SITE TO SITE VPN INITIATION ISSUE

veltech · ‎08-12-2013

Hi All,

We are having trouble with a site to site VPN as follows:

PROBLEM

In this example we will use site A and site B. We have a Pix 515E at site A and a Cisco 1801 at site B with a site to site between the two. If we ping from site B to site A then the tunnel comes up and we can ping in either direction and traffic flows in both directions. If we try to ping from site A to site B to bring up the tunnel then the pings will fail. So, put another way we can only initiate the tunnel from site B.

TROUBLE SHOOTING SO FAR

We have checked the NAT and ACLs, all of which seem fine and seem comparable with other configs on working systems in the field.

Anyone have any suggestions or possible causes?

regards,

fb_webuser · ‎08-12-2013

Can you post the configs? Also when behind the 1801, when you try to ping does the tunnel come up? What is showing when you do a show crypto ipsec or isakmp?

Also might try debug crypto ipsec/isakmp and try initialize tunnel. That debug should/would tell you the exact cause. Lastly, are you trying ping from the 1801 to the PIX, or a device behind the PIX?

---

Posted by WebUser Sean Waite from Cisco Support Community App

jawad-mukhtar · ‎08-12-2013

Post config

.

Jawad

veltech · ‎08-13-2013

Hi All,

Please find answers to questions so far and the config for the 1801.

We can ping from either a PC behind the 1801 or from the 1801 directly, either will bring up the tunnel. Alternatively if we ping from the Pix we can not initiate the tunnel. We have run debug on the 1801 but it shows nothing as it seems the traffic is not getting over the VPN to the 1801. Just to recap; our problem is that we can not initiate the tunnel from the Pix side, only from the 1801 side. Here is the sanitised config:

rt23#sh run

Building configuration...

Current configuration : 6871 bytes

!

version 12.4

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

!

hostname rt23

!

boot-start-marker

boot-end-marker

!

logging buffered 52000

enable secret XXXXXXXXXXXXXXXX

!

aaa new-model

!

aaa authentication login default local

aaa authorization exec default local

!

aaa session-id common

clock summer-time BST recurring last Sun Mar 2:00 last Sun Oct 2:00

!

dot11 syslog

!

ip cef

no ip dhcp use vrf connected

ip dhcp excluded-address 172.16.99.1 172.16.99.10

ip dhcp excluded-address 172.16.99.240 172.16.99.254

!

ip dhcp pool LAN23

network 172.16.99.0 255.255.255.0

default-router 172.16.99.1

dns-server 172.16.99.1

domain-name XXXXX

!

ip name-server 208.67.220.220

ip name-server 208.67.222.222

ip inspect tcp reassembly queue length 128

ip inspect tcp reassembly timeout 10

ip inspect name myfw cuseeme timeout 3600

ip inspect name myfw ftp timeout 3600

ip inspect name myfw rcmd timeout 3600

ip inspect name myfw realaudio timeout 3600

ip inspect name myfw smtp timeout 3600

ip inspect name myfw tftp timeout 3600

ip inspect name myfw udp timeout 15

ip inspect name myfw h323 timeout 3600

ip inspect name myfw sip

ip inspect name myfw icmp

ip inspect name myfw tcp timeout 3600

ip inspect name myfw http timeout 3600

ip ddns update method ddns

HTTP

add http://XXXXXXXXXXXXXXXXX

interval maximum 0 0 10 0

interval minimum 0 0 5 0

!

multilink bundle-name authenticated

!

username XXXXXXXXXXXXXXXXXX

!

crypto isakmp policy 10

encr 3des

authentication pre-share

group 2

crypto isakmp key XXXXXXXXXXXX hostname ZZZZZZZZZZZZ

crypto isakmp keepalive 20 5

crypto isakmp nat keepalive 20

!

crypto ipsec transform-set SET23 esp-3des esp-sha-hmac

!

crypto map MAP23 10 ipsec-isakmp

set peer ZZZZZZZZZZ dynamic

set transform-set SET23

set pfs group2

match address 100

!