PIX-to-PIX VPN not working

[ckaiser]

Here's my setup:

local-pix 501 connected to DSL line.

Remote-pix 506e connected to dsl line

single routable IP address on each PIX (so using PAT, not NAT).

trying to create site-to-site vpn. Tried PDM, CLI via cisco's documentation, CLI via Richard Deal's book. I can apparently make the connections, but no traffic flows. I have no idea what I'm doing wrong. Here's the relevant configs:

Local PIX:

PIX Version 6.3(3)

interface ethernet0 auto

interface ethernet1 100full

nameif ethernet0 outside security0

nameif ethernet1 inside security100

enable password

passwd

hostname encima

domain-name golden-eagle.org

fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol ils 389

fixup protocol pptp 1723

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69

names

access-list outside_access_in permit gre 64.144.92.0 255.255.255.128 any log

access-list outside_access_in permit tcp 64.144.92.0 255.255.255.128 eq pptp any eq pptp log

access-list outside_access_in permit icmp any any echo-reply

access-list outside_access_in permit icmp any any time-exceeded

access-list outside_access_in permit icmp any any source-quench

access-list outside_access_in permit icmp any any unreachable

access-list outside_access_in permit esp host 66.159.222.109 host 67.100.95.114

access-list outside_access_in permit esp host 67.100.95.114 host 66.159.222.109

access-list 90 permit ip 172.17.0.0 255.255.255.0 172.24.1.0 255.255.255.0

pager lines 24

logging on

logging monitor informational

logging buffered informational

icmp permit host 67.100.95.114 outside

icmp permit any inside

mtu outside 1500

mtu inside 1500

ip address outside x.x.x.109 255.255.255.0

ip address inside 172.17.0.1 255.255.255.0

ip audit info action alarm

ip audit attack action alarm

pdm location 172.24.1.0 255.255.255.0 outside

pdm location 172.17.0.0 255.255.255.0 outside

pdm location 64.144.92.0 255.255.255.128 outside

pdm location 172.17.0.0 255.255.0.0 inside

pdm logging informational 100

pdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list 90

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

access-group outside_access_in in interface outside

route outside 0.0.0.0 0.0.0.0 66.159.222.1 1

timeout xlate 0:05:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

aaa-server LOCAL protocol local

aaa authentication ssh console LOCAL

aaa authorization command LOCAL

http server enable

http x.x.x.x 255.255.255.255 outside

http x.x.x.x 255.255.255.128 outside

http 172.17.0.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

sysopt connection permit-ipsec

crypto ipsec transform-set strong esp-3des esp-sha-hmac

crypto map toEssex 20 ipsec-isakmp

crypto map toEssex 20 match address 90

crypto map toEssex 20 set peer 67.100.95.114

crypto map toEssex 20 set transform-set strong

crypto map toEssex interface outside

isakmp enable outside

isakmp key ******** address 67.100.95.114 netmask 255.255.255.255

isakmp policy 9 authentication pre-share

isakmp policy 9 encryption 3des

isakmp policy 9 hash sha

isakmp policy 9 group 1

isakmp policy 9 lifetime 86400

telnet 172.17.0.0 255.255.255.0 inside

telnet timeout 60

ssh x.x.x.x 255.255.255.128 outside

ssh timeout 60

console timeout 0

dhcpd address 172.17.0.2-172.17.0.32 inside

dhcpd dns x.x.x.100 66.218.44.5

dhcpd lease 3600

dhcpd ping_timeout 750

dhcpd auto_config outside

dhcpd enable inside

username ckaiser password **** encrypted privilege 15

terminal width 80

Cryptochecksum:xxxxxx

: end

Remote PIX:

PIX Version 6.3(1)

interface ethernet0 auto

interface ethernet1 auto

nameif ethernet0 outside security0

nameif ethernet1 inside security100

enable password

passwd

hostname EVL-PIX-DSL

domain-name essexcredit.com

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol ils 389

fixup protocol pptp 1723

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

names

access-list outside_access_in permit gre any any log

access-list outside_access_in permit tcp any any eq pptp log

access-list outside_access_in permit icmp any any echo-reply

access-list outside_access_in permit icmp any any time-exceeded

access-list outside_access_in permit icmp any any source-quench

access-list outside_access_in permit icmp any any unreachable

access-list outside_access_in permit esp host x.x.x.114 host 66.159.222.109

access-list outside_access_in permit esp host 66.159.222.109 host 67.100.95.114

access-list 80 permit ip 172.24.1.0 255.255.255.0 172.17.0.0 255.255.255.0

pager lines 24

logging on

logging timestamp

logging monitor debugging

logging buffered informational

logging trap debugging

logging history warnings

logging facility 22

icmp permit host x.x.222.109 outside

icmp permit any inside

mtu outside 1500

mtu inside 1500

ip address outside x.x.x.114 255.255.255.248

ip address inside 172.24.1.240 255.255.255.0

ip audit info action alarm

ip audit attack action alarm

pdm location x.x.x.x 255.255.255.255 outside

pdm location 172.24.1.0 255.255.255.0 inside

pdm logging informational 100

pdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list 80

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

access-group outside_access_in in interface outside

route outside 0.0.0.0 0.0.0.0 67.100.95.113 1

route outside x.x.x.0 255.255.0.0 66.159.222.109 1

timeout xlate 0:05:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

aaa-server LOCAL protocol local

aaa authentication ssh console LOCAL

aaa authorization command LOCAL

http server enable

http x.x.x.x 255.255.255.255 outside

http 172.24.1.0 255.255.255.0 inside

snmp-server host inside 172.24.1.11

snmp-server location Emeryville, CA

snmp-server contact Charlie Kaiser

snmp-server community snmp4esx!

snmp-server enable traps

floodguard enable

sysopt connection permit-ipsec

crypto ipsec transform-set strong esp-3des esp-sha-hmac

crypto map toEncima 10 ipsec-isakmp

crypto map toEncima 10 match address 80

crypto map toEncima 10 set peer 66.159.222.109

crypto map toEncima 10 set transform-set strong

crypto map toEncima interface outside

isakmp enable outside

isakmp key ******** address 66.159.222.109 netmask 255.255.255.255

isakmp policy 8 authentication pre-share

isakmp policy 8 encryption 3des

isakmp policy 8 hash sha

isakmp policy 8 group 1

isakmp policy 8 lifetime 86400

telnet 172.24.1.0 255.255.255.0 inside

telnet timeout 60

ssh x.x.x.x 255.255.255.255 outside

ssh timeout 60

console timeout 0

username ckaiser password ***** encrypted privilege 15

terminal width 80

Cryptochecksumxxxxxx

: end

When I try to ping an address on the 172.24 net from the first pix, I get no reply. When I try to ping an address on the 172.17 net from the second pix, I get no reply. Internet connectivity is fine. I can ping the outside addresses of each pix OK.

My debug output for isakmp shows return status is IKMP_NO_ERROR and the SAs look OK;everything matches. More configs/debugs available on request.

Any idea why I can't get from one network to another?

Thanks!

Charlie Kaiser

[kagodfrey · Accepted solution]

"When I try to ping an address on the 172.24 net from the first pix, I get no reply. When I try to ping an address on the 172.17 net from the second pix, I get no reply."

It could be as simple as because you are trying to ping from the pixs (because you can't) and your tunnel could actually be functioning correctly

Try pinging from a device on 172.17 to one on 172.24.

(Make sure that your gateway to the opposing LAN for these host devices are configured to be the pixs)

HTH

[mostiguy]

route outside 172.17.0.0 255.255.0.0 66.159.222.109 1

does this route actually do anything? it looks like 66.159.222.109 isn't on a local subnet, so this routing statement should not work, but it might interfere with things.

[ckaiser]

I had tried that with no success. I made one change; I upgraded the FOS on the remote PIX to 6.3.3 and now I have a one-way connection from the remote to the local, but I can't get back the other direction yet. Reloaded crypto maps again, but still no change.

Default GW is set correctly.

I've looked at icmp debugs and don't see the local-to-remote showing up on the remote, although I do see the remote-to-local showing up on the local. Can't figure out if it's routing or ACLs.

I do see one difference on the output of sh ipsec sa. On the local i get:

PERMIT, flags={origin_is_acl,}

On the remote I get:

PERMIT, flags={}

Also, the pkts encaps/encrypt/etc numbers don't add up between local and remote.

Odd...

[michelcaissie]

Charlie

-does a "sh isakmp sa" gives a QM_IDLE

-be sure to have the same isakmp key on both side

- you could also do a capture to see if IPSEC traffic flows between both PIX

access-list acl_cap permit ip host 66.159.222.109 host 67.100.95.114

access-list acl_cap permit ip host 67.100.95.114 host 66.159.222.109

capture capcheck access-list acl_cap interface outside

sh capture capcheck

clear capture capcheck

[ali-franks]

Hi Charlie,

What type of DSL router is it?

Ali

[ckaiser]

Local is a BroadMax LinkMax HSA300A

Remote is a Netopia 4652-T.

[mjreupenny]

Hi there Charlie,

I was looking at your configs and I see a few discrepencies. On your local pix should not have:

access-list outside_access_in permit esp host 66.159.222.109 host 67.100.95.114

access-list outside_access_in permit esp host 67.100.95.114 host 66.159.222.109

<<<< Since the IPSec connection is terminating on the pix itself, no need for these access-list statements

On your Remote Pix, you shouldn't have:

access-list outside_access_in permit esp host 67.100.95.114 host 66.159.222.109

access-list outside_access_in permit esp host 66.159.222.109 host 67.100.95.114

route outside 172.17.0.0 255.255.0.0 66.159.222.109 1

<<< 1st acl - same reason as above statement 2nd acl unnecessary since outbound traffic from "internal" is allowed anyway.. Routing the internal network doesn't work since the IPsec traffic is governed by the acl you placed to identify "interesting" traffic.

If you choose to remove these statements, I would then delete and reapply the cryptomaps on both pixes. Hopefully, this would work.

If you have never had the connection work with full functionality, then my advice would be to first simplify your configs to the bare minimum. Once you have the connection successfully working, then you can add the extra features one at a time. By doing it this way, you can limit the number of variables plus reduce stress and headache when trying to set this up.

Worst case scenario, call your friendly neighborhood TAC. Good luck.

Miller