Question of WRV210 VPN RVS4000

Similar Questions

• SA520 and Question IPSec VPN RVS4000

  Hello

  I installed an IPSec VPN for one of my friends for his company. At its principal office, I installed a Cisco SA520 and he uses to connect devices such as the iPhone and iPad via the IPSec VPN. He uses this fact because he travels abroad a lot and he has problems with services such as Skype is blocked in some countries. This configuration works very well.

  It also has a Cisco RVS4000, which he would like to install at his place of business to the Mexico. He would like the RVS4000 VPN configuration to the SA520 in his office. The SA520 in his office has a static IP address. The RVS4000 to the Mexico does not work.

  Is it possible to Setup IPSec VPN between a SA520 with a static IP and RVS4000 address that does not have a static IP address? If so, examples of configuration would be greatly appreciated.

  Thank you!

  Hi William, simply sign up for a dyndns account or similar service, the RVS4000 configuration will be the same, instead of the IP, you'd be using the dyndns name.

  -Tom
  Please mark replied messages useful

• VPN RVS4000 And Mac

  We configure just the RVS4000 in our office as our router. We do not have set up VPN features on it yet. I travel mainly with a MacBook Pro on the road, so I would like to VPN in my office.

  My Mac running OS X Lion.

  We are on a static IP address to the Agency.

  What should I do to get my Mac to connect to a VPN on the RVS4000?

  Do I need third party software, or built-in to OS X VPN clients work?

  What are the steps I need to do it at the level of the router to establish a VPN connection on him to connect my Mac?

  I went through the manual, but I'm still not sure 100% what I need to do (good info in the manual of good).

  BTW, this is the V2 version I'm.

  Thank you!

  Nathan,

  Since you use Mac book pro, you will need to download a third party software. Other clients, I've seen using IPsecuritias.

  http://www.Lobotomo.com/products/IPSecuritas/

  Thank you

  Support Cisco engineer

  .:|:.:|:.

  http://download.CNET.com/IPSecuritas/3000-18512_4-10278425.html

• In Forefront TMG IPSec VPN RVS4000

  Hello

  We set up a site to site VPN using a Cisco RVS4000 at one end and TMG to another.  When initiate us communication (PING) from a client on the local network of TMG, the binding is ESTABLISHED and both directions of traffic flow.  However, if we start the communication between the local network of Cisco, the time-out of PINGs and link remains DOWN.  For the Cisco VPN log file is locked.

  We verified that the IPSec settings at each corresponding end and also tried to update the firmware of 2.0.2.7.  Each side of the tunnel of thje uses a public IP with any NAT device between the two.

  Ideas or suggestions appreciated.

  Ian

  I have exactly the same problem

  someone at - it solution

• Question of dynamic VPN

  Trying to setup VPN Dynamic tunnels site to site our ASA with a static ip address by using the correct method of Cisco. We do it for a few years, but apparently this is not the recommended method. We were advised to use the DefaultL2LGroup method.

  We have the standard model, but I do not see how this will work without the access lists we used previously.

  .

  ---------

  Model

  ---------

  Crypto ipsec transform-set esp - esp-md5-hmac RIGHT
  !
  Crypto-map mymap 1 transform-set RIGHT Dynamics
  Crypto-map mymap Dynamics 1 the value reverse-road
  10 IPSec-isakmp crypto map dyn-map mymap Dynamics
  dyn-map interface card crypto outside
  !
  crypto ISAKMP policy 10
  preshared authentication
  the Encryption
  md5 hash
  Group 2
  life 86400
  !
  IPSec-attributes tunnel-group DefaultL2LGroup
  pre-shared-key *.

  .

  ---------

  Previous config to access list

  ---------

  address the Site1 72 of the crypto dynamic-map WAN_cryptomap_59

  WAN_cryptomap_59 list extended access permitted ip object HQ Site1

  Hello

  Please follow below document

  TP: / /www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-gener...

  Concerning

  #Rohan

• Question of P2P VPN One Way

  Hello support,

  I'm having a problem with a P2P VPN. Our side is a Cisco ASA 5512 and peripheral supplier is a firewall of some sort. When launch us the VPN from Cisco ASA end 5512, the VPN is fine without problem and communication goes on both sides. If I take the VPN down and then he tries to launch the VPN, I never see same traffic come into our firewall, and it does not come to the top. When we do a trace of their inside network inside our network (when you start their end), the trace goes to some edge devices at their end and outside the ISP. There are actually a few public IPs in the traceroute, but when launch us the VPN to our end and before you run a trace on their end, these same public IPs do not show in the trace.

  It almost seems like they have a device on their end which does not correctly handle the NAT or SHEEP for private subnets. Does this sound accurate?

  Just to remind, when launch us the VPN, look clean and only private IPs see traces on both ends. When they start the VPN, traffic never hit our firewalls and traces of their late show public IPs on the route.

  From now on, we keep a ping running to keep alive the VPN, but it's not ideal. Here, any help would be greatly appreciated.

  Hey John,

  are you sure that when they start their home subnet traffic, it is hitting the vpn.

  Please ask them to run debug crypto since their end and if the first protocol udp 500 is even sent to their end.

  Now, in order to follow the tunnel, you can configure SLA monitoring on the ASA:

  Please follow the discussion below to set up the same:

  https://supportforums.Cisco.com/discussion/11012751/IP-SLA-monitor-VPN

• Question of redundancy VPN l2l using 2811 as endpoint devices

  I have a new implementation of VPN L2L passes using two 2811 s than VPN terminal devices. I'll try to use the HSRP address between the public interfaces of both routers as VPN peer address. The problem that I found during the test is that the tunnel will become active and debugs watch the HSRP address as an invalid address to form the tunnel. Have a work-around, or a better plan for redundancy on peering address using similar devices? Thanks in advance.

  Take a look at this doc about IOS IPSec HA.

  http://www.Cisco.com/en/us/docs/iOS/security/configuration/guide/sec_vpn_ha_enhance_ps6922_TSD_Products_Configuration_Guide_Chapter.html#wp1039849

• Simple Question on 877 VPN functionality

  Where can I find namely how the router throughput is affected when there are configured VPN Tunnels? or if there is someone who can give me this info... I have just didn? find it in the data sheet. Thank you

  Refer to page 61

  http://www.Cisco.com/application/PDF/en/us/guest/NetSol/ns171/c649/ccmigration_09186a008073a0c5.PDF

  871 and 877 have the same architecture.

  or

  http://www.Cisco.com/Web/partners/downloads/765/tools/quickreference/vpn_performance_eng.PDF

• Question of access VPN Tunnel

  I was wondering if there is a way to allow only one side of a vpn tunnel to create connections?

  Example I have a vpn tunnel going to a site with servers that I manage. I want to be able to get on the servers (via rdp, ssh, etc.) and allow the return of traffic but I don't want the servers to be able to reach me (via rdp, ssh, etc.).

  Any ideas?

  I use a cisco ASA5540

  Hello

  You have alteast 2 possibilities

  • You can configure a filter ACL on the L2L VPN connection VPN
    • Long-term a solution a little messier. Mainly due to the ACL filter of VPN L2L having a slightly different configuration than the usual ACL interface format
  • You can turn off (if not already disabled) feature that allows to bypass your 'outer' interface ACL all traffic entering from a VPN connection. In this way, you can control incoming VPN L2L with ACL 'outside' interface traffic.
    • connections are allowed as any other Internet connection in the "outside" interface ACL if its fairly simple to manage.

  If this is something you are looking for I can tell you how to get to one of them.

  -Jouni

• interesting question of the vpn site to site NAT/PAT traffic config

  I have an ASA 8.4.2 running code and am just checking the Site to site configs before migration of tunnel. more precisely if the NAT/PAT and ACL is correct. Phase 1 is already defined and work, as well as cryptographic maps and tunnel groups.

  When you set the traffic interesting in the ACL are you using NAT or the real IP? The order of the ACL is correct?

  First of all:

  The vedor network is a 192.168.1.10 and must be coordinated to 10.1.0.2

  name 5.6.7.8 VendorName object-group network VendorName-R network-object host 192.168.1.10 object-group network VendorName-NAT-R network-object host 10.1.0.2 object-group network VendorName-L network-object host 10.1.1.3 access-list VendorName-crypto extended permit ip object-group VendorName-L object-group VendorName-NAT-R nat (inside,outside) 1 source static VendorName-L VendorName-NAT-R destination static VendorName-R VendorName-R

  Second:

  Sellers network is 192.168.1.0 to 192.168.2.0, these must be PATed 10.1.0.2 and 10.1.0.3

  192.168.1.20 and 168.1.21 must be staticly using a NAT 10.1.0.4 and 10.1.0.5

  Name the SupplierName 5.6.7.8

  object-group network VendorName-R-1

  network-object subnet 192.168.1.0 255.255.255.0

  object-group network VendorName-R-2

  network-object subnet 192.168.2.0 255.255.255.0

  object-group network VendorName-R-3

  network-object host 192.168.1.20

  object-group network VendorName-R-4

  network-object host 192.168.1.21

  object-group network VendorName-NAT-R-1

  network-object host 10.1.0.2

  object-group network VendorName-NAT-R-2

  network-object host 10.1.0.3

  object-group network VendorName-NAT-R-3

  network-object host 10.1.0.4

  object-group network VendorName-NAT-R-4

  network-object host 10.1.0.5

  object-group network VendorName-R

  network-object VendorName-NAT-R-1

  network-object VendorName-NAT-R-2

  network-object VendorName-NAT-R-3

  network-object VendorName-NAT-R-4

  object-group network VendorName-L

  network-object host 10.1.1.3

  the object-Network 10.1.1.6 host

  VendorName-crypto allowed extended ip access-list object-VendorName-L Group VendorName-R

  NAT (inside, outside) 1 dynamic source VendorName-l VendorName-NAT-R-1 static destination VendorName-R-1 VendorName-R-1

  NAT (inside, outside) 1 dynamic source VendorName-l VendorName-NAT-R-2 static destination VendorName-R-2 VendorName-R-2

  NAT (inside, outside) 1 static source VendorName-l VendorName-NAT-R-3 of destination VendorName-R-3 static VendorName-R-3

  NAT (inside, outside) 1 static source VendorName-l VendorName-NAT-R-4 static destination VendorName-R-4 VendorName-R-4

  Your valuable traffic acl MUST be the IP NAT address.

• VPN question: ISP assigned a private ip address

  Hi all

  Internet-online-online headquarters VPN 3015 concentrator

  Users remote VPN Client connected to the internet using a private ip address provided by the ISP (cable) is to establish a VPN tunnel, but they can not ping our private network.

  The only way to get the VPN works is when remote users use a public ip.

  It is a question of Cisco VPN Client? Or it has a solution...

  Thanks in advance,

  Kind regards

  Carlos Welhous

  Network engineer

  Hi Carlos,

  If your ISP gave you a private address, they must use NAT - in which case you will have to enable NAT - T on the VPN concentrator.

  To configure the NAT - T in the world, go to Configuration | System | Tunnelling protocols. IPSec | Screen of transparent NAT and check on NAT - T IPSec case.

• Question about the connection of a customer VPN ASA

  Hi guys,.

  I have a question about Tunneling VPN. I have an ASA 5505 with static PPPoE address external and local 192.168.202.0/24 network, operates as an EasyVPN server. On the other side is an another ASA 5505 without dynamic PPPoE outside interface acting as EasyVPN customer in customer ode. The internal network is 192.168.1.0/24

  It works very well! But now, I created another user who uses EasyVPN client software to connect to the EasyVPN server. This works as well.

  But how am I able to connect customer network 192.168.1.0/24 on the connections of the ASA?

  Please give me a hint.

  "But how am I able to connect customer network 192.168.1.0/24 on the connections of the ASA?

  Yes, if you set the ACL of split tunnel correctly you should be able to connect to the remote client ASA.

  Please follow the method of configuration of Cisco doc split tunnel, at the bottom of the link.

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a00808a61f4.shtml

  Evaluate the useful ticket.

  Thank you

  Rizwan James

• VPN site to Site with restrictions (vpn-filter)

  VPN site to site, I installed and it works fine and two site can meet but I question after the vpn enforcement - run under Group Policy

  restrict users in the local site for dial-up networking with specific tcp ports, the vpn does not not like after order question «sh l2l vpn-sessiondb»

  This works but users can't access something in the remote site

  Note > after rising online in ACL at the end with this

  US_SITE ip access list allow a whole

  new to works well again

  example of a line of Access-List

  US_SITE list extended access permit tcp host 10.68.22.50 host 192.168.10.23 HTTP_HTTPS object-group
  US_SITE list extended access permit tcp host 10.68.22.50 host 192.168.10.24 HTTP_HTTPS object-group

  local network: 10.68.22.50

  remote network: 192.168.10.24

  is that correct or not?

  attributes of the strategy group x.x.x.x
  value of VPN-filer US_SITE

  tunnel-group General y.y.y.y
  x.x.x.x by default-group-policy

  Note: allowed sysopt active vpn connection

  The syntax on ACL that is used as a vpn-filter is different from what is normally expected. These VPN filters is not a direction, it should be noted the traffic we want to allow incoming and outgoing of the VPN in an ACL. The syntax for this is:

  access-list X permit/deny REMOTE-DEFINITION LOCAL-DEFINITION

  Example: You want to allow local users to access the RDP on the remote site:

  access-list VPN-ACL permit tcp host 192.168.10.24 eq 3389 10.68.22.0 255.255.255.0

  Disadvantage: This is all really confusing, and you can't afford things like Ping in one direction.

• ASA VPN

  Hello

  I have a question concerning the VPN, is it possible to configure the two IPsec VPN site-to-site and remote access vpn on the same ASA and working at the same time, does require one or two different public ip addresses?

  I have cisco ASA 5540 - version 9.1

  Best regards

  Hello

  Yes, you can with 1 single public ip address. You need to activate the same-security-traffic allow intra-interface functionality to allow a customer vpn site-to-site vpn access if you need.

  Take a look at the Cisco documentation;

  http://www.Cisco.com/c/en/us/support/docs/security/ASA-5500-x-series-NEX...

  Thank you

  PS: Please do not forget to rate and score as good response if this solves your problem

• SonicWall VPN PIX - does not, could someone help?

  Hi all

  I'm trying to set up an a 506th PIX VPN tunnel (firmware 6.3 (2)), a firewall SonicWall Pro. It does not at the moment. Phase 1 is ok but the phase 2 is not, the VPN tunnel has not been established, and the security association is removed after a minute or two. I enclose below the PIX config and an attempt to create VPN tunnel debugging output (slightly modified and cut for reasons of confidentiality). The PIX already has other two VPN configured which work perfectly.

  I would be very grateful to anyone who could help me answer the following questions about this VPN configuration:

  1. to debug output, which means the next?

  ISAKMP (0): retransmission of the phase 2 (0/0)... mess_id 0xafc08a94

  crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

  ISAKMP: error msg not encrypted

  2. in the config, I don't know if the 3 static controls are necessary and how it might interact... What do you think?

  3. in what order things happen in the PIX when traffic is from the local network to remote network by VPN? What is NAT then treatment then setting up VPN to access list? or or treatment, then NAT and VPN to access list? or another possibility?

  4. How can I get it work?

  Thank you very much in advance for any help provided,

  A.G.

  ########### NAMING #################################

  vpnpix1 - is the local cisco PIX

  remotevpnpeer - is the Sonicwall firewall remote

  Intranet - is the local network behind PIX

  remotevpnLAN - is the remote network behind the SonicWall

  ################ CONFIG #############################

  6.3 (2) version PIX

  interface ethernet0 10full

  interface ethernet1 10full

  ethernet0 nameif outside security0

  nameif ethernet1 inside the security100

  .../...

  hostname vpnpix1

  .../...

  names of

  name A.B.C.D vpnpix1-e1

  name X.Y.Z.T vpnpix1-e0

  name E.F.G.H defaultgw

  intranet name 10.0.0.0

  name 192.168.250.0 nat-intranet

  name J.K.L.M internetgw

  name 10.M.N.P server1

  name Server2 10.M.N.Q

  name 10.M.N.R server3

  name 192.168.252.0 remotevpnLAN

  name 10.1.71.0 nat-remotevpnLAN

  .../...

  object-group network server-group

  description servers used by conencted to users remote LAN through a VPN tunnel

  network-host server1 object

  host Server2 network-object

  network-host server3 object

  .../...

  access allowed INCOMING tcp nat-remotevpnLAN 255.255.255.0 list object-group server-eq - ica citrix

  .../...

  OUTBOUND ip intranet 255.0.0.0 allowed access list nat-remotevpnLAN 255.255.255.0

  access list permits INTRANET-to-remotevpnLAN-VPN ip intranet 255.0.0.0 255.255.255.0 remotevpnLAN

  access-list SHEEP, remotevpnLAN permits intranet ip 255.0.0.0 255.255.255.0 nat-remotevpnLAN

  .../...

  IP address outside the vpnpix1-e0 255.255.255.240

  IP address inside the vpnpix1-e1 255.255.252.0

  .../...

  Global 192.168.250.1 1 (outside)

  NAT (inside) 0 access-list SHEEP-to-remotevpnLAN

  NAT (inside) 1 intranet 255.0.0.0 0 0

  .../...

  static (inside, outside) server1 server1 netmask 255.255.255.255 0 0

  public static server2 (indoor, outdoor) server2 netmask 255.255.255.255 0 0

  public static server3 (indoor, outdoor) server3 netmask 255.255.255.255 0 0

  static (exterior, Interior) nat-remotevpnLAN remotevpnLAN netmask 255.255.255.0 0 0

  .../...

  Access-group ENTERING into the interface outside

  Access-group OUTGOING in the interface inside

  Route outside 0.0.0.0 0.0.0.0 internetgw 1

  Route inside the intranet 255.0.0.0 defaultgw 1

  .../...

  Permitted connection ipsec sysopt

  .../...

  Crypto ipsec transform-set esp-3des esp-md5-hmac VPN - TS1

  .../...

  map BusinessPartners 30 ipsec-isakmp crypto

  card crypto BusinessPartners 30 matches the INTRANET-to-remotevpnLAN-VPN address

  card crypto BusinessPartners 30 set peer remotevpnpeer

  card crypto BusinessPartners 30 game of transformation-VPN-TS1

  BusinessPartners outside crypto map interface

  ISAKMP allows outside

  .../...

  ISAKMP key * address remotevpnpeer netmask 255.255.255.255

  ISAKMP identity address

  part of pre authentication ISAKMP policy 10

  ISAKMP policy 10 3des encryption

  ISAKMP policy 10 md5 hash

  10 2 ISAKMP policy group

  ISAKMP life duration strategy 10 28800

  part of pre authentication ISAKMP policy 20

  ISAKMP policy 20 3des encryption

  ISAKMP policy 20 chopping sha

  20 2 ISAKMP policy group

  ISAKMP duration strategy of life 20 28800

  part of pre authentication ISAKMP policy 30

  ISAKMP policy 30 3des encryption

  ISAKMP policy 30 md5 hash

  30 1 ISAKMP policy group

  ISAKMP duration strategy of life 30 28800

  .../...

  : end

  ################## DEBUG ############################

  vpnpix1 # debug crypto isakmp

  vpnpix1 #.

  ISAKMP (0): early changes of Main Mode

  crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

  Exchange OAK_MM

  ISAKMP (0): treatment ITS payload. Message ID = 0

  ISAKMP (0): audit ISAKMP transform 1 against the policy of priority 10

  ISAKMP: 3DES-CBC encryption

  ISAKMP: MD5 hash

  ISAKMP: default group 2

  ISAKMP: preshared auth

  ISAKMP: type of life in seconds

  ISAKMP: duration of life (basic) of 28800

  ISAKMP (0): atts are acceptable. Next payload is 0

  ISAKMP (0): ITS been pre-shared key, using id ID_IPV4_ADDR type authentication

  to return to the State is IKMP_NO_ERROR

  crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

  Exchange OAK_MM

  ISAKMP (0): processing KE payload. Message ID = 0

  ISAKMP (0): processing NONCE payload. Message ID = 0

  ISAKMP (0): load useful treatment vendor id

  ISAKMP (0): ID payload

  next payload: 8

  type: 1

  Protocol: 17

  Port: 500

  Length: 8

  ISAKMP (0): the total payload length: 12

  to return to the State is IKMP_NO_ERROR

  crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

  Exchange OAK_MM

  ISAKMP (0): processing ID payload. Message ID = 0

  ISAKMP (0): HASH payload processing. Message ID = 0

  ISAKMP (0): SA has been authenticated.

  ISAKMP (0): start Quick Mode Exchange, M - ID - 1346336108:afc08a94

  to return to the State is IKMP_NO_ERROR

  ISAKMP (0): send to notify INITIAL_CONTACT

  ISAKMP (0): sending message 24578 NOTIFY 1 protocol

  Peer VPN: ISAKMP: approved new addition: ip:remotevpnpeer / 500 Total VPN peer: 3

  Peer VPN: ISAKMP: Peer ip:remotevpnpeer / 500 Ref cnt incremented: 1 Total VPN peer: 3

  crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

  ISAKMP (0): processing NOTIFY payload Protocol 14 1

  SPI 0, message ID = 476084314

  to return to the State is IKMP_NO_ERR_NO_TRANS

  ISAKMP (0): retransmission of the phase 2 (0/0)... mess_id 0xafc08a94

  crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

  ISAKMP: error msg not encrypted

  ISAKMP (0): start Quick Mode Exchange, M - ID 1919346690:7266e802

  crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

  ISAKMP: error msg not encrypted

  ISAKMP (0): retransmission of the phase 2 (1: 1)... mess_id 0xafc08a94

  crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

  ISAKMP: error msg not encrypted

  ISAKMP (0): retransmission of the phase 2 (0/2)... mess_id 0x7266e802

  crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

  ISAKMP: error msg not encrypted

  ISAKMP (0): retransmission of the phase 2 (2/3)... mess_id 0xafc08a94

  crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

  ISAKMP: error msg not encrypted

  ISAKMP (0): retransmission of the phase 2 (1/4)... mess_id 0x7266e802

  crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

  ISAKMP: error msg not encrypted

  ISAKMP (0): start Quick Mode Exchange, M - ID - 1475513565:a80d7323

  ISAKMP (0): delete SA: CBC vpnpix1-e0, dst remotevpnpeer

  crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

  ISAKMP: drop msg deleted his

  ISADB: Reaper checking HIS 0x10ff1ac, id_conn = 0 DELETE IT!

  Peer VPN: ISAKMP: Peer ip:remotevpnpeer / 500 Ref cnt decremented for: 0 Total of VPN peer: 3

  Peer VPN: ISAKMP: deleted peer: ip:remotevpnpeer / 500 Total VPN peers: 2

  ISADB: Reaper checking HIS 0 x 1100984, id_conn = 0

  ISADB: Reaper checking HIS 0x10fcddc, id_conn = 0

  crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

  ISAKMP: its not located for ike msg

  #####################################################

  Get rid of:

  static (exterior, Interior) nat-remotevpnLAN remotevpnLAN netmask 255.255.255.0 0 0

  You don't need it. Change:

  OUTBOUND ip intranet 255.0.0.0 allowed access list nat-remotevpnLAN 255.255.255.0

  access-list SHEEP, remotevpnLAN permits intranet ip 255.0.0.0 255.255.255.0 nat-remotevpnLAN

  TO:

  access list permits OUTGOING ip intranet 255.0.0.0 255.255.255.0 remotevpnLAN

  access-list SHEEP, remotevpnLAN permits intranet ip 255.0.0.0 255.255.255.0 remotevpnLAN

  This indicates the PIX not NAT IPSec traffic. NAT happens BEFORE IPSec in the PIX, so if you the traffic IPSec nat it will never match your crypto access list and will not be encrypted.

  This, however, should not stop the tunnel of Phase 2 of the course of construction, they would stop flowing above the tunnel, traffic, so you still have a problem somewhere. What I'm guessing, is that the Sonicwall (SW) has a different encryption-defined list access, it must be the EXACT OPPOSITE of what is configured on the PIX. In other words, the SW should be encrypting the traffic of "remotevpnLAN-24" "intranet/8", make sure that the subnet mask ar ETHE same too. "

  To answer your questions:

  1. it simply means that the PIX has not received a response and is to retransmit the last ISAKMP packet. The process_block simply means that the PIX has dropped a package that was to be encrypted because the IPSec tunnel has not been built. If you get the tunnel built, these messages will disappear.

  2. the 3 first static does not appear to be linked to the tunnel IPSec, if they are simply to access a server inside, then they will not affect this VPN tunnel. The last of them should be deleted, as I already said.

  3. for traffic initiated from inside the PIX, the order is incoming ACL, then NAT, IPSec processing. That's why your OUTGOING ACL must allow traffic first, then your NAT 0 statement refuses to be NAT had, then the encryption function is the traffic and the number.

  4 do what I said above :-)

  If you still have no luck, re - run debugs, but initiate traffic behind the Sonicwall, in this way the Sonicwall will try and debug of build that the tunnel and you will get more information on the PIX. Mainly, we'll see what traffic model the SonicWall is configured to encrypt (you don't see if the PIX initiates the tunnel).