SIte-to-Site VPN problem

Unanswered Question

I'm having a problem with a site-to-site VPN. I'm attaching the basic diagram (public IP's excluded).

I'm trying to set up a lan-to-lan tunnel between the two pix firewalls, and the only way I can get communication goin between the two sites is if I initiate traffic from both sites at the same time (before the tunenl times out)...once that's done as long as I have traffic going accross it's fine, but if I stop sending traffic I have to recreate the tunnel by re-initiating traffic from both site. I'm guessing it's a problem with the edge routers...on the london side I'm getting this error (note this router is only supposed to forward traffic to the pix, no tunnel is supposed to be created on this router):

%CRYPTO-4-RECVD_PKT_INV_SPI: decaps: rec'd IPSEC packet has

invalid spi for

destaddr=*.*.*.*, prot=50, spi=0x354F6836(894396470), srcaddr=*.*.*.*

Here are the relevent configs:

London Router:

ip nat inside source static tcp 172.16.70.100 500 *.*.*.* 500 extendable

Europe Router:

ip nat inside source static udp 172.16.71.100 500 *.*.*.* 500 extendable

London PIX 6.3:

nat (inside) 0 access-list 101

access-list 101 permit ip 192.168.70.0 255.255.255.0 192.168.71.0 255.255.255.0

access-list london permit ip 192.168.70.0 255.255.255.0 192.168.71.0 255.255.255.0

sysopt connection permit-ipsec

crypto ipsec transform-set london esp-3des esp-md5-hmac

crypto ipsec security-association lifetime seconds 3600

crypto map hongkongvpn 5 ipsec-isakmp

crypto map hongkongvpn 5 match address hk

crypto map hongkongvpn 5 set peer ***public ip of europe router***

crypto map hongkongvpn 5 set transform-set london

crypto map hongkongvpn 5 set security-association lifetime seconds 28800 kilobytes 4608000

crypto map hongkongvpn interface outside

isakmp enable outside

isakmp key ******** address ***** netmask 255.255.255.255

isakmp identity address

isakmp policy 1 authentication pre-share

isakmp policy 1 encryption 3des

isakmp policy 1 hash md5

isakmp policy 1 group 2

isakmp policy 1 lifetime 86400

Europe PIX 7.0:

nat (inside) 0 access-list london-nat

access-list london-nat extended permit ip 192.168.71.0 255.255.255.0 192.168.70.0 255.255.255.0

access-list 101 extended permit ip 192.168.71.0 255.255.255.0 192.168.70.0 255.255.255.0

crypto ipsec transform-set RTS esp-3des esp-sha-hmac

crypto ipsec transform-set london esp-3des esp-md5-hmac

crypto ipsec security-association lifetime seconds 3600

crypto map RTS 1 set peer ******

crypto map RTS 1 set transform-set RTS

crypto map RTS 1 set security-association lifetime seconds 28800

crypto map vpntunnel 21 match address 101

crypto map vpntunnel 21 set peer ***public ip of london router****

crypto map vpntunnel 21 set transform-set london

crypto map vpntunnel 21 set security-association lifetime seconds 28800

crypto map vpntunnel interface outside

isakmp identity address

isakmp enable outside

isakmp policy 1 authentication pre-share

isakmp policy 1 encryption 3des

isakmp policy 1 hash md5

isakmp policy 1 group 2

isakmp policy 1 lifetime 86400

tunnel-group RTS type ipsec-l2l

tunnel-group ****** type ipsec-l2l

tunnel-group ****** ipsec-attributes

pre-shared-key *

tunnel-group ***** type ipsec-l2l

tunnel-group ***** ipsec-attributes

pre-shared-key *

Any help would be appreciated!

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.

Actions

This Discussion