Hi I am trying to create a Site-to-Site VPN connection between a Nortel box and a Pix 525. I am able to get phase 1 up in QM-IDLE status but not able to get phase 2 working. I think there is a routing/nat problem but I am not sure. The inside network on the pix is a public address 63.xx.xx.xx and we need to nat this to another public address 65.xx.xx.xx This setup is a little different form a normal connection since the vpn peer is on the 65.xx.x.xx network and the hosts are supposed to be as well. We also had to bring in another t1 in addition to the main t1 for internet access. So this vpn connection is supposed to be off another inerface on the pix. We can not let the other site of the vpn connection know of the 63.xx.xx.xx network. Is it possible to have the peer and the host on the same network? Thanks for your help.
Just a little more info. This is what I get when I debug ipsec.
PH-PH-PIX-01(config)# IPSEC(key_engine): got a queue event...
IPSEC(key_engine_delete_sas): rec'd delete notify from ISAKMP
IPSEC(key_engine_delete_sas): delete all SAs shared with 205.xx.xx.xx
IPSEC(key_engine): got a queue event...
IPSEC(spi_response): getting spi 0xf3b5fbb2(4088789938) for SA
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
Table of Contents Introduction:This document describes details on how
NAT-T works. Background: ESP encrypts all critical information,
encapsulating the entire inner TCP/UDP datagram within an ESP header.
ESP is an IP protocol in the same sense that TCP an...