Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Attention: The Community will be in read-only mode on 12/14/2017 from 12:00 am pacific to 11:30 am.

During this time you will only be able to see content. Other interactions such as posting, replying to questions, or marking content as helpful will be disabled for few hours.

We apologize for the inconvenience while we perform important updates to the Community.

New Member

PIX to PIX VPN

I am setting up a pix to pix vpn and keep getting the error message "IPSEC(ipsec_encap): crypto map check deny" any time I try to pass a packet across the VPN. I believe the VPN is up but I am 100% sure how to verify this. What is causing this error message???

Thanks,

~Dennis~

dennis.eastman@netplex-south.com

2 REPLIES
New Member

Re: PIX to PIX VPN

How to verify that the VPN is up: ping across the VPN from the first LAN to the second LAN. A successful ping will usually mean it is working, but since you are getting this error message I believe it will fail.

Are the access lists mirror images of each other, on each side of the VPN? Did you apply the map to the interface after modifying it? The command to do this looks like "crypto map map1 interface outside." This clears the SA's and re-initializes the database. You must do this command every time you create or modify a crypto map.

Check the status of the VPN SA's by typing "show crypto ipsec sa" and "sho crypto isakmp sa" into the PIX. There will be SA's at the isakmp and the ipsec levels.

Ping across the VPN again, and check the SA's. Did this work?

Thanks,

Sam

New Member

Re: PIX to PIX VPN

Just check your ACL to make sure that they are matching the interesting traffic (i.e the ip packets that you want to encrypt)

243
Views
0
Helpful
2
Replies
CreatePlease to create content