Hi David,

On the Cisco side you should be able to get it working with this (in my config the 10.x.16.0 is the local subnet, and the 128.x.x.0 is the remote subnet):

crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
lifetime 28800
crypto isakmp key address x.x.x.x
!
!
crypto ipsec transform-set ESP-3DES-SHA1 esp-3des esp-sha-hmac
!
crypto map XX_XX 1 ipsec-isakmp
set peer x.x.x.x
set transform-set ESP-3DES-SHA1
set pfs group2
match address 150
!
interface Dialer0
...
crypto map XX_XX
...
!
ip nat inside source list 100 interface Dialer0 overload
!
access-list 100 deny   ip 10.x.16.0 0.0.0.255 128.x.x.0 0.0.0.255
access-list 100 permit ip 10.x.16.0 0.0.0.255 any

access-list 150 permit ip 10.x.16.0 0.0.0.255 128.x.x.0 0.0.0.255
access-list 150 permit icmp 10.x.16.0 0.0.0.255 128.x.x.0 0.0.0.255
access-list 150 permit icmp 128.x.x.0 0.0.0.255 10.x.16.0 0.0.0.255

If you have your Cisco router configged like this, then the problem resides on your ISA side. Please check if it works with above config on your Cisco side, if not I can send you some screens from our ISA config.

Untill now I was not able to find a solution for the Dropouts on our VPN tunnels.

We use the following IOS on our routers: c870-advsecurityk9-mz.124-15.T9 is there any know bug on this version that can cause my dropouts?

Best regards and happy newyear!

Peter

Hi Peter,

Thanks for the config.

I'm still having problems and now I suspect that they are on the ISA end.

A bit of background - I also publish OWA via RPC over HTTPS and connect via Outlook 2007. I found several articles that say I should have the external ip address of the Cisco added into the properties for the Cisco network in ISA. As soon as I add this and apply the setting I am unable to access Exchange2007 OWA (via Internet Explorer or Outlook), unable to connect via PPTP vpn.

The interesting part is that once I add in that ip to the Cisco network object within ISA the session monitor tells me that the ipsec tunnel is connected to the branch. But I cannot ping from ISA to the Cisco network.

Can you send through some more details about how you have the ISA end configured?

Thanks,

David

Hi David,

We do not add the External IP of our Cisco router in the properties of ISA.

Properties on our ISA per VPN:

General:

Name, Description and enabled.

Addresses:

Start address - End Address

10.x.x.0 10.x.x.255

Connection:

Remote tunnel endpoint

"External ip from your Cisco"

Local VPN gateway address

"External ip from your ISA"

Ipsec Settings: see my first post on this topic.

Authentication:

Use pre-shared key for authenticaton

"pre shared key"

That makes it work on our side so I hope this helps.

You can check the status of your vpn tunnel on the Cisco site by "show crypto isakmp sa" and "show crypto ipsec sa".

Best regards,

Peter