VPN site to Site btw Pix535 and 2811 router, can't get to work

Hi, everyone, I spent a few days doing a VPN site-to site between PIX535 and 2811 router but returned empty-handed, I followed the instructions here:

http://www.Cisco.com/en/us/products/ps9422/products_configuration_example09186a0080b4ae61.shtml

#1: config PIX:

: Saved

: Written by enable_15 to the 18:05:33.678 EDT Saturday, October 20, 2012

!

8.0 (4) version PIX

!

hostname pix535

!

interface GigabitEthernet0

Description to cable-modem

nameif outside

security-level 0

address IP X.X.138.132 255.255.255.0

OSPF cost 10

!

interface GigabitEthernet1

Description inside 10/16

nameif inside

security-level 100

IP 10.1.1.254 255.255.0.0

OSPF cost 10

!

outside_access_in of access allowed any ip an extended list

access extensive list ip 10.1.0.0 inside_nat0_outbound allow 255.255.0.0 10.20.0.0 255.255.0.0

inside_nat0_outbound list of allowed ip extended access all 10.1.1.192 255.255.255.248

outside_cryptomap_dyn_60 list of allowed ip extended access all 10.1.1.192 255.255.255.248

access extensive list ip 10.1.0.0 outside_1_cryptomap allow 255.255.0.0 10.20.0.0 255.255.0.0

pager lines 24

cnf-8-ip 10.1.1.192 mask - 10.1.1.199 IP local pool 255.255.0.0

Global interface 10 (external)

15 1.2.4.5 (outside) global

NAT (inside) 0-list of access inside_nat0_outbound

NAT (inside) 15 10.1.0.0 255.255.0.0

Access-group outside_access_in in interface outside

Route outside 0.0.0.0 0.0.0.0 X.X.138.1 1

Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

life crypto ipsec security association seconds 28800

Crypto ipsec kilobytes of life - safety 4608000 association

Crypto-map dynamic outside_dyn_map 20 the value transform-set ESP-3DES-SHA MD5-ESP-3DES ESP-DES-MD5

life together - the association of security crypto dynamic-map outside_dyn_map 20 28800 seconds

Crypto-map dynamic outside_dyn_map 20 kilobytes of life together - the association of safety 4608000

Crypto-map dynamic outside_dyn_map 40 value transform-set ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA

life together - the association of security crypto dynamic-map outside_dyn_map 40 28800 seconds

Crypto-map dynamic outside_dyn_map 40 kilobytes of life together - the association of safety 4608000

Dynamic crypto map outside_dyn_map 60 match address outside_cryptomap_dyn_60

Crypto-map dynamic outside_dyn_map 60 value transform-set ESP-3DES-MD5 ESP-3DES-SHA ESP-DES-MD5 ESP-DES-SHA

life together - the association of security crypto dynamic-map outside_dyn_map 60 28800 seconds

Crypto-map dynamic outside_dyn_map 60 kilobytes of life together - the association of safety 4608000

Dynamic crypto map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs

Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-SHA-3DES ESP-MD5-3DES ESP-DES-SHA ESP-DES-MD5

Dynamic crypto map SYSTEM_DEFAULT_CRYPTO_MAP 65535 define security association lifetime 28800 seconds

cryptographic kilobytes 4608000 life of the set - the association of security of the 65535 SYSTEM_DEFAULT_CRYPTO_MAP of the dynamic-map

card crypto outside_map 1 match address outside_1_cryptomap

outside_map game 1 card crypto peer X.X.21.29

card crypto outside_map 1 set of transformation-ESP-DES-SHA

outside_map map 1 lifetime of security association set seconds 28800 crypto

card crypto outside_map 1 set security-association life kilobytes 4608000

outside_map card crypto 65534 isakmp ipsec dynamic SYSTEM_DEFAULT_CRYPTO_MAP

map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map

outside_map interface card crypto outside

ISAKMP crypto identity hostname

crypto ISAKMP allow outside

crypto ISAKMP policy 10

preshared authentication

the Encryption

sha hash

Group 1

life 86400

crypto ISAKMP policy 20

preshared authentication

3des encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 65535

preshared authentication

3des encryption

sha hash

Group 2

life 86400

Crypto isakmp nat-traversal 3600

internal GroupPolicy1 group strategy

cnf-vpn-cls group policy internal

attributes of cnf-vpn-cls-group policy

value of 10.1.1.7 WINS server

value of 10.1.1.7 DNS server 10.1.1.205

Protocol-tunnel-VPN IPSec l2tp ipsec

field default value x.com

sean U/h5bFVjXlIDx8BtqPFrQw password user name is nt encrypted

IPSec-attributes tunnel-group DefaultRAGroup

pre-shared-key secret1

RADIUS-sdi-xauth

tunnel-group DefaultRAGroup ppp-attributes

ms-chap-v2 authentication

tunnel-group cnf-vpn-cls type remote access

tunnel-group global cnf-vpn-cls-attributes

cnf-8-ip address pool

Group Policy - by default-cnf-vpn-cls

tunnel-group cnf-CC-vpn-ipsec-attributes

pre-shared-key secret2

ISAKMP ikev1-user authentication no

tunnel-group cnf-vpn-cls ppp-attributes

ms-chap-v2 authentication

tunnel-group X.X.21.29 type ipsec-l2l

IPSec-attributes tunnel-Group X.X.21.29

Pre-shared key SECRET

!

class-map inspection_default

match default-inspection-traffic

!

!

!

global service-policy global_policy

context of prompt hostname

Cryptochecksum:9780edb09bc7debe147db1e7d52ec39c

: end

#2: 2811 router config:

!

! Last configuration change to 09:15:32 PST Friday, October 19, 2012 by cnfla

! NVRAM config update at 13:45:03 PST Tuesday, October 16, 2012

!

version 12.4

horodateurs service debug datetime msec

Log service timestamps datetime msec

no password encryption service

!

hostname THE-2800

!

!

Crypto pki trustpoint TP-self-signed-1411740556

enrollment selfsigned

name of the object cn = IOS - Self - signed - certificate - 1411740556

revocation checking no

rsakeypair TP-self-signed-1411740556

!

!

TP-self-signed-1411740556 crypto pki certificate chain

certificate self-signed 01

308201A 8 A0030201 02020101 3082023F 300 D 0609 2A 864886 F70D0101 04050030

2 060355 04031326 494F532D 53656 C 66 2 AND 536967 6E65642D 43657274 31312F30

69666963 31343131 37343035 6174652D 3536301E 170 3132 31303136 32303435

30335A 17 0D 323030 31303130 30303030 305A 3031 06035504 03132649 312F302D

4F532D53 5369676E 656C662D 43 65727469 66696361 74652 31 34313137 65642D

34303535 3630819F 300 D 0609 2A 864886 01050003, 818, 0030, 81890281 F70D0101

8100F75F F1BDAD9B DE9381FD 7EAF9685 CF15A317 165B 5188 1 B 424825 9C66AA28

C990B2D3 D69A2F0F D745DB0E 2BB4995D 73415AC4 F01B2019 C4BCF9E0 84373199

E599B86C 17DBDCE6 47EBE0E3 8DBC90B2 9B4E217A 87F04BF7 A182501E 24381019

A61D2C05 5404DE88 DA2A1ADC A81B7F65 C318B697 7ED69DF1 2769E4C8 F3449B33

010001A 3 67306530 1 130101 FF040530 030101FF 30120603 0F060355 35AF0203

1104 B 0 300982 074C412D 32383030 551D 551 2304 18301680 14B56EEB 301F0603

88054CCA BB8CF8E8 F44BFE2C B77954E1 52301 D 06 04160414 B56EEB88 03551D0E

054CCABB 8CF8E8F4 4BFE2CB7 7954E152 300 D 0609 2A 864886 F70D0101 04050003

81810056 58755 56 331294F8 BEC4FEBC 54879FF5 0FCC73D4 B964BA7A 07D 20452

E7F40F42 8B 355015 77156C9F AAA45F9F 59CDD27F 89FE7560 F08D953B FC19FD2D

310DA96E A5F3E83B 52D515F8 7B4C99CF 4CECC3F7 1A0D4909 BD08C373 50BB53CC

659 4246 2CB7B79F 43D94D96 586F9103 9B4659B6 5C8DDE4F 7CC5FC68 C4AD197A 4EC322 C

quit smoking

!

!

!

crypto ISAKMP policy 1

preshared authentication

ISAKMP crypto key address SECRET X.X.138.132 No.-xauth

!

!

Crypto ipsec transform-set the-2800-trans-set esp - esp-sha-hmac

!

map 1 la-2800-ipsec policy ipsec-isakmp crypto

ipsec vpn Description policy

defined by peer X.X.138.132

the transform-set the-2800-trans-set value

match address 101

!

!

!

!

!

!

interface FastEthernet0/0

Description WAN side

address IP X.X.216.29 255.255.255.248

NAT outside IP

IP virtual-reassembly

automatic duplex

automatic speed

No cdp enable

No mop enabled

card crypto 2800-ipsec-policy

!

interface FastEthernet0/1

Description side LAN

IP 10.20.1.1 255.255.255.0

IP nat inside

IP virtual-reassembly

full duplex

automatic speed

No mop enabled

!

IP nat inside source map route sheep interface FastEthernet0/0 overload

access-list 10 permit X.X.138.132

access-list 99 allow 64.236.96.53

access-list 99 allow 98.82.1.202

access list 101 remark vpn tunnerl acl

Note access-list 101 category SDM_ACL = 4

policy of access list 101 remark tunnel

access-list 101 permit ip 10.20.0.0 0.0.0.255 10.1.0.0 0.0.255.255

access-list 110 deny ip 10.20.0.0 0.0.0.255 10.1.0.0 0.0.255.255

access-list 110 permit ip 10.20.0.0 0.0.0.255 any

public RO SNMP-server community

!

!

!

sheep allowed 10 route map

corresponds to the IP 110

!

!

!

!

WebVPN gateway gateway_1

IP address X.X.216.29 port 443

SSL trustpoint TP-self-signed-1411740556

development

!

WebVPN install svc flash:/webvpn/svc.pkg

!

WebVPN gateway-1 context

title 'b '.

secondary-color white

color of the title #CCCC66

text-color black

SSL authentication check all

!

!

policy_1 political group

functions compatible svc

SVC-pool of addresses "WebVPN-Pool."

SVC Dungeon-client-installed

SVC split include 10.20.0.0 255.255.0.0

Group Policy - by default-policy_1

Gateway gateway_1

development

!

!

end

#3: test Pix to the router:


ITS enabled: 1

Generate a new key SA: 0 (a tunnel report Active 1 and 1 to generate a new key during the generate a new key)

Total SA IKE: 1

1 peer IKE: X.X.21.29

Type: user role: initiator

Generate a new key: no State: MM_WAIT_MSG2

> DEBUG:

12:07:14 pix535:Oct 22 Oct 22 12:20:28 EDT: % PIX-vpn-3-713902: IP = X.X.21.29, Removing peer to peer table has not, no match
!
22 Oct 12:07:14 pix535: 22 Oct 12:20:28 EDT: % PIX-vpn-4-713903: IP = X.X.21.29, error: cannot delete PeerTblEntry
#4: test the router to pix:
LA - 2800 #sh crypto isakmp his
IPv4 Crypto ISAKMP Security Association
status of DST CBC State conn-id slot
X.X.138.132 X.X.216.29 MM_KEY_EXCH 1017 ASSETS 0
> debug
LA - 2800 #ping 10.1.1.7 source 10.20.1.1
Type to abort escape sequence.
Send 5, echoes ICMP 100 bytes to 10.1.1.7, time-out is 2 seconds:
Packet sent with a source address of 10.20.1.1
Oct 22 16:24:33.945: ISAKMP: (0): profile of THE request is (NULL)
22 Oct 16:24:33.945: ISAKMP: created a struct peer X.X.138.132, peer port 500
22 Oct 16:24:33.945: ISAKMP: new created position = 0x488B25C8 peer_handle = 0 x 80000013
22 Oct 16:24:33.945: ISAKMP: lock struct 0x488B25C8, refcount 1 to peer isakmp_initiator
22 Oct 16:24:33.945: ISAKMP: 500 local port, remote port 500
22 Oct 16:24:33.945: ISAKMP: set new node 0 to QM_IDLE
22 Oct 16:24:33.945: ISAKMP: find a dup her to the tree during the isadb_insert his 487720 A 0 = call BVA
22 Oct 16:24:33.945: ISAKMP: (0): cannot start aggressive mode, try the main mode.
22 Oct 16:24:33.945: ISAKMP: (0): pair found pre-shared key matching 70.169.138.132
Oct 22 16:24:33.945: ISAKMP: (0): built of NAT - T of the seller-rfc3947 ID
Oct 22 16:24:33.945: ISAKMP: (0): built the seller-07 ID NAT - t
Oct 22 16:24:33.945: ISAKMP: (0): built of NAT - T of the seller-03 ID
Oct 22 16:24:33.945: ISAKMP: (0): built the seller-02 ID NAT - t
22 Oct 16:24:33.945: ISAKMP: (0): entry = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM
22 Oct 16:24:33.945: ISAKMP: (0): former State = new State IKE_READY = IKE_I_MM1
Oct 22 16:24:33.945: ISAKMP: (0): Beginner Main Mode Exchange
Oct 22 16:24:33.945: ISAKMP: (0): package X.X.138.132 my_port 500 peer_port 500 (I) sending MM_NO_STATE
22 Oct 16:24:33.945: ISAKMP: (0): sending a packet IPv4 IKE.
22 Oct 16:24:34.049: ISAKMP (0:0): packet received dport 500 sport Global 500 (I) MM_NO_STATE X.X.138.132
22 Oct 16:24:34.049: ISAKMP: (0): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
22 Oct 16:24:34.049: ISAKMP: (0): former State = new State IKE_I_MM1 = IKE_I_MM2
Oct 22 16:24:34.049: ISAKMP: (0): treatment ITS payload. Message ID = 0
Oct 22 16:24:34.049: ISAKMP: (0): load useful vendor id of treatment
Oct 22 16:24:34.049: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 123
Oct 22 16:24:34.049: ISAKMP: (0): provider ID is NAT - T v2
Oct 22 16:24:34.049: ISAKMP: (0): load useful vendor id of treatment
Oct 22 16:24:34.049: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 194
22 Oct 16:24:34.053: ISAKMP: (0): pair found pre-shared key matching 70.169.138.132
Oct 22 16:24:34.053: ISAKMP: (0): pre-shared key local found
22 Oct 16:24:34.053: ISAKMP: analysis of the profiles for xauth...
22 Oct 16:24:34.053: ISAKMP: (0): audit ISAKMP transform 1 against the policy of priority 1
22 Oct 16:24:34.053: ISAKMP: DES-CBC encryption
22 Oct 16:24:34.053: ISAKMP: SHA hash
22 Oct 16:24:34.053: ISAKMP: default group 1
22 Oct 16:24:34.053: ISAKMP: pre-shared key auth
22 Oct 16:24:34.053: ISAKMP: type of life in seconds
22 Oct 16:24:34.053: ISAKMP: life (IPV) 0 x 0 0 x 1 0 x 51 0x80
22 Oct 16:24:34.053: ISAKMP: (0): atts are acceptable
. Next payload is 0
22 Oct 16:24:34.053: ISAKMP: (0): Acceptable atts: real life: 0
22 Oct 16:24:34.053: ISAKMP: (0): Acceptable atts:life: 0
22 Oct 16:24:34.053: ISAKMP: (0): fill atts in his vpi_length:4
22 Oct 16:24:34.053: ISAKMP: (0): fill atts in his life_in_seconds:86400
22 Oct 16:24:34.053: ISAKMP: (0): return real life: 86400
22 Oct 16:24:34.053: ISAKMP: (0): timer life Started: 86400.
Oct 22 16:24:34.053: ISAKMP: (0): load useful vendor id of treatment
Oct 22 16:24:34.053: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 123
Oct 22 16:24:34.053: ISAKMP: (0): provider ID is NAT - T v2
Oct 22 16:24:34.053: ISAKMP: (0): load useful vendor id of treatment
Oct 22 16:24:34.053: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 194
22 Oct 16:24:34.053: ISAKMP: (0): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
22 Oct 16:24:34.053: ISAKMP: (0): former State = new State IKE_I_MM2 = IKE_I_MM2
Oct 22 16:24:34.057: ISAKMP: (0): package X.X.138.132 my_port 500 peer_port 500 (I) sending MM_SA_SETUP
22 Oct 16:24:34.057: ISAKMP: (0): sending a packet IPv4 IKE.
22 Oct 16:24:34.057: ISAKMP: (0): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
22 Oct 16:24:34.057: ISAKMP: (0): former State = new State IKE_I_MM2 = IKE_I_MM3
22 Oct 16:24:34.181: ISAKMP (0:0): packet received dport 500 sport Global 500 (I) MM_SA_SETUP X.X.138.132
22 Oct 16:24:34.181: ISAKMP: (0): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
22 Oct 16:24:34.181: ISAKMP: (0): former State = new State IKE_I_MM3 = IKE_I_MM4
Oct 22 16:24:34.181: ISAKMP: (0): processing KE payload. Message ID = 0
Oct 22 16:24:34.217: ISAKMP: (0): processing NONCE payload. Message ID = 0
22 Oct 16:24:34.217: ISAKMP: (0): pre-shared key found peer corresponding to X.X.138.132
Oct 22 16:24:34.217: ISAKMP: (1018): load useful vendor id of treatment
Oct 22 16:24:34.217: ISAKMP: (1018): provider ID is the unit
Oct 22 16:24:34.217: ISAKMP: (1018): load useful vendor id of treatment
Oct 22 16:24:34.217: ISAKMP: (1018): provider ID seems the unit/DPD but major incompatibility of 55
Oct 22 16:24:34.217: ISAKMP: (1018): provider ID is XAUTH
Oct 22 16:24:34.217: ISAKMP: (1018): load useful vendor id of treatment
Oct 22 16:24:34.217: ISAKMP: (1018): addressing another box of IOS
!
Oct 22 16:24:34.221: ISAKMP: (1018): load useful vendor id of treatment
22 Oct 16:24:34.221: ISAKMP: (1018): vendor ID seems the unit/DPD but hash mismatch
22 Oct 16:24:34.221: ISAKMP: receives the payload type 20
22 Oct 16:24:34.221: ISAKMP: receives the payload type 20
22 Oct 16:24:34.221: ISAKMP: (1018): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
22 Oct 16:24:34.221: ISAKMP: (1018): former State = new State IKE_I_MM4 = IKE_I_MM4
22 Oct 16:24:34.221: ISAKMP: (1018): send initial contact
22 Oct 16:24:34.221: ISAKMP: (1018): ITS been pre-shared key, using id ID_IPV4_ADDR type authentication
22 Oct 16:24:34.221: ISAKMP (0:1018): payload ID
next payload: 8
type: 1
address: X.X.216.29
Protocol: 17
Port: 500
Length: 12
22 Oct 16:24:34.221: ISAKMP: (1018): the total payload length: 12
Oct 22 16:24:34.221: ISAKMP: (1018): package X.X.138.132 my_port 500 peer_port 500 (I) sending MM_KEY_EXCH
22 Oct 16:24:34.221: ISAKMP: (1018): sending a packet IPv4 IKE.
22 Oct 16:24:34.225: ISAKMP: (1018): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
22 Oct 16:24:34.225: ISAKMP: (1018): former State = new State IKE_I_MM4 = IKE_I_MM5
...
22 Oct 16:24:38.849: ISAKMP: (1017): purge the node 198554740
22 Oct 16:24:38.849: ISAKMP: (1017): purge the node 812380002
22 Oct 16:24:38.849: ISAKMP: (1017): purge node 773209335...
Success rate is 0% (0/5)
# THE-2800
Oct 22 16:24:44.221: ISAKMP: (1018): transmit phase 1 MM_KEY_EXCH...
22 Oct 16:24:44.221: ISAKMP (0:1018): increment the count of errors on his, try 1 5: retransmit the phase 1
Oct 22 16:24:44.221: ISAKMP: (1018): transmit phase 1 MM_KEY_EXCH
Oct 22 16:24:44.221: ISAKMP: (1018): package X.X.138.132 my_port 500 peer_port 500 (I) sending MM_KEY_EXCH
22 Oct 16:24:44.221: ISAKMP: (1018): sending a packet IPv4 IKE.
22 Oct 16:24:44.317: ISAKMP (0:1018): packet received dport 500 sport Global 500 (I) MM_KEY_EXCH X.X.138.132
Oct 22 16:24:44.317: ISAKMP: (1018): package of phase 1 is a duplicate of a previous package.
Oct 22 16:24:44.321: ISAKMP: (1018): retransmission jumped to the stage 1 (time elapsed since the last transmission 96)
22 Oct 16:24:48.849: ISAKMP: (1017): serving SA., his is 469BAD60, delme is 469BAD60
22 Oct 16:24:52.313: ISAKMP (0:1018): packet received dport 500 sport Global 500 (I) MM_KEY_EXCH X.X.138.132
Oct 22 16:24:52.313: ISAKMP: (1018): package of phase 1 is a duplicate of a previous package.
Oct 22 16:24:52.313: ISAKMP: (1018): retransmission due to phase 1 of retransmission
Oct 22 16:24:52.813: ISAKMP: (1018): transmit phase 1 MM_KEY_EXCH...
22 Oct 16:24:52.813: ISAKMP (0:1018): increment the count of errors on his, try 2 of 5: retransmit the phase 1
Oct 22 16:24:52.813: ISAKMP: (1018): transmit phase 1 MM_KEY_EXCH
Oct 22 16:24:52.813: ISAKMP: (1018): package X.X138.132 my_port 500 peer_port 500 (I) sending MM_KEY_EXCH
22 Oct 16:24:52.813: ISAKMP: (1018): sending a packet IPv4 IKE.
Oct 22 16:24:52.913: ISAKMP: (1018): package of phase 1 is a duplicate of a previous package.
Oct 22 16:24:52.913: ISAKMP: (1018): retransmission jumped to the stage 1 (time elapsed since the last transmission of 100)
22 Oct 16:25:00.905: ISAKMP (0:1018): packet received dport 500 sport Global 500 (I) MM_KEY_EXCH X.X.138.132
22 Oct 16:25:00.905: ISAKMP: node set 422447177 to QM_IDLE
....
22 Oct 16:25:03.941: ISAKMP: (1018): SA is still budding. New application of ipsec in the annex
. (local 1 X. X.216.29, remote X.X.138.132)
22 Oct 16:25:03.941: ISAKMP: error during the processing of HIS application: failed to initialize SA
22 Oct 16:25:03.941: ISAKMP: error while processing message KMI 0, error 2.
Oct 22 16:25:12.814: ISAKMP: (1018): transmit phase 1 MM_KEY_EXCH...
22 Oct 16:25:12.814: ISAKMP (0:1018): increment the count of errors on his, try 4 out 5: retransmit the phase 1
Oct 22 16:25:12.814: ISAKMP: (1018): transmit phase 1 MM_KEY_EXCH
Oct 22 16:25:12.814: ISAKMP: (1018): package X.X.138.132 my_port 500 peer_port 500 (I) sending MM_KEY_EXCH
22 Oct 16:25:12.814: ISAKMP: (1018): sending a packet IPv4 IKE.
Oct 22 16:25:22.814: ISAKMP: (1018): transmit phase 1 MM_KEY_EXCH...
22 Oct 16:25:22.814: ISAKMP (0:1018): increment the count of errors on his, try 5 of 5: retransmit the phase 1
Oct 22 16:25:22.814: ISAKMP: (1018): transmit phase 1 MM_KEY_EXCH
Oct 22 16:25:22.814: ISAKMP: (1018): package X.X.138.132 my_port 500 peer_port 500 (I) sending MM_KEY_EXCH
22 Oct 16:25:22.814: ISAKMP: (1018): sending a packet IPv4 IKE.
Oct 22 16:25:32.814: ISAKMP: (1018): transmit phase 1 MM_KEY_EXCH...
22 Oct 16:25:32.814: ISAKMP: (1018): peer does not paranoid KeepAlive.
......

22 Oct 16:25:32.814: ISAKMP: (1018): removal of reason ITS status of 'Death by retransmission P1' (I) MM_KEY_EXCH (post 70.169.138.132)

22 Oct 16:25:32.814: ISAKMP: (1018): removal of reason ITS status of 'Death by retransmission P1' (I) MM_KEY_EXCH (post 70.169.138.132)

22 Oct 16:25:32.814: ISAKMP: Unlocking counterpart struct 0x488B25C8 for isadb_mark_sa_deleted(), count 0

22 Oct 16:25:32.814: ISAKMP: delete peer node by peer_reap for X.X.138.132: 488B25C8

22 Oct 16:25:32.814: ISAKMP: (1018): error suppression node 1112432180 FALSE reason 'IKE deleted.

22 Oct 16:25:32.814: ISAKMP: (1018): error suppression node 422447177 FALSE reason 'IKE deleted.

22 Oct 16:25:32.814: ISAKMP: (1018): node-278980615 error suppression FALSE reason 'IKE deleted.

22 Oct 16:25:32.814: ISAKMP: (1018): entry = IKE_MESG_INTERNAL, IKE_PHASE1_DEL

22 Oct 16:25:32.814: ISAKMP: (1018): former State = new State IKE_I_MM5 = IKE_DEST_SA

22 Oct 16:26:22.816: ISAKMP: (1018): purge the node 1112432180

22 Oct 16:26:22.816: ISAKMP: (1018): purge the node 422447177

22 Oct 16:26:22.816: ISAKMP: (1018): purge the node-278980615

22 Oct 16:26:32.816: ISAKMP: (1018): serving SA., its A 487720, 0 =, delme = A 487720, 0

The PIX is also used VPN client, such as the VPN Cicso 5.0 client access, works very well. Router is used as a server SSL VPN, too much work

I know there are a lot of data here, I hope that these data may be useful for diagnostic purposes.

All suggestions and tips are greatly appreciated.

Sean

Recommended action:

On the PIX:

no card crypto outside_map 1

!

crypto ISAKMP policy 5

preshared authentication

3des encryption

sha hash

Group 2

life 86400

!

card crypto outside_map 10 correspondence address outside_1_cryptomap

crypto outside_map 10 peer X.X.216.29 card game

outside_map crypto 10 card value transform-set ESP-3DES-SHA

life safety association set card crypto outside_map 10 28800 seconds

card crypto outside_map 10 set security-association life kilobytes 4608000

!

tunnel-group X.X.216.29 type ipsec-l2l

IPSec-attributes tunnel-Group X.X.216.29

Pre-shared key SECRET

!

On the router:

crypto ISAKMP policy 10

preshared authentication

Group 2

3des encryption

!

Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

output

!

card 10 la-2800-ipsec policy ipsec-isakmp crypto

ipsec vpn Description policy

defined by peer X.X.138.132

game of transformation-ESP-3DES-SHA

match address 101

!

No crypto card-2800-ipsec-policy 1

Let me know how it goes.

Portu.

Please note all useful posts

Post edited by: Javier Portuguez

Tags: Cisco Security

Similar Questions

Maybe you are looking for

  • Why Apple have downgraded app music in iOS10?

    I have never written a comment or opened a discussion here but I felt compelled after the last updated iOS10... I do not understand why Apple have passed their music app when they are competing with major players such as Spotify etc. As a music lover

  • Windows 10 USB on MacPro Quad mid-2010

    Hi guys, we have a MacPro running El Capitan [early 2013] on which we want to install Windows 10. Windows 10 is on a USB key. Bootcamp requires a drive. How to overcome this impasse? We have an ISO downloaded ~ 4GB of Microsoft but it doesn't seem to

  • Fix Corruption of the BIOS?

    Today, after awhile of use my laptop, I closed the lid to get up and do something. When I came back to the laptop, the screen was black. The WiFi light orange and the light caps lock blinked twice. I searched for a while and found that it probably me

  • 1073807346 error occurred at the VISA write to rsspecan_core_write.vi

    Possible reasons: VISA: (Hex 0xBFFF000E) the given reference of session or the object is not valid. I use a USB port for connection of GPIB to a Rohde Schwarz FSV30 of Windows 7 spectrum Analizer. My program works 100% in LabView, but the problem com

  • Error STOP: 0x0000009C (0 x 00000004, 0x80546F70, 0xb2000000, 0x00070F0F)

    I tried to transfer files from an old Compaq Presario R3000 laptop using the SD card Port, and this error pops up on a BSOD. It's a 4 GB SDHC card. In addition, this SDHC works fine on my Windows 8 PC as well as my Vista PC. While trying to pass file