Site to Site VPN Problems

Answered Question
Dec 17th, 2009
User Badges:

Hi all, I'm trying to replicate a site to site VPN before I go and install in but having a couple of issues, the tunnel is up but I’m having problems pinging laptops connected to each of them, the error is at the bottom of this thread.


I'm using pix 515 and a 501 with a Crossover cable with configs as follows: -


PIX 515


PIX Version 6.3(3)

interface ethernet0 auto

interface ethernet1 auto

nameif ethernet0 outside security0

nameif ethernet1 inside security100

enable password 8Ry2YjIyt7RRXU24 encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

hostname firewall

domain-name local

fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69

names

access-list inside_nat_outbound permit ip any 172.22.7.0 255.255.255.0

access-list inside_nat_outbound permit ip any 172.16.0.0 255.255.255.0

access-list outside_cryptomap_9 permit ip host 192.168.115.9 172.22.7.0 255.255.255.0

access-list outside_cryptomap_9 permit ip host 192.168.115.9 172.16.0.0 255.255.255.0

pager lines 24

logging console debugging

mtu outside 1500

mtu inside 1500

ip address outside 192.72.164.150 255.255.255.192

ip address inside 10.10.9.1 255.255.255.0

ip audit info action alarm

ip audit attack action alarm

no failover

failover timeout 0:00:00

failover poll 15

no failover ip address outside

no failover ip address inside

pdm location 10.10.9.2 255.255.255.255 inside

pdm history enable

arp timeout 14400

global (outside) 1 192.168.115.9

nat (inside) 1 access-list inside_nat_outbound 0 0

route outside 0.0.0.0 0.0.0.0 194.72.164.151 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

aaa-server LOCAL protocol local

http server enable

http 10.10.9.2 255.255.255.255 inside

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

sysopt connection permit-ipsec

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto map outside_map 14 ipsec-isakmp

crypto map outside_map 14 match address outside_cryptomap_9

crypto map outside_map 14 set pfs

crypto map outside_map 14 set peer 194.72.164.151

crypto map outside_map 14 set transform-set ESP-3DES-MD5

crypto map outside_map interface outside

isakmp enable outside

isakmp key ******** address 192.72.164.151 netmask 255.255.255.255

isakmp identity address

isakmp policy 1 authentication pre-share

isakmp policy 1 encryption 3des

isakmp policy 1 hash md5

isakmp policy 1 group 1

isakmp policy 1 lifetime 86400

telnet timeout 5

ssh timeout 5

console timeout 0

terminal width 80

Cryptochecksum:c74b0dfc07a242f8c76795675742ac60


PIX 501


PIX Version 6.3(4)

interface ethernet0 auto

interface ethernet1 100full

nameif ethernet0 outside security0

nameif ethernet1 inside security100

enable password 8Ry2YjIyt7RRXU24 encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

hostname testpix

domain-name default

fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69

names

access-list outside_cryptomap_9 permit ip 172.16.0.0 255.255.255.0 host 192.168.115.9

access-list outside_cryptomap_9 permit ip 172.22.7.0 255.255.255.0 host 192.168.115.9

pager lines 24

logging on

mtu outside 1500

mtu inside 1500

ip address outside 192.72.164.151 255.255.255.192

ip address inside 172.22.7.1 255.255.255.0

ip audit info action alarm

ip audit attack action alarm

pdm location 172.22.7.2 255.255.255.255 inside

pdm location 192.168.3.1 255.255.255.255 inside

pdm history enable

arp timeout 14400

route outside 0.0.0.0 0.0.0.0 194.72.164.150 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server TACACS+ max-failed-attempts 3

aaa-server TACACS+ deadtime 10

aaa-server RADIUS protocol radius

aaa-server RADIUS max-failed-attempts 3

aaa-server RADIUS deadtime 10

aaa-server LOCAL protocol local

http server enable

http 192.168.3.1 255.255.255.255 inside

http 172.22.7.2 255.255.255.255 inside

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

sysopt connection permit-ipsec

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto map outside_map 14 ipsec-isakmp

crypto map outside_map 14 match address outside_cryptomap_9

crypto map outside_map 14 set pfs

crypto map outside_map 14 set peer 194.72.164.150

crypto map outside_map 14 set transform-set ESP-3DES-MD5

crypto map outside_map interface outside

isakmp enable outside

isakmp key ******** address 192.72.164.150 netmask 255.255.255.255

isakmp identity address

isakmp policy 1 authentication pre-share

isakmp policy 1 encryption 3des

isakmp policy 1 hash md5

isakmp policy 1 group 1

isakmp policy 1 lifetime 86400

telnet timeout 5

ssh timeout 5

console timeout 0

terminal width 80

Cryptochecksum:a68ab952f8b667e7dbf9bbb8adb6926e


The tunnel is up but I’m getting the following from the PIX 501 when I try and ping from either PC that is connected to each of the PIX: -


305005: No translation group found for icmp src inside:172.22.7.2 dst outside:10.10.9.2 (type 8, code 0)


305005: No translation group found for icmp src outside:192.168.115.9 dst inside:172.22.7.2 (type 8, code 0)


305005: No translation group found for icmp src inside:172.22.7.2 dst outside:10.10.9.2 (type 8, code 0)


305005: No translation group found for icmp src outside:192.168.115.9 dst inside:172.22.7.2 (type 8, code 0)


305005: No translation group found for icmp src inside:172.22.7.2 dst outside:10.10.9.2 (type 8, code 0)


305005: No translation group found for icmp src outside:192.168.115.9 dst inside:172.22.7.2 (type 8, code 0)


Hope you can help me work this out


Thanks for your time and hopefully solution.


Martyn

Correct Answer by yamramos.tueme about 7 years 7 months ago

Hi Martyn!


It looks to me that you are missing the no-nat (or nat excemption command) You can try adding this into your configuration:



PIX 515

access-list nonat permit ip host 192.168.115.9 172.22.7.0 255.255.255.0

access-list nonat permit ip host 192.168.115.9 172.16.0.0 255.255.255.0

nat (inside) 0 access-list nonat


PIX 501

access-list nonat permit ip 172.16.0.0 255.255.255.0 host 192.168.115.9

access-list nonat permit ip 172.22.7.0 255.255.255.0 host 192.168.115.9

nat (inside) 0 access-list nonat



As you can notice the access-list "nonat" looks the same as the one you have in your crypto map.


Hope that works for you!


Cheers!

- Yamil

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
yamramos.tueme Thu, 12/17/2009 - 10:34
User Badges:

Hi Martyn!


It looks to me that you are missing the no-nat (or nat excemption command) You can try adding this into your configuration:



PIX 515

access-list nonat permit ip host 192.168.115.9 172.22.7.0 255.255.255.0

access-list nonat permit ip host 192.168.115.9 172.16.0.0 255.255.255.0

nat (inside) 0 access-list nonat


PIX 501

access-list nonat permit ip 172.16.0.0 255.255.255.0 host 192.168.115.9

access-list nonat permit ip 172.22.7.0 255.255.255.0 host 192.168.115.9

nat (inside) 0 access-list nonat



As you can notice the access-list "nonat" looks the same as the one you have in your crypto map.


Hope that works for you!


Cheers!

- Yamil

martynch1 Fri, 12/18/2009 - 02:11
User Badges:

Thanks for the response, tunnel is up and I can ping one way which is a massive step in the right direction, but I have one more issue with it.

Pix501: -

Has a laptop connected with an IP address of 172.22.7.2

Pix515

Has a Laptop connected with an IP address of 10.10.9.1

10.10.9.1 Can ping 172.22.7.2 but not from the other way around, 172.22.7.2 can not ping the nat’d IP of 10.10.9.1

Hope you can continue to help

Thanks

martynch1 Fri, 12/18/2009 - 09:37
User Badges:

Forget my above post, how stupid of me... Yes it worked thanks very much.


Have a great festive season


Martyn

Actions

This Discussion