×

Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

troubleshooting VPN thru PIX

Unanswered Question
Apr 28th, 2006
User Badges:

PIX 525s between main network and another company. We permit VPN from their network thru ours to allow access to servers, email, etc. VPN has stopped working


How do i debug VPN traffic from their network (172.16.10.50) to ours (10.1.35.75) to see whether traffic is even coming thru the PIX firewall?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.

Troubleshooting Commands


Note: The clear commands must be performed in configuration mode.


clear crypto ipsec sa – Resets the IPSec associations after failed attempts to negotiate a VPN tunnel.


clear crypto isakmp sa – Resets the ISAKMP security associations after failed attempts to negotiate a VPN tunnel.


debug crypto ipsec – Shows if a client is negotiating the IPSec portion of the VPN connection.


debug crypto isakmp – Shows if the peers are negotiating the ISAKMP portion of the VPN connection.


All the above can be found here:


http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a0080094761.shtml


What's the output for: sho isakmp sa

And do you see encap / decap counts when you issues:


sho ipsec sa


One more thing, do you actually have L3 connectivity between the two peers? Can you ping from your PIX to your peers outside IP address (remove any icmp deny statements from both peers before issuing ping).


Hope this helps and please rate post if it does.


Jay


Actions

This Discussion