Unanswered Question
Jul 30th, 2009
User Badges:

Hi, hope someone can help with this. I am trying to establish a site to site tunnel between an ios router and a PIX 7.0(1). The ios router is 12.4(15)T7. At the IOS router side I have configured a static 1 to 1 NAT to translate the 172.31.x.x source address to 172.30.x.x, the crypto's at both sides of the tunnel are configured for 172.30.x.x subnet. What I can see happening is the tunnel being established, the IOS router encaps/decaps packets, but the counter on the PIX side is only encapsulating packets, absolutely none are being decapsulated. So it looks like the pix is sending packets, the ios router is sending and receiving them……

The relevant info in the configs is below, any suggestions would be welcome.

IOS Router

ip access-list extended CRYPTO

permit ip

permit ip

crypto isakmp policy 1

encr 3des

hash md5

authentication pre-share

group 2

crypto isakmp key xxxxx address xxxxxx



crypto ipsec transform-set 3DES-MD5 esp-3des esp-md5-hmac


crypto map VPN 10 ipsec-isakmp

set peer x.x.x.x

set transform-set 3DES-MD5

match address CRYPTO

ip nat inside source static network /16

I can see the NAT translations occuring when I put in the sh ip nat translations. IP NAT inside is applied to the internal LAN interface, IP NAT outside is applied to the dialer interface.


access-list crypto extended permit ip

access-list crypto extended permit ip

access-list 102 extended permit ip

access-list 102 extended permit ip

nat (inside) 0 access-list 102

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto map outside_map 200 match address crypto

crypto map outside_map 200 set peer x.x.x.x

crypto map outside_map 200 set transform-set ESP-3DES-MD5

crypto map outside_map interface outside

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
petersrule2003 Sun, 08/02/2009 - 13:00
User Badges:

Since the pix is encapsulating and the IOS is encapsulating and decapsulating traffic then it suggests to be that there may be a firewall blocking esp over udp traffic(inbound on the filtering device in the transit path ) from the ios back to the pix hence the pix has no packets to deencapsulate


kegodfrey Tue, 08/04/2009 - 00:51
User Badges:

Thanks for getting back to me. I've checked the config of the internet facing router and there is no port filtering. At present, I have VPN clients that can connect to the PIX for remote access. I still cannot see how the PIX is either not receiving packets from the ios router, or is receiving them and not identifying them as being to/from an established VPN tunnel...


This Discussion