Tunnel established but no traffic passing on the Site 2 Site VPN

Similar Questions

• Try to upgrade Windows 7 Edition Home Premium to professional, but I can't access the site to upgrade. How to pass?

  original title: Windows7 Professional Upgrade

  I just bought a new computer running Windows 7 Edition Home Premium with an upgrade to windows 7 Pro. I have the PIN # for the upgrade, but I can't get the site to come www.windows7.com/get key. How to pass?

  If your PIN does not work, try the following:
  1. check that the PIN has been entered correctly. PIN code is not case sensitive and is alpha-numeric.
  2. make sure that the PIN has not already been used to obtain a product key. A PIN can be used only once to get a product key. If the PIN has been used, you can connect to your account with your Windows Live ID (if you have it when the PIN has been entered) to access your product key or you can check your email for the confirmation e-mail, that you have received when the PIN has been consumed to access your product key.
  3 contact support if you have any questions: www.windows7.com/getkeysupport.

• Pavilion 15-p108ne: my computer laptop p108ne I hope that I can install Windows 7 Windows 7 drivers. But what was not in the site

  My computer laptop p108ne I hope that I can install Windows 7 Windows 7 drivers. But what was not in the site

  Hello:

  You should be able to use the W7 x 64 drivers and software of p000-15 t on your model, except the BIOS and firmware files.

  http://support.HP.com/us-en/drivers/selfservice/HP-Pavilion-15-P000-notebook-PC-series/6936226/model/7174371

• Reactivate microsoft reader, but when I get on the site and I try get a 500 Server error

  Original title: 500 Server error.

  I'll have to re-enable the drive of microsoft, but when I get to the site and try I get a server 500 error is it possible around that I have hundreds of books with a value of eBooks that I can't access

  Original title: 500 Server error.

  I'll have to re-enable the drive of microsoft, but when I get to the site and try I get a server 500 error is it possible around that I have hundreds of books with a value of eBooks that I can't access

  Problem solved by other means.

• Good afternoon! I had a problem with Adobe Muse to pay. I was transferred to the free subscription. In a letter to the mailbox said he indicated that the need to update the card payment in detail, but I can do, and the site gives a

  Good afternoon! I had a problem with Adobe Muse to pay. I was transferred to the free subscription. In a letter to the mailbox said he indicated that the need to update the card payment in detail, but I can do, and the site gives an error. Credit card remains the same.

  Since this is an open forum, not Adobe support... you must contact Adobe personnel to help

  Chat/phone: Mon - Fri 05:00-19:00 (US Pacific Time)<=== note="" days="" and="">

  Don't forget to stay signed with your Adobe ID before accessing the link below

  Creative cloud support (all creative cloud customer service problems)

  http://helpx.Adobe.com/x-productkb/global/service-CCM.html

• I bought the 14 for Mac adobe elements.  Is there a download error.  I received an email with the serial number, but when I went on the site to download the illustrated product was 14 for Windows.  What is the download link for adobe elements 14

  I bought the 14 for Mac adobe elements.  Is there a download error.  I received an email with the serial number, but when I went on the site to download the illustrated product was 14 for Windows.  What is the download link for adobe elements 14 for Mac?

  Download & install instructions https://forums.adobe.com/thread/2003339 can help

  -includes a link to access a page to download the Adobe programs if you do not have a disk or drive

  -Cloud desktop http://helpx.adobe.com/creative-cloud/help/creative-cloud-desktop.html

  -Cloud Getting Started https://helpx.adobe.com/creative-cloud.html

  -you will need to enter your original serial number during the installation for non-Cloud programs

  - or kglad links in response to #1 here can help https://forums.adobe.com/thread/2081216

  Also go to https://forums.adobe.com/community/creative_cloud/creative_cloud_faq

• Client VPN und Cisco asa 5505 tunnel work but no traffic

  Hi all

  I am new to this forum and Don t have a lot of experience with Cisco, so I hope I can get help from specialists.

  I have the following problem:

  I installed und konfigured ASA 5505 for use with vpn client. I would like to access the local network from outside through vpn.

  To test, I installed ASA 5505 with ADSL (pppoe) and tried to give access to the internal network.

  Of course whenever I have recive the supplier's different IP address, but it didn't is not a problem reconfigure in the vpn client.

  After the connection is established (vpn tunnel work) I can see my external network packets. But I Don t have any connection to the internal network.

  I erased my setup yesterday and tried to reconfigure ASA again. I didn t tested yesterday, because it was too late. And I know that I Don t have the authorization rule at present by the ACL. But I think I'm having the same problem again. (tunnel but no traffic).

  What I did wrong. Could someone let me know what I have to do today.

  With hope for your help Dimitri.

  ASA configuration after reset and basic configuration: works to the Internet from within the course.

  : Saved

  : Written by enable_15 to the CEDT 20:29:18.909 Sunday, August 29, 2010

  !

  ASA Version 8.2 (2)

  !

  ciscoasa hostname

  activate 2KFQnbNIdI.2KYOU encrypted password

  2KFQnbNIdI.2KYOU encrypted passwd

  names of

  !

  interface Vlan1

  nameif inside

  security-level 100

  IP 192.168.1.1 255.255.255.0

  !

  interface Vlan2

  nameif outside

  security-level 0

  PPPoE client vpdn group home

  IP address pppoe setroute

  !

  interface Ethernet0/0

  switchport access vlan 2

  !

  interface Ethernet0/1

  !

  interface Ethernet0/2

  !

  interface Ethernet0/3

  !

  interface Ethernet0/4

  !

  interface Ethernet0/5

  !

  interface Ethernet0/6

  !

  interface Ethernet0/7

  !

  boot system Disk0: / asa822 - k8.bin

  passive FTP mode

  clock timezone THATS 1

  clock to summer time CEDT recurring last Sun Mar 02:00 last Sun Oct 03:00

  DNS domain-lookup outside

  DNS server-group DefaultDNS

  Server name 194.25.0.60

  Server name 194.25.0.68

  DM_INLINE_TCP_1 tcp service object-group

  port-object eq www

  EQ object of the https port

  inside_access_in list extended access permitted udp 192.168.1.0 255.255.255.0 no matter what eq field open a debug session

  inside_access_in list extended access permitted tcp 192.168.1.0 255.255.255.0 any object-group DM_INLINE_TCP_1 open a debug session

  inside_access_in list extended access deny ip any any debug log

  inside_nat0_outbound to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.0.0 255.255.0.0

  permit inside_nat0_outbound to access extended list ip 192.168.10.0 255.255.255.0 192.168.10.0 255.255.255.128

  homegroup_splitTunnelAcl list standard access allowed 192.168.10.0 255.255.255.0

  pager lines 24

  Enable logging

  asdm of logging of information

  Outside 1500 MTU

  Within 1500 MTU

  IP local pool homepool 192.168.10.1 - 192.168.10.100 mask 255.255.255.0

  ICMP unreachable rate-limit 1 burst-size 1

  ASDM image disk0: / asdm-625 - 53.bin

  ASDM location 192.168.0.0 255.255.0.0 inside

  ASDM location 192.168.10.0 255.255.255.0 inside

  don't allow no asdm history

  ARP timeout 14400

  Global 1 interface (outside)

  NAT (inside) 0-list of access inside_nat0_outbound

  NAT (inside) 1 0.0.0.0 0.0.0.0

  inside_access_in access to the interface inside group

  Timeout xlate 03:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

  timeout tcp-proxy-reassembly 0:01:00

  dynamic-access-policy-registration DfltAccessPolicy

  Enable http server

  http 192.168.1.0 255.255.255.0 inside

  No snmp server location

  No snmp Server contact

  Server enable SNMP traps snmp authentication linkup, linkdown cold start

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

  Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

  Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

  Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

  Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

  Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

  life crypto ipsec security association seconds 28800

  Crypto ipsec kilobytes of life - safety 4608000 association

  crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set

  Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

  outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

  outside_map interface card crypto outside

  crypto ISAKMP allow outside

  crypto ISAKMP policy 10

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 86400

  Telnet timeout 5

  SSH timeout 5

  Console timeout 0

  VPDN group home request dialout pppoe

  VPDN group House localname 04152886790

  VPDN group House ppp authentication PAP

  VPDN username 04152886790 password 1

  dhcpd outside auto_config

  !

  dhcpd address 192.168.1.5 - 192.168.1.36 inside

  dhcpd allow inside

  !

  a basic threat threat detection

  Statistics-list of access threat detection

  no statistical threat detection tcp-interception

  TFTP server 192.168.1.5 inside c:/tftp-root

  WebVPN

  Group Policy inner residential group

  attributes of the strategy of group home group

  value of 192.168.1.1 DNS server

  Protocol-tunnel-VPN IPSec

  Split-tunnel-policy tunnelspecified

  value of Split-tunnel-network-list homegroup_splitTunnelAcl

  username user01 encrypted password privilege 0 v5P40l1UGvtJa7Nn

  user01 username attributes

  VPN-strategy group home group

  tunnel-group home group type remote access

  attributes global-tunnel-group home group

  address homepool pool

  Group Policy - by default-homegroup

  tunnel-group group residential ipsec-attributes

  pre-shared-key ciscotest

  !

  class-map inspection_default

  match default-inspection-traffic

  !

  !

  type of policy-card inspect dns preset_dns_map

  parameters

  maximum message length automatic of customer

  message-length maximum 512

  Policy-map global_policy

  class inspection_default

  inspect the preset_dns_map dns

  inspect the ftp

  inspect h323 h225

  inspect the h323 ras

  inspect the rsh

  inspect the rtsp

  inspect esmtp

  inspect sqlnet

  inspect the skinny

  inspect sunrpc

  inspect xdmcp

  inspect the sip

  inspect the netbios

  inspect the tftp

  Review the ip options

  !

  global service-policy global_policy

  context of prompt hostname

  Cryptochecksum:930e6cddf25838e47ef9633dc2f07acb

  : end

  Hello

  Normally, you want a static public IP address on the ASA to allow it to receive connections from VPN clients (avoid to change the IP address all the time).

  If you connect via VPN, check the following:

  1. the tunnel is established:

  HS cry isa his

  Must say QM_IDLE or MM_ACTIVE

  2 traffic is flowing (encrypted/decrypted):

  HS cry ips its

  3. Enter the command:

  management-access inside

  And check if you can PING the inside ASA VPN client IP.

  4. check that the default gateway for the LAN internal ASA within intellectual property (or there is a road to the ASA to send traffic to the VPN clients).

  Federico.

• Site to site VPN, I need all internet traffic to exit the site.

  I have 2 sites connected via a pair of SRX5308

  A = 192.168.1.0/24

  IP WAN = 1.1.1.1

  B = 192.168.2.0/24

  IP WAN = 2.2.2.2

  Now what I need to do, is to have all traffic from B to go to the site one even traffic destined to the internet. That is, I need internet traffic out of our network with the IP 1.1.1.1, even if it is from the network B.

  On my I have set up a route 1.1.1.1 of the ISP, then a value by default 0/0 to 192.168.1.1 it ASA knows how to get to the peer VPN is a more specific route, but sends everything above the tunnel, at the remote end which then hairpin of ASA routes internet outside its own WAN port traffic.

  I can understand though not how to so the same thing on the pair of SRX5308 they either don't raise the tunnel or internet route to the local site address B.

  Anyone have any ideas?

  I need to do this because we are logging and monitoring of internet traffic to A site via tapping from upstream to various IDS solutions and will not (cannot) reproduce this to all our remote sites.

  Thank you

  Dave.

  After some more thought and testing I came up with a workable solution to my own problem. I'll share it here in case it can help others.

  (1) use the wizard at both ends to implement a normal VPN that connects the two segments of network 192.168.1.0 and 192.168.2.0

  (2) go to site VPN - VPN policy remote router192.168.2.1 and click Edit

  (a) disable Netbios

  (b) select "None" from the drop-down list the remote IP address.

  (c) to apply the change

  3) go to the VPN-> VPN policy on the head end site (192.168.1.1) and click Edit

  (a) disable Netbios

  (b) select "None" from the drop-down list the local IP address

  (c) to apply the change

  Now all the traffic wil go down the VPN tunnel and exit to the internet on the site of head end. Hope this helps others with the same question.

• Once I refreshed, when I go to pull down to a previous visit, it loads the address bar, but will not go on the site.

  Everything was going well until I refreshed Firefox. Since then, the address bar does not work. If I type in a website or attempt to use the drop-down menu to access a previous site, the site loads but does not "join the service or go the arrow." It is used to automatically load, now it won't load at all! I am running Windows XP

  You are running Firefox in compatibility mode for Windows 98 (NT 4.10) according to the user agent.

  • Mozilla/5.0 (Windows NT 4.10; rv:36.0) Gecko/20100101 Firefox/36.0

  Make sure that you are not Firefox running in compatibility mode.
  You can open the properties of the desktop Firefox shortcut via the context menu and check under the tab "compatibility".
  Make sure that all items are disabled in the tab "Compatibility" in the Properties window.

• My Belkin router has stopped working. After talking to Belkin support, we got it to work, but I can't access the site of iiNet connection.

  original title: Wireless router problems

  My Belkin router has stopped working the other day, so I tried the usual stuff (turning on an etc) in the end rang Belkin and after about an hour the router started working again, but would go only on the iiNet connection site! Go figure, not even with them. The woman to the Belkin told me to ring my ISP I did, and they got me online, however, my printer, the laptop and the iPhone is no longer will connect wireless. They were all working perfectly before the router dropped out.

  I went through all the procedures that several times. Uninstalled and reinstalled the printer and the router... still does not work.

  The printer can not just to find the wireless network. The test report said that everything went except the SSID, which has been a FAILURE. How can this be when I haven't changed the

  SSID?

  I've updated as well.

  Hoping really frustrated, can someone help!
  Thanks in advance!

  Hello

  1 are there any changes or updates made on the computer before the show?

  2. What is the exact model of the router number?

  3. do you get an error message? If Yes, what is the full and exact error message?

  4. what operating system is installed on the computer?

  Method 1:

  Check the link and try to run the troubleshooter to check if it helps.

  Windows wireless and wired network connection problems

  http://Windows.Microsoft.com/en-us/Windows/help/wired-and-wireless-network-connection-problems-in-Windows

  Method 2:

  Check out the links and check if that helps:

  Solve problems, find wireless networks

  http://Windows.Microsoft.com/en-us/Windows-Vista/troubleshoot-problems-finding-wireless-networks

  The link applies to the Windows Vista and Windows 7 operating system.

  Problems of network with a router in Windows XP

  http://support.Microsoft.com/kb/315978

• embedded SWF plays in preview mode, but not when loaded on the site

  http://delormdesigns.com/Oxen2008/2008Fair.html

  I created a SWF to create first a flv from an avi file, and then publish the swf file in flash. I have inserted in an html page and can see the preview video. However, when I load the page and all assets on the site, I get nothing.

  I tried to view the swf file directly, and it does not play. Maybe it's a problem with how I converted the avi file or how I published the swf file. I start in this forum, just in case.

  Thank you!

  Hello

  because one of my swf files - working with the source code, I suspect that your swf file is corrupted or not properly converted or created, because even if it does not work: http://delormdesigns.com/Oxen2008/Oxen2008Fair.swf

  So I'll offer, try to import another swf file which you know it works.

  Hans-Günter

• Help the Site VPN Site PIX 501

  Hello

  I'm pretty new to PIX firewall, so I hope someone here can help me.

  I have two PIX and try to create a private network virtual between the two PIX. I posted the configs below.

  The problem is that I can ping PIX on a PIX two, but I can't ping the servers behind TWO PIX. On two PIX, I cannot ping PIX ONE or all the servers behind it.

  Any advice would be appreciated.

  Thank you

  PIX 1

  6.2 (2) version PIX

  ethernet0 nameif outside security0

  nameif ethernet1 inside the security100

  hostname TMAXWALES

  domain ciscopix.com

  fixup protocol ftp 21

  fixup protocol http 80

  fixup protocol h323 h225 1720

  fixup protocol h323 ras 1718-1719

  fixup protocol they 389

  fixup protocol rsh 514

  fixup protocol rtsp 554

  fixup protocol smtp 25

  fixup protocol sqlnet 1521

  fixup protocol sip 5060

  fixup protocol 2000 skinny

  names of

  inside_outbound_nat0_acl ip 192.168.254.0 access list allow 255.255.255.0 192.1

  68.1.0 255.255.255.0

  outside_cryptomap_20 ip 192.168.254.0 access list allow 255.255.255.0 192.168.1

  .0 255.255.255.0

  pager lines 24

  interface ethernet0 10baset

  interface ethernet1 10full

  Outside 1500 MTU

  Within 1500 MTU

  IP address outside of *. *.198.139 255.255.255.248

  IP address inside 192.168.254.1 255.255.255.0

  alarm action IP verification of information

  alarm action attack IP audit

  location of PDM 192.168.254.10 255.255.255.255 inside

  location of PDM 192.168.1.0 255.255.255.0 outside

  history of PDM activate

  ARP timeout 14400

  Global 1 interface (outside)

  NAT (inside) 0-list of access inside_outbound_nat0_acl

  NAT (inside) 1 0.0.0.0 0.0.0.0 0 0

  Route outside 0.0.0.0 0.0.0.0 *. * 1.198.137

  Timeout xlate 03:00

  Timeout conn 0 half-closed 01:00:10: 00 udp 0:02:00 CPP 0: h323 from 10:00 0:05:00 TR

  p 0:30:00 sip_media 0:02:00

  Timeout, uauth 0:05:00 absolute

  GANYMEDE + Protocol Ganymede + AAA-server

  RADIUS Protocol RADIUS AAA server

  AAA-server local LOCAL Protocol

  Enable http server

  http 192.168.254.10 255.255.255.255 inside

  No snmp server location

  No snmp Server contact

  SNMP-Server Community public

  No trap to activate snmp Server

  enable floodguard

  Permitted connection ipsec sysopt

  No sysopt route dnat

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  outside_map 20 ipsec-isakmp crypto map

  card crypto outside_map 20 match address outside_cryptomap_20

  card crypto outside_map 20 peers set *. *.198.138

  outside_map crypto 20 card value transform-set ESP-3DES-SHA

  outside_map interface card crypto outside

  ISAKMP allows outside

  ISAKMP key * address *. *.198.138 netmask 255.255.255.255 No.-xauth non - co

  Nfig-mode

  part of pre authentication ISAKMP policy 20

  ISAKMP policy 20 3des encryption

  ISAKMP policy 20 chopping sha

  20 2 ISAKMP policy group

  ISAKMP duration strategy of life 20 86400

  Telnet timeout 5

  SSH timeout 5

  Terminal width 80

  PIX 2

  6.2 (2) version PIX

  ethernet0 nameif outside security0

  nameif ethernet1 inside the security100

  hostname tmaxbangor

  domain ciscopix.com

  fixup protocol ftp 21

  fixup protocol http 80

  fixup protocol h323 h225 1720

  fixup protocol h323 ras 1718-1719

  fixup protocol they 389

  fixup protocol rsh 514

  fixup protocol rtsp 554

  fixup protocol smtp 25

  fixup protocol sqlnet 1521

  fixup protocol sip 5060

  fixup protocol 2000 skinny

  names of

  permit 192.168.1.0 ip access list inside_outbound_nat0_acl 255.255.255.0 192.168

  . 254.0 255.255.255.0

  permit 192.168.1.0 ip access list outside_cryptomap_20 255.255.255.0 192.168.254

  .0 255.255.255.0

  pager lines 24

  opening of session

  debug logging in buffered memory

  interface ethernet0 10baset

  interface ethernet1 10full

  Outside 1500 MTU

  Within 1500 MTU

  IP address outside of *. *.198.138 255.255.255.248

  IP address inside 192.168.1.1 255.255.255.0

  IP verify reverse path to the outside interface

  IP verify reverse path inside interface

  the IP audit info action alarm reset drop

  reset the IP audit attack alarm drop action

  location of PDM 192.168.1.0 255.255.255.0 inside

  PDM logging 100 information

  history of PDM activate

  ARP timeout 14400

  Global 1 interface (outside)

  NAT (inside) 0-list of access inside_outbound_nat0_acl

  NAT (inside) 1 0.0.0.0 0.0.0.0 0 0

  Route outside 0.0.0.0 0.0.0.0 *. * 1.198.137

  Timeout xlate 03:00

  Timeout conn 0 half-closed 01:00:10: 00 udp 0:02:00 CPP 0: h323 from 10:00 0:05:00 TR

  p 0:30:00 sip_media 0:02:00

  Timeout, uauth 0:05:00 absolute

  GANYMEDE + Protocol Ganymede + AAA-server

  RADIUS Protocol RADIUS AAA server

  AAA-server local LOCAL Protocol

  Enable http server

  http 192.168.1.0 255.255.255.0 inside

  http 192.84.7.111 255.255.255.255 inside

  http 192.168.1.10 255.255.255.255 inside

  No snmp server location

  No snmp Server contact

  SNMP-Server Community public

  No trap to activate snmp Server

  enable floodguard

  Permitted connection ipsec sysopt

  No sysopt route dnat

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  outside_map 20 ipsec-isakmp crypto map

  card crypto outside_map 20 match address outside_cryptomap_20

  card crypto outside_map 20 peers set *. *.198.139

  outside_map crypto 20 card value transform-set ESP-3DES-SHA

  outside_map interface card crypto outside

  ISAKMP allows outside

  ISAKMP key * address *. *.198.139 netmask 255.255.255.255 No.-xauth non - co

  Nfig-mode

  part of pre authentication ISAKMP policy 20

  ISAKMP policy 20 3des encryption

  ISAKMP policy 20 chopping sha

  20 2 ISAKMP policy group

  ISAKMP duration strategy of life 20 86400

  Telnet 192.168.1.0 255.255.255.0 inside

  Telnet timeout 50

  SSH timeout 5

  Terminal width 80

  Can't see anything obviously wrong with the configs. You have these connected back to back on the same subnet, it looks that it even if you have xxx out IP addresses? If so it's maybe a routing problem, in what they send everything to the default gateway of xxx.x.198.137 rather than to the other.

  Try to add a static route to the remote subnet to each PIX that points directly to the peer, so on PIX1 you should have:

  Route outside 192.168.1.0 255.255.255.0 xxx.x.198.138

  and on PIX2 do:

  Route outside 192.168.254.0 255.255.255.0 xxx.x.198.139

  and see if that makes a difference. Note that you wouldn't encounter this problem when these two PIX is on separate networks and uses the default gateway for all routing decisions.

  If this still fails, run 'debug cryp isa' and ' debug cry ipsec "on the two PIX are trying to build a tunnel again, and then and send us the output.

  Also, make sure your tests that you're rattling to a host behind a PIX to a host behind the other PIX, ping PIX to PIX or host because of PIX that won't test your VPN connection.

• VPN Tunnel to the TOP but no traffic passing (PIX515)

  I'll put up a remote engineers access to off-site to access my network (using the cisco vpn client). I use PIX 515E software version 7.0 (3) 20 as a vpn server. I can establish a tunnel, but I can't access network resources. I can ping the external interface of the PIX. This is my setup: internet-router-pix-dmz(server farm). Please find attached my setup. Thanks in advance.

  After a glance at your policy, it seems that the Pool of IP, that is assigned to the clients behind the outside interface, runs behind the DMZ. I don't think it will work.

  In addition, defined distribution policy seems to be backward. Im sure that you intend to send traffic FROM the IP pool to 196.26.12.64/26. Your acl split is the opposite.

  In addition, your routing table does not contain a route for the 196 network, so the firewall will use the default route to the outside. If this is intentional, the clients and dst are on the outside, which is considered to be crossed. This is allowed on the SAA only with the same security setting configured.

• Tunnel is - to &gt; No. traffic passes

  I built a tunnel L2L ipsec between the external interfaces of a pix 515 (7.2.1) and one asa 5520 (8.0.2). I want inside each firewall network to be able to communicate with each other through the tunnel, but I cant get any traffic to cross.

  I configured the nat 0 access-list sheep on each firewall with traffic, I want to go through the tunnel and that acl is also on my crypto card (inside). The only way I can get the tunnel upwards is ping on my external interface of each firewall (which I have added as 'interesting' traffic) for the tunnel to the top.

  Any ideas why my internal LAN no is not communicating would be appreciated.

  Delete the second line list of access-160, and then add the following line to the PIX and ASA time:

  management-access inside

  If you try to open the flow of the ASA, then you need to managing access control, however, it should appear if you try to leave a device inside the network.

• VPN Tunnel established but no LAN access

  I have an embarrassing problem where more remote site PCs are accessing resources HQ LAN very well using the VPN Client (v4.6) connecting to a Cisco PIX 515E. Any PC running Windows XP SP2 with the firewall off o/s. A PC site however establishes the IPSEC tunnel, but cannot communicate with network resources (Intranet, Email, etc) and it also times out ping machines which must meet. I noticed when running VPN stats on the client, even if the packages are be encrypted, they may not be decrypted and there are many packets discarded. I'm quite a beginner when it comes to Cisco VPN if someone at - it clues as to why a machine will not work when it is exactly the same configuration as the others what to do.

  No problem

  If possible mark this issue as resolved on this forum - its useful when you search for old messages

  M.