.0 0 0

static (inside, outside) 10.0.0.10 192.168.0.100 netmask 255.255.255.255 0 0

Access-group outside_access_in in interface outside

inside_access_in access to the interface inside group

Route outside 0.0.0.0 0.0.0.0 10.0.0.2 1

Timeout xlate 0:05:00

Conn Timeout 0:00:00 half closed 0: 10:00 udp 0:02:00 CPP 0: h323 from 10:00 0: 05:00 sip 0:30:00

sip_media 0:02:00

Timeout, uauth 0:00:00 absolute

GANYMEDE + Protocol Ganymede + AAA-server

RADIUS Protocol RADIUS AAA server

AAA-server local LOCAL Protocol

authenticate the NTP

NTP server 192.43.244.18 source outdoors

NTP server 128.118.25.3 prefer external source

Enable http server

http 192.168.0.100 255.255.255.255 inside

http 192.168.0.128 255.255.255.255 inside

http 192.168.0.135 255.255.255.255 inside

http 192.168.11.0 255.255.255.0 inside

No snmp server location

No snmp Server contact

SNMP-Server Community public

No trap to activate snmp Server

enable floodguard

Permitted connection ipsec sysopt

No sysopt route dnat

Crypto ipsec transform-set esp - esp-md5-hmac COMUN_BCN

Polinyà 1 ipsec-isakmp crypto map

correspondence address 1 card crypto Polinyà 101

card crypto Polinyà 1 set peer 80.37.246.195

card crypto Polinyà 1 the transform-set COMUN_BCN value

interface to crypto map outdoors Polinyà

ISAKMP allows outside

ISAKMP key * address 80.37.246.195 netmask 255.255.255.255

ISAKMP identity address

part of pre authentication ISAKMP policy 1

of ISAKMP policy 1 encryption

ISAKMP policy 1 md5 hash

1 1 ISAKMP policy group

ISAKMP policy 1 lifetime 1000

Telnet 192.168.0.128 255.255.255.255 inside

Telnet 192.168.0.135 255.255.255.255 inside

Telnet 192.168.11.0 255.255.255.0 inside

Telnet timeout 10

SSH timeout 5

username password QSECOFR privilege ELFfg8t/K5UMO89z encrypted 15

Terminal width 80

Cryptochecksum:74cd0cf16ef2c35804dffaeee924efdf

WATBCINX1 #.

PIX 501 Setup (remote site):

CTXPOINX1 # sh conf

: Saved

: Written by enable_15 to the CEDT 09:27:14.439 Friday, June 20, 2003

6.2 (2) version PIX

ethernet0 nameif outside security0

nameif ethernet1 inside the security100

activate qU51Wrx8ggFHLusK encrypted password

qU51Wrx8ggFHLusK encrypted passwd

hostname CTXPOINX1

NEOKEM domain name. LAN

clock timezone THATS 1

clock to summer time CEDT recurring last Sun Mar 02:00 last Sun Oct 03:00

fixup protocol ftp 21

fixup protocol http 80

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol they 389

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol sip 5060

fixup protocol 2000 skinny

no names

name 80.32.132.188 BCN

access-list inside_access_in allow a tcp

Allow Access-list inside_access_in a whole udp

access-list inside_access_in allow icmp a whole

inside_access_in ip access list allow a whole

access-list outside_access_in allow icmp a whole

access-list 101 permit ip 192.168.11.0 255.255.255.0 192.168.0.0 255.255.255.0

pager lines 24

opening of session

interface ethernet0 10baset

interface ethernet1 10full

Outside 1500 MTU

Within 1500 MTU

IP 10.0.0.1 address outside 255.0.0.0

IP address inside 192.168.11.2 255.255.255.0

alarm action IP verification of information

alarm action attack IP audit

location of PDM 192.168.0.0 255.255.0.0 inside

location of PDM 192.168.11.0 255.255.255.255 inside

PDM 100 debug logging

history of PDM activate

ARP timeout 14400

Global 1 interface (outside)

(Inside) NAT 0-list of access 101

NAT (inside) 1 0.0.0.0 0.0.0.0 0 0

Access-group outside_access_in in interface outside

inside_access_in access to the interface inside group

Route outside 0.0.0.0 0.0.0.0 10.0.0.2 1

Timeout xlate 0:05:00

Conn Timeout 0:00:00 half closed 0: 10:00 udp 0:02:00 CPP 0: h323 from 10:00 0: 05:00 sip 0:30:00

sip_media 0:02:00

Timeout, uauth 0:00:00 absolute

GANYMEDE + Protocol Ganymede + AAA-server

RADIUS Protocol RADIUS AAA server

AAA-server local LOCAL Protocol

authenticate the NTP

NTP server 192.5.41.209 prefer external source

Enable http server

HTTP 80.32.132.188 255.255.255.255 outside

http 192.168.0.0 255.255.0.0 inside

http 192.168.11.0 255.255.255.255 inside

No snmp server location

No snmp Server contact

SNMP-Server Community public

No trap to activate snmp Server

enable floodguard

Permitted connection ipsec sysopt

No sysopt route dnat

Crypto ipsec transform-set esp - esp-md5-hmac COMUN

BCN 1 ipsec-isakmp crypto map

card crypto bcn 1 set peer 80.32.132.188

card crypto bcn 1 the transform-set COMMON value

bcn outside crypto map interface

ISAKMP allows outside

ISAKMP key * address 80.32.132.188 netmask 255.255.255.255

ISAKMP identity address

part of pre authentication ISAKMP policy 1

of ISAKMP policy 1 encryption

ISAKMP policy 1 md5 hash

1 1 ISAKMP policy group

ISAKMP policy 1 lifetime 1000

Telnet 80.32.132.188 255.255.255.255 outside

Telnet 192.168.0.0 255.255.0.0 inside

Telnet timeout 10

SSH timeout 5

username password QSECOFR privilege ELFfg8t/K5UMO89z encrypted 15

Terminal width 80

Cryptochecksum:dc8d08655d07886b74d867228e84f70f

CTXPOINX1 #.

Hello

You left out of your config VPN 501 correspondence address... put this in...

correspondence address 1 card crypto bcn 101

Hope that helps...

Tags: Cisco Security

Similar Questions

Maybe you are looking for