PIX-to-PIX VPN config help needed

[chrisloggins]

What am I missing? The configuration is between two LANs, with a pix515 serving the host, and a pix506 at the remote. The pix515 config still has some garbage from the last company that configured it (being removed now). I'm sure it's something simple, but for some reason I don't see what I'm missing... When I 'ping 10.1.18.x' (or anything else to 10.1.18.x) from the host site, there is no response.

[jmia]

Chris,

Take a look at this document for configuration example on site-to-site IPSec VPN:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a0080094761.shtml

Hope this help and if it does please rate post as others might find it useful.

Thanks, and let me know if you need any further help.

Jay

[chrisloggins]

I read that article, and referenced it in configuring the remote site. The only real difference was using 'ip address dhcp outside'. I didn't think that would make a difference, and still no luck.

Here's some more info:

Home -

10.1.17.0 (includes dhcp server inside at 10.1.17.11) -> pix515 -> cablemodem -> (internet)

Remote -

10.1.18.0 (pix506) -> cablemodem -> (internet)

Again, thanks for the help.

[jmia]

Chris,

OK, I was in a hurry earlier, so you have one side with dynamic IP and the other with static IP - correct? If so, look at the configuration details form this document:

http://www.cisco.com/en/US/products/sw/secursw/ps2308/products_configuration_example09186a0080094680.shtml

Let me know if this helps and please rate post as it might help others too.

Thanks -

Jay

[chrisloggins]

Both sides are dynamic IP. The IPs rarely change, and it is possible we will have a static IP in the near future.

[mostiguy]

PIXen require that one side be static. I am not aware of any cisco device that allows both sides to be dynamic. The dynamic side needs to know where the other side is - hence it must be static.

[chrisloggins]

The IPs of the two sites rarely change (once in the past six months). The VPN was functional at some point in the past (prior to the last IP change). My thinking was to config the units as if the IPs were static, and worry about updating the config if/when the IPs changed (assuming static IPs aren't purchased in the interim).