IPSec VPN with VPN-DES??

Unanswered Question
Jan 17th, 2009
User Badges:

I have a cisco pix 515e with an image version 7.2, but it dOesn't have a license to support VPN-3DES-AES so I have configured it for VPN-DES but unable establish a remote-access VPN connections.

The configuration is as pasted below, kindly review and suggest any corrections.



vpn-firewall# sh run

vpn-firewall# sh running-config

: Saved


PIX Version 7.2(4)


hostname atheeb-vpn-firewall

enable password xxx

passwd xxx




interface Ethernet0

nameif outside

security-level 0

ip address 212.33.x.y


interface Ethernet1

nameif inside

security-level 100

ip address


ftp mode passive

access-list nonat extended permit ip

access-list nonat extended permit ip

pager lines 24

mtu outside 1500

mtu inside 1500

ip local pool test mask

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list nonat

nat (inside) 1

route outside 212.33.x.z 1

route inside 1

route inside 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set atheebset esp-des esp-md5-hmac

crypto dynamic-map dyn1 1 set reverse-route

crypto map mymap 1 ipsec-isakmp dynamic dyn1

crypto map mymap interface outside

crypto isakmp identity hostname

crypto isakmp enable outside

crypto isakmp policy 1

authentication pre-share

encryption des

hash sha

group 2

lifetime 43200

crypto isakmp policy 65535

authentication pre-share

encryption des

hash sha

group 2

lifetime 86400

crypto isakmp nat-traversal 20

vpn-sessiondb max-session-limit 450

telnet inside

telnet timeout 5

ssh timeout 5

console timeout 0

username user password xxxencrypted

tunnel-group test-vpn type ipsec-ra

tunnel-group test-vpn general-attributes

address-pool test

tunnel-group test-vpn ipsec-attributes

pre-shared-key *


class-map inspection_default

match default-inspection-traffic



policy-map type inspect dns migrated_dns_map_1


message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns migrated_dns_map_1

inspect ftp

inspect h323 h225

inspect h323 ras

inspect netbios

inspect rsh

inspect rtsp

inspect skinny

inspect esmtp

inspect sqlnet

inspect sunrpc

inspect tftp

inspect sip

inspect xdmcp


service-policy global_policy global

prompt hostname context


: end

vpn-firewall# exit



vpn-firewall# sh version

Cisco PIX Security Appliance Software Version 7.2(4)

Licensed features for this platform:

Maximum Physical Interfaces : 3

Maximum VLANs : 10

Inside Hosts : Unlimited

Failover : Disabled

VPN-DES : Enabled

VPN-3DES-AES : Disabled

Cut-through Proxy : Enabled

Guards : Enabled

URL Filtering : Enabled

Security Contexts : 0

GTP/GPRS : Disabled

VPN Peers : Unlimited

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)


This Discussion