pix unable to ping server IP address over the tunnel

shirwaziri1_2 · ‎09-13-2007

My client has a pix506e and the IP address of it is 192.168.5.1. The pix has established a tunnel connected to the remote site.

I see that the tunnel is up and running:

MCNEILPIX506# show crypto isa sa

Total : 2

Embryonic : 0

dst src state pending created

24.x.x.202 151.147.254.25 QM_IDLE 0 0

24.x.x.202 24.39.88.50 QM_IDLE 0 1

MCNEILPIX506#

My problem is that I cannot ping the remote pix from this Pix. Nor can I ping any ip address that are 10.10.10.0

subnet.

From the show run is there Nat's that I should be creating or access list to allow this pix to be able to connect to that 10.10.10.0 network?

Thanks

lapascua06 · ‎09-16-2007

Hi,

On the remote pix and local pix, enter this command:

pixfirewall(config)# management-access inside

*this command enable us to ping the inside interface of the remote and source our ping on the inside interface of the local pix:

On the local pix, do an extended ping:

(assuming the inside interface of the remote pix is 10.10.10.1)

pixfirewall# ping inside 10.10.10.1

If this doesn't work, double check your VPN configuration..make sure that phase 2 policies as well as crypto ACl are mirrored on both sides.

Hope this helps...

Cheers,

lapascua