Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
New Member

IPSec between a 3600 and PIX

We're trying to establish a LAN to LAN IPSEC connection between a Cisco 3600 12.3(6) and a PIX 6.3(4). The 3600 is behind a NAT firewall. It seems like the ISAKMP and IPSEC negotiation is successful, but we can't ping between the end points. The tunnel interface on the router shows no packets received and "sho crypto ipsec sa" shows errors and no encapsulated packets. I can see a route pointing to the tunnel interface in the 3600 for the remote network. Could you recommend more troubleshooting procedures? It would be appreciated. Configs attached.

Thank You,


Cisco Employee

Re: IPSec between a 3600 and PIX

You don't need the tunnel interface on the router, that's only for doing GRE/IPSec which the PIX does NOT support. Do the following on the router:

no interface tunnel5

Then on the PIX you need to modify your crypto and "nat 0" acl's to be the exact opposite of the router acl, so cut/paste the following:

access-list inside_outbound_nat0_acl permit ip

no access-list inside_outbound_nat0_acl permit ip any

access-list outside_cryptomap_B permit ip

no access-list outside_cryptomap_B permit ip host Router-Cisco B

no access-list outside_cryptomap_B permit ip host Brick-interna Babcock_Brown

no access-list outside_cryptomap_B permit ip host Tacacs B

Actually with your current PIX config is any internal user traffic getting out through this device? Add the following to PAT standard (non-encrypted) traffic to the outside interface address:

nat (inside) 1

That should get you a bit closer to a tunnel being built and it passing traffic correctly.

CreatePlease to create content