Cisco 800 VPN to a NetScreen-25

[jfarrer]

I am trying to configure a VPN tunnel between a Cisco 800 router and a NetScreen-25 firewall. I am able to complete Phase 1, but Phase 2 debugs show "peer not found". What am I missing?

[ggilbert]

Hello,

Would it be possible if you could please upload the config from the Cisco 800 series router.

Thanks

Gilbert

[jfarrer]

here are the configs for the Cisco 800 and the NetScreen

[ajagadee · Accepted solution]

Jack,

The crypto configuration on the 800 router has overlapping access-lists.

Crypto map access-list 115 and 116 are overlapping. Meaning, the destination is the same network and they are to two different peers.

access-list 115 permit ip 192.168.103.64 0.0.0.31 192.168.101.0 0.0.0.255

access-list 116 permit ip 192.168.103.64 0.0.0.31 192.168.101.0 0.0.0.255

access-list 116 permit ip 192.168.101.0 0.0.0.255 192.168.103.64 0.0.0.31

Also, access-list 116 has a destination of 192.168.103.64 0.0.0.31 which is your network.

Please update the configuration and try to bring up the tunnel.

Let me know how it goes.

Regards,

Arul

** Please rate all helpful posts **

[ggilbert]

Jack,

Also take a look at ACL - 117

access-list 117 permit ip 192.168.103.64 0.0.0.31 192.168.101.0 0.0.0.255

access-list 117 permit ip 192.168.101.0 0.0.0.255 192.168.103.64 0.0.0.31

You do not need the second entry.

Cheers

Gilbert

- Rate it, if it helps -

[jfarrer]

Arul,

That did the trick. I removed the overlapping peer and removed the access lists that weren't being used. Thanks for you help.

Jack.