Pix to 3640 router

[ahall]

Hi, I have configured a VPN tunnel from a PIX to a Cisco 3640. The problem is I can only initiate the tunnel from the PIX side. Once the IPSec SA is created I can ping from either side, but I can only ping from the PIX side initially.

I've triple checked all access-lists but can't see anything wrong.

Any ideas ?

[edadios]

If you are sure about the access-list, it could be some firewalling issue.

Since the tunnel is up from the firewall end, the traffic from the router end can already send to the pix end.

If initiating from router end, it could be being blocked by some firewalling/filter inbound to the pix.

Regards,

[ahall]

I have found the problem, the access-lists have to match exactly on both ends.

My access-list read:

Router side:

permit ip 10.128.0.0 0.0.255.255 192.168.80.0 255.255.255.0

PIX side:

permit ip 192.168.80.0 255.255.255.0 10.128.1.0 255.255.255.0

permit ip 192.168.80.0 255.255.255.0 10.128.2.0 255.255.255.0

needed to change it to:

router side:

stayed the same.

pix side:

permit ip 192.168.80.0 255.255.255.0 10.128.0.0 255.255.0.0

Now it works in both directions !

Thanks for your help