Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Can't Connect to Pix 501 VPN on Network

Hi All,

I have a software VPN client that connects just fine to the PIX 501 VPN, but I cannot ping or telnet to any services on the LAN. Below is my config and results of show cry ipsec sa. I would appreciate any suggestions to fix this.

It's been a while since I have done this. When I check the DHCP address received from the VPN, the default gateway is missing. IIRC, that is normal. What is strange is that when I ping, Windows does not show any sent packets.

Thanks,

--Drichards38

PIX Version 6.3(3)

interface ethernet0 auto

interface ethernet1 100full

nameif ethernet0 outside security0

nameif ethernet1 inside security100

enable password bgVy005CZTsaMOwR encrypted

passwd bgVy005CZTsaMOwR encrypted

hostname cisco

domain-name xxxxxx.biz

fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol ftp 1024-2048

fixup protocol ftp 49152-65534

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69

names

access-list acl-out permit tcp any interface outside eq www

access-list acl_out permit tcp any host aa.bb.cc.dd eq telnet

access-list acl_out permit tcp any host aa.bb.cc.dd eq 3389

access-list acl_out permit tcp any host aa.bb.cc.dd eq 60990

access-list acl_out permit tcp any host aa.bb.cc.dd eq www

access-list acl_out permit tcp any host aa.bb.cc.dd eq www

access-list acl_out permit tcp any host aa.bb.cc.dd eq echo

access-list acl_out permit tcp any host aa.bb.cc.dd eq ftp

access-list acl_out permit tcp any host aa.bb.cc.dd eq https

access-list acl_out permit tcp any interface inside eq www

access-list acl_out permit tcp any interface inside eq ftp

access-list acl_out permit tcp any interface inside eq 3389

access-list acl_out permit tcp any interface inside eq https

access-list acl_out permit tcp any host aa.bb.cc.dd eq www

access-list acl_out permit tcp any host aa.bb.cc.dd eq www

access-list acl_out permit tcp any host aa.bb.cc.dd eq https

access-list acl_out permit tcp any host aa.bb.cc.dd eq https

access-list acl_out permit tcp any host aa.bb.cc.dd eq 3389

access-list acl_out permit tcp any host aa.bb.cc.dd eq 3389

access-list acl_out permit tcp any host aa.bb.cc.dd eq www

access-list acl_out permit tcp any host aa.bb.cc.dd eq https

access-list acl_out permit tcp any host aa.bb.cc.dd eq 3389

access-list acl_out permit tcp any host aa.bb.cc.dd eq ftp

access-list acl_out permit tcp any host aa.bb.cc.dd eq www

access-list acl_out permit tcp any host aa.bb.cc.dd eq https

access-list acl_out permit tcp any host aa.bb.cc.dd eq 3389

access-list acl_out permit tcp any host aa.bb.cc.dd eq 902

access-list acl_out permit tcp any host aa.bb.cc.dd eq ftp

access-list acl_out permit tcp any host aa.bb.cc.dd eq www

access-list acl_out permit tcp any host aa.bb.cc.dd eq ftp

access-list acl_out permit tcp any host aa.bb.cc.dd eq https

access-list acl_out permit tcp any host aa.bb.cc.dd eq 3389

access-list acl_out permit tcp any host aa.bb.cc.dd eq www

access-list acl_out permit tcp any host aa.bb.cc.dd eq ftp

access-list acl_out permit tcp any host aa.bb.cc.dd eq https

access-list acl_out permit tcp any host aa.bb.cc.dd eq 3389

access-list acl_out permit tcp any host aa.bb.cc.dd eq www

access-list acl_out permit tcp any host aa.bb.cc.dd eq https

access-list acl_out permit tcp any host aa.bb.cc.dd eq ftp

access-list acl_out permit tcp any host aa.bb.cc.dd eq 3389

access-list outside_cryptomap_dyn_20 permit ip any 10.0.0.0 255.0.0.0

access-list split_tunnel_acl permit ip 10.0.0.0 255.0.0.0 any

pager lines 24

mtu outside 1500

mtu inside 1500

ip address outside aa.bb.cc.dd 255.255.255.240

ip address inside 192.168.93.1 255.255.255.0

ip audit info action alarm

ip audit attack action alarm

ip local pool low_vpn_pool 10.0.1.205-10.0.1.210

pdm location 172.16.0.0 255.255.0.0 inside

pdm logging informational 100

pdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 1 192.168.93.0 255.255.255.0 0 0

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

static (inside,outside) aa.bb.cc.dd 192.168.93.67 netmask 255.255.255.255 0 0

static (inside,outside) aa.bb.cc.dd 192.168.93.68 netmask 255.255.255.255 0 0

static (inside,outside) aa.bb.cc.dd 192.168.93.69 netmask 255.255.255.255 0 0

static (inside,outside) aa.bb.cc.dd 192.168.93.70 netmask 255.255.255.255 0 0

static (inside,outside) aa.bb.cc.dd 192.168.93.71 netmask 255.255.255.255 0 0

static (inside,outside) aa.bb.cc.dd 192.168.93.72 netmask 255.255.255.255 0 0

static (inside,outside) aa.bb.cc.dd 192.168.93.73 netmask 255.255.255.255 0 0

static (inside,outside) aa.bb.cc.dd 192.168.93.74 netmask 255.255.255.255 0 0

static (inside,outside) aa.bb.cc.dd 192.168.93.75 netmask 255.255.255.255 0 0

static (inside,outside) aa.bb.cc.dd 192.168.93.76 netmask 255.255.255.255 0 0

static (inside,outside) aa.bb.cc.dd 192.168.93.77 netmask 255.255.255.255 0 0

static (inside,outside) aa.bb.cc.dd 192.168.93.78 netmask 255.255.255.255 0 0

access-group acl_out in interface outside

rip inside default version 1

route outside 0.0.0.0 0.0.0.0 aa.bb.cc.dd 1

timeout xlate 0:05:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

aaa-server LOCAL protocol local

aaa authorization command LOCAL

http server enable

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

sysopt connection permit-ipsec

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20

crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5

crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map

crypto map outside_map client authentication LOCAL

crypto map outside_map interface outside

isakmp enable outside

isakmp nat-traversal 20

isakmp policy 20 authentication pre-share

isakmp policy 20 encryption 3des

isakmp policy 20 hash md5

isakmp policy 20 group 2

isakmp policy 20 lifetime 86400

vpngroup MY_VPN address-pool low_vpn_pool

vpngroup MY_VPN dns-server 4.2.2.1

vpngroup MY_VPN default-domain xxxxx.biz

vpngroup MY_VPN split-tunnel split_tunnel_acl

vpngroup MY_VPN idle-time 1800

vpngroup MY_VPN password ********

telnet 0.0.0.0 255.255.255.255 outside

telnet 192.168.93.0 255.255.255.0 inside

telnet timeout 5

ssh 0.0.0.0 0.0.0.0 outside

ssh timeout 60

console timeout 0

dhcpd address 192.168.93.230-192.168.93.240 inside

dhcpd dns ff.gg.hh.ii ff.gg.hh.ii

dhcpd lease 65536

dhcpd ping_timeout 750

dhcpd domain xxxxxx.biz

dhcpd auto_config outside

dhcpd enable inside

username xxxx password xxxxxxx encrypted privilege 15

cisco(config)# show cry ipsec sa

interface: outside

    Crypto map tag: outside_map, local addr. aa.bb.cc.dd

   local  ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)

   remote ident (addr/mask/prot/port): (10.0.1.205/255.255.255.255/0/0)

   current_peer: jj.kk.ll.mm:1265

   dynamic allocated peer ip: 10.0.1.205

     PERMIT, flags={transport_parent,}

    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0

    #pkts decaps: 38, #pkts decrypt: 38, #pkts verify 38

    #pkts compressed: 0, #pkts decompressed: 0

    #pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0

    #send errors 0, #recv errors 0

     local crypto endpt.: aa.bb.cc.dd, remote crypto endpt.: 97.93.95.133

     path mtu 1500, ipsec overhead 64, media mtu 1500

     current outbound spi: 3a898e67

     inbound esp sas:

      spi: 0xeeb64931(4004923697)

        transform: esp-3des esp-md5-hmac ,

        in use settings ={Tunnel UDP-Encaps, }

        slot: 0, conn id: 1, crypto map: outside_map

        sa timing: remaining key lifetime (k/sec): (4607993/28610)

        IV size: 8 bytes

        replay detection support: Y

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:

      spi: 0x3a898e67(982093415)

        transform: esp-3des esp-md5-hmac ,

        in use settings ={Tunnel UDP-Encaps, }

        slot: 0, conn id: 2, crypto map: outside_map

        sa timing: remaining key lifetime (k/sec): (4608000/28574)

        IV size: 8 bytes

        replay detection support: Y

     outbound ah sas:

     outbound pcp sas:

11 REPLIES
New Member

Can't Connect to Pix 501 VPN on Network

Hi Deryck,

Your NAT-Exemption is missing. Issue the following commands on the pix:

access-list nat-exempt permit ip any 10.0.1.0 255.255.255.0

nat (inside) 0 access-list nat-exempt

You can also replace any keyword with your specific internal networks, if you want.

This should fix it.

Shikhar Sharma

CCIE Security # 29741

Cisco TAC - VPN Team

New Member

Re: Can't Connect to Pix 501 VPN on Network

Hi Shikhar,

Thanks for the response. I added the two lines, but I still cannot ping on the local network.

When I run an ipconfig in Windows after connecting to the VPN, this is what I get:

Ethernet adapter Local Area Connection 3:

Connection-specific DNS Suffix: xxxx.biz

IP Address: 10.0.1.205

Subnet Mask: 255.0.0.0

Default Gateway:

Should I see a default gateway listed here? Is there something I need to do to make the Pix respond on a 10.0.1.x address?

Thanks,

Deryck

New Member

Re: Can't Connect to Pix 501 VPN on Network

The one thing that I keep seeing is that there are 0 packets being sent from my Windows XP machine when connected to the VPN. Here is a result of route PRINT from Windows while connected to the VPN:

===========================================================================

Interface List

0x1 ........................... MS TCP Loopback interface

0x2 ...00 80 45 22 b8 d3 ...... Realtek RTL8139/810x Family Fast Ethernet NIC - Packet Scheduler Miniport

0x10004 ...7a 79 05 1e 40 28 ...... Hamachi Network Interface - Deterministic Network Enhancer Miniport

0x10005 ...f8 d1 11 12 f1 86 ...... 802.11n USB Wireless LAN Card - Packet Scheduler Miniport

0x30006 ...00 05 9a 3c 78 00 ...... Cisco Systems VPN Adapter - Packet Scheduler Miniport

===========================================================================

===========================================================================

Active Routes:

Network Destination        Netmask          Gateway       Interface  Metric

          0.0.0.0          0.0.0.0       172.16.0.1     172.16.0.11      20

          5.0.0.0        255.0.0.0       5.30.64.40      5.30.64.40      20

       5.30.64.40  255.255.255.255        127.0.0.1       127.0.0.1      20

    5.255.255.255  255.255.255.255       5.30.64.40      5.30.64.40      20

         10.0.0.0        255.0.0.0       10.0.1.205      10.0.1.205      1

       10.0.1.205  255.255.255.255        127.0.0.1       127.0.0.1      25

   10.255.255.255  255.255.255.255       10.0.1.205      10.0.1.205      25

    24.43.158.146  255.255.255.255       172.16.0.1     172.16.0.11      1

        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1      1

       172.16.0.0      255.255.0.0      172.16.0.11     172.16.0.11      20

       172.16.0.1  255.255.255.255      172.16.0.11     172.16.0.11      1

      172.16.0.11  255.255.255.255        127.0.0.1       127.0.0.1      20

   172.16.255.255  255.255.255.255      172.16.0.11     172.16.0.11      20

        224.0.0.0        240.0.0.0       5.30.64.40      5.30.64.40      20

        224.0.0.0        240.0.0.0       10.0.1.205      10.0.1.205      25

        224.0.0.0        240.0.0.0      172.16.0.11     172.16.0.11      20

  255.255.255.255  255.255.255.255       5.30.64.40      5.30.64.40      1

  255.255.255.255  255.255.255.255       10.0.1.205               2      1

  255.255.255.255  255.255.255.255       10.0.1.205      10.0.1.205      1

  255.255.255.255  255.255.255.255      172.16.0.11     172.16.0.11      1

Default Gateway:        172.16.0.1

===========================================================================

Persistent Routes:

  None

New Member

Re: Can't Connect to Pix 501 VPN on Network

I just set the logging to high on all areas of the Cisco VPN client. Below is the resulting log. Everything looks ok from here:

Cisco Systems VPN Client Version 5.0.03.0530

Copyright (C) 1998-2007 Cisco Systems, Inc. All Rights Reserved.

Client Type(s): Windows, WinNT

Running on: 5.1.2600 Service Pack 3

29     09:57:02.887  09/03/12  Sev=Info/4    CM/0x63100002

Begin connection process

30     09:57:02.897  09/03/12  Sev=Info/4    CM/0x63100004

Establish secure connection

31     09:57:02.897  09/03/12  Sev=Info/4    CM/0x63100024

Attempt connection with server "a.b.c.d"

32     09:57:02.907  09/03/12  Sev=Info/6    IKE/0x6300003B

Attempting to establish a connection with a.b.c.d.

33     09:57:02.917  09/03/12  Sev=Info/4    IKE/0x63000013

SENDING >>> ISAKMP OAK AG (SA, KE, NON, ID, VID(Xauth), VID(dpd), VID(Frag), VID(Nat-T), VID(Unity)) to a.b.c.d

34     09:57:03.228  09/03/12  Sev=Info/4    IPSEC/0x63700008

IPSec driver successfully started

35     09:57:03.228  09/03/12  Sev=Info/4    IPSEC/0x63700014

Deleted all keys

36     09:57:03.228  09/03/12  Sev=Info/6    IPSEC/0x6370002C

Sent 47 packets, 0 were fragmented.

37     09:57:03.979  09/03/12  Sev=Info/5    IKE/0x6300002F

Received ISAKMP packet: peer = a.b.c.d

38     09:57:03.979  09/03/12  Sev=Info/4    IKE/0x63000014

RECEIVING <<< ISAKMP OAK AG (SA, VID(Xauth), VID(dpd), VID(Unity), VID(?), KE, ID, NON, VID(?), VID(Nat-T), NAT-D, NAT-D, HASH) from a.b.c.d

39     09:57:04.039  09/03/12  Sev=Info/6    GUI/0x63B00012

Authentication request attributes is 6h.

40     09:57:03.979  09/03/12  Sev=Info/5    IKE/0x63000001

Peer supports XAUTH

41     09:57:03.979  09/03/12  Sev=Info/5    IKE/0x63000001

Peer supports DPD

42     09:57:03.979  09/03/12  Sev=Info/5    IKE/0x63000001

Peer is a Cisco-Unity compliant peer

43     09:57:03.979  09/03/12  Sev=Info/5    IKE/0x63000082

Received IOS Vendor ID with unknown capabilities flag 0x000000A5

44     09:57:03.979  09/03/12  Sev=Info/5    IKE/0x63000001

Peer supports NAT-T

45     09:57:03.999  09/03/12  Sev=Info/6    IKE/0x63000001

IOS Vendor ID Contruction successful

46     09:57:03.999  09/03/12  Sev=Info/4    IKE/0x63000013

SENDING >>> ISAKMP OAK AG *(HASH, NOTIFY:STATUS_INITIAL_CONTACT, NAT-D, NAT-D, VID(?), VID(Unity)) to a.b.c.d

47     09:57:03.999  09/03/12  Sev=Info/6    IKE/0x63000055

Sent a keepalive on the IPSec SA

48     09:57:03.999  09/03/12  Sev=Info/4    IKE/0x63000083

IKE Port in use - Local Port =  0x0421, Remote Port = 0x1194

49     09:57:03.999  09/03/12  Sev=Info/5    IKE/0x63000072

Automatic NAT Detection Status:

   Remote end is NOT behind a NAT device

   This   end IS behind a NAT device

50     09:57:03.999  09/03/12  Sev=Info/4    CM/0x6310000E

Established Phase 1 SA.  1 Crypto Active IKE SA, 0 User Authenticated IKE SA in the system

51     09:57:04.029  09/03/12  Sev=Info/5    IKE/0x6300002F

Received ISAKMP packet: peer = a.b.c.d

52     09:57:04.029  09/03/12  Sev=Info/4    IKE/0x63000014

RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:STATUS_INITIAL_CONTACT) from a.b.c.d

53     09:57:04.029  09/03/12  Sev=Warning/2    IKE/0xA3000067

Received Unexpected InitialContact Notify (PLMgrNotify:886)

54     09:57:04.039  09/03/12  Sev=Info/5    IKE/0x6300002F

Received ISAKMP packet: peer = a.b.c.d

55     09:57:04.039  09/03/12  Sev=Info/4    IKE/0x63000014

RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:STATUS_RESP_LIFETIME) from a.b.c.d

56     09:57:04.039  09/03/12  Sev=Info/5    IKE/0x63000045

RESPONDER-LIFETIME notify has value of 86400 seconds

57     09:57:04.039  09/03/12  Sev=Info/5    IKE/0x63000047

This SA has already been alive for 2 seconds, setting expiry to 86398 seconds from now

58     09:57:04.039  09/03/12  Sev=Info/5    IKE/0x6300002F

Received ISAKMP packet: peer = a.b.c.d

59     09:57:04.039  09/03/12  Sev=Info/4    IKE/0x63000014

RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from a.b.c.d

60     09:57:04.039  09/03/12  Sev=Info/4    CM/0x63100015

Launch xAuth application

61     09:57:09.327  09/03/12  Sev=Info/4    CM/0x63100017

xAuth application returned

62     09:57:09.327  09/03/12  Sev=Info/4    IKE/0x63000013

SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to a.b.c.d

63     09:57:09.367  09/03/12  Sev=Info/5    IKE/0x6300002F

Received ISAKMP packet: peer = a.b.c.d

64     09:57:09.367  09/03/12  Sev=Info/4    IKE/0x63000014

RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from a.b.c.d

65     09:57:09.367  09/03/12  Sev=Info/4    IKE/0x63000013

SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to a.b.c.d

66     09:57:09.367  09/03/12  Sev=Info/4    CM/0x6310000E

Established Phase 1 SA.  1 Crypto Active IKE SA, 1 User Authenticated IKE SA in the system

67     09:57:09.387  09/03/12  Sev=Info/5    IKE/0x6300005E

Client sending a firewall request to concentrator

68     09:57:09.387  09/03/12  Sev=Info/5    IKE/0x6300005D

Firewall Policy: Product=Cisco Systems Integrated Client Firewall, Capability= (Centralized Protection Policy).

69     09:57:09.387  09/03/12  Sev=Info/4    IKE/0x63000013

SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to a.b.c.d

70     09:57:09.427  09/03/12  Sev=Info/5    IKE/0x6300002F

Received ISAKMP packet: peer = a.b.c.d

71     09:57:09.427  09/03/12  Sev=Info/4    IKE/0x63000014

RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from a.b.c.d

72     09:57:09.427  09/03/12  Sev=Info/5    IKE/0x63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_ADDRESS: , value = 10.0.1.205

73     09:57:09.427  09/03/12  Sev=Info/5    IKE/0x63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS(1): , value = 4.2.2.1

74     09:57:09.427  09/03/12  Sev=Info/5    IKE/0x6300000E

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_DEFDOMAIN: , value = xxxx.biz

75     09:57:09.427  09/03/12  Sev=Info/5    IKE/0x6300000D

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SPLIT_INCLUDE (# of split_nets), value = 0x00000001

76     09:57:09.427  09/03/12  Sev=Info/5    IKE/0x6300000F

SPLIT_NET #1

    subnet = 10.0.0.0

    mask = 255.0.0.0

    protocol = 0

    src port = 0

    dest port=0

77     09:57:09.427  09/03/12  Sev=Info/5    IKE/0x6300000D

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_PFS: , value = 0x00000000

78     09:57:09.427  09/03/12  Sev=Info/5    IKE/0x6300000D

MODE_CFG_REPLY: Attribute = Received and using NAT-T port number , value = 0x00001194

79     09:57:09.427  09/03/12  Sev=Info/4    CM/0x63100019

Mode Config data received

80     09:57:09.427  09/03/12  Sev=Info/4    IKE/0x63000056

Received a key request from Driver: Local IP = 10.0.1.205, GW IP = a.b.c.d, Remote IP = 0.0.0.0

81     09:57:09.437  09/03/12  Sev=Info/4    IKE/0x63000013

SENDING >>> ISAKMP OAK QM *(HASH, SA, NON, ID, ID) to a.b.c.d

82     09:57:09.477  09/03/12  Sev=Info/5    IKE/0x6300002F

Received ISAKMP packet: peer = a.b.c.d

83     09:57:09.477  09/03/12  Sev=Info/4    IKE/0x63000014

RECEIVING <<< ISAKMP OAK QM *(HASH, SA, NON, ID, ID, NOTIFY:STATUS_RESP_LIFETIME) from a.b.c.d

84     09:57:09.477  09/03/12  Sev=Info/5    IKE/0x63000045

RESPONDER-LIFETIME notify has value of 28800 seconds

85     09:57:09.477  09/03/12  Sev=Info/5    IKE/0x63000046

RESPONDER-LIFETIME notify has value of 4608000 kb

86     09:57:09.477  09/03/12  Sev=Info/4    IKE/0x63000013

SENDING >>> ISAKMP OAK QM *(HASH) to a.b.c.d

87     09:57:09.477  09/03/12  Sev=Info/5    IKE/0x63000059

Loading IPsec SA (MsgID=D70550E6 OUTBOUND SPI = 0xB335C6DA INBOUND SPI = 0xE99E1A59)

88     09:57:09.477  09/03/12  Sev=Info/5    IKE/0x63000025

Loaded OUTBOUND ESP SPI: 0xB335C6DA

89     09:57:09.477  09/03/12  Sev=Info/5    IKE/0x63000026

Loaded INBOUND ESP SPI: 0xE99E1A59

90     09:57:09.527  09/03/12  Sev=Info/5    CVPND/0x63400013

    Destination           Netmask           Gateway         Interface   Metric

        0.0.0.0           0.0.0.0        172.16.0.1       172.16.0.11       25

      127.0.0.0         255.0.0.0         127.0.0.1         127.0.0.1        1

     172.16.0.0       255.255.0.0       172.16.0.11       172.16.0.11       25

    172.16.0.11   255.255.255.255         127.0.0.1         127.0.0.1       25

172.16.255.255   255.255.255.255       172.16.0.11       172.16.0.11       25

      224.0.0.0         240.0.0.0       172.16.0.11       172.16.0.11       25

255.255.255.255   255.255.255.255       172.16.0.11           0.0.0.0        1

255.255.255.255   255.255.255.255       172.16.0.11       172.16.0.11        1

91     09:57:10.448  09/03/12  Sev=Info/4    CM/0x63100034

The Virtual Adapter was enabled:

    IP=10.0.1.205/255.0.0.0

    DNS=4.2.2.1,0.0.0.0

    WINS=0.0.0.0,0.0.0.0

    Domain=xxxx.biz

    Split DNS Names=

92     09:57:10.458  09/03/12  Sev=Info/5    CVPND/0x63400013

    Destination           Netmask           Gateway         Interface   Metric

        0.0.0.0           0.0.0.0        172.16.0.1       172.16.0.11       25

       10.0.0.0         255.0.0.0        10.0.1.205        10.0.1.205       25

     10.0.1.205   255.255.255.255         127.0.0.1         127.0.0.1       25

10.255.255.255   255.255.255.255        10.0.1.205        10.0.1.205       25

      127.0.0.0         255.0.0.0         127.0.0.1         127.0.0.1        1

     172.16.0.0       255.255.0.0       172.16.0.11       172.16.0.11       25

    172.16.0.11   255.255.255.255         127.0.0.1         127.0.0.1       25

172.16.255.255   255.255.255.255       172.16.0.11       172.16.0.11       25

      224.0.0.0         240.0.0.0        10.0.1.205        10.0.1.205       25

      224.0.0.0         240.0.0.0       172.16.0.11       172.16.0.11       25

255.255.255.255   255.255.255.255        10.0.1.205           0.0.0.0        1

255.255.255.255   255.255.255.255        10.0.1.205        10.0.1.205        1

255.255.255.255   255.255.255.255       172.16.0.11       172.16.0.11        1

93     09:57:10.458  09/03/12  Sev=Info/4    CM/0x63100038

Successfully saved route changes to file.

94     09:57:10.458  09/03/12  Sev=Info/5    CVPND/0x63400013

    Destination           Netmask           Gateway         Interface   Metric

        0.0.0.0           0.0.0.0        172.16.0.1       172.16.0.11       25

       10.0.0.0         255.0.0.0        10.0.1.205        10.0.1.205        1

     10.0.1.205   255.255.255.255         127.0.0.1         127.0.0.1       25

10.255.255.255   255.255.255.255        10.0.1.205        10.0.1.205       25

  a.b.c.d   255.255.255.255        172.16.0.1       172.16.0.11        1

      127.0.0.0         255.0.0.0         127.0.0.1         127.0.0.1        1

     172.16.0.0       255.255.0.0       172.16.0.11       172.16.0.11       25

     172.16.0.1   255.255.255.255       172.16.0.11       172.16.0.11        1

    172.16.0.11   255.255.255.255         127.0.0.1         127.0.0.1       25

172.16.255.255   255.255.255.255       172.16.0.11       172.16.0.11       25

      224.0.0.0         240.0.0.0        10.0.1.205        10.0.1.205       25

      224.0.0.0         240.0.0.0       172.16.0.11       172.16.0.11       25

255.255.255.255   255.255.255.255        10.0.1.205           0.0.0.0        1

255.255.255.255   255.255.255.255        10.0.1.205        10.0.1.205        1

255.255.255.255   255.255.255.255       172.16.0.11       172.16.0.11        1

95     09:57:10.458  09/03/12  Sev=Info/6    CM/0x63100036

The routing table was updated for the Virtual Adapter

96     09:57:10.508  09/03/12  Sev=Info/4    CM/0x6310001A

One secure connection established

97     09:57:10.618  09/03/12  Sev=Info/4    CM/0x6310003B

Address watch added for 172.16.0.11.  Current hostname: toughone, Current address(es): 10.0.1.205, 172.16.0.11.

98     09:57:10.638  09/03/12  Sev=Info/4    CM/0x6310003B

Address watch added for 10.0.1.205.  Current hostname: toughone, Current address(es): 10.0.1.205, 172.16.0.11.

99     09:57:10.638  09/03/12  Sev=Info/4    IPSEC/0x63700014

Deleted all keys

100    09:57:10.638  09/03/12  Sev=Info/4    IPSEC/0x63700010

Created a new key structure

101    09:57:10.638  09/03/12  Sev=Info/4    IPSEC/0x6370000F

Added key with SPI=0xdac635b3 into key list

102    09:57:10.638  09/03/12  Sev=Info/4    IPSEC/0x63700010

Created a new key structure

103    09:57:10.638  09/03/12  Sev=Info/4    IPSEC/0x6370000F

Added key with SPI=0x591a9ee9 into key list

104    09:57:10.638  09/03/12  Sev=Info/4    IPSEC/0x6370002F

Assigned VA private interface addr 10.0.1.205

105    09:57:10.638  09/03/12  Sev=Info/4    IPSEC/0x63700037

Configure public interface: 172.16.0.11. SG: a.b.c.d

106    09:57:10.638  09/03/12  Sev=Info/6    CM/0x63100046

Set tunnel established flag in registry to 1.

107    09:57:19.741  09/03/12  Sev=Info/4    IKE/0x63000013

SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to a.b.c.d

108    09:57:19.741  09/03/12  Sev=Info/6    IKE/0x6300003D

Sending DPD request to a.b.c.d, our seq# = 3951445672

109    09:57:19.772  09/03/12  Sev=Info/5    IKE/0x6300002F

Received ISAKMP packet: peer = a.b.c.d

110    09:57:19.772  09/03/12  Sev=Info/4    IKE/0x63000014

RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:DPD_ACK) from a.b.c.d

111    09:57:19.772  09/03/12  Sev=Info/5    IKE/0x63000040

Received DPD ACK from a.b.c.d, seq# received = 3951445672, seq# expected = 3951445672

112    09:57:30.257  09/03/12  Sev=Info/4    IKE/0x63000013

SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to a.b.c.d

113    09:57:30.257  09/03/12  Sev=Info/6    IKE/0x6300003D

Sending DPD request to a.b.c.d, our seq# = 3951445673

114    09:57:30.297  09/03/12  Sev=Info/5    IKE/0x6300002F

Received ISAKMP packet: peer = a.b.c.d

115    09:57:30.297  09/03/12  Sev=Info/4    IKE/0x63000014

RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:DPD_ACK) from a.b.c.d

116    09:57:30.297  09/03/12  Sev=Info/5    IKE/0x63000040

Received DPD ACK from a.b.c.d, seq# received = 3951445673, seq# expected = 3951445673

117    09:57:40.772  09/03/12  Sev=Info/4    IKE/0x63000013

SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to a.b.c.d

118    09:57:40.772  09/03/12  Sev=Info/6    IKE/0x6300003D

Sending DPD request to a.b.c.d, our seq# = 3951445674

119    09:57:40.802  09/03/12  Sev=Info/5    IKE/0x6300002F

Received ISAKMP packet: peer = a.b.c.d

120    09:57:40.802  09/03/12  Sev=Info/4    IKE/0x63000014

RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:DPD_ACK) from a.b.c.d

121    09:57:40.802  09/03/12  Sev=Info/5    IKE/0x63000040

Received DPD ACK from a.b.c.d, seq# received = 3951445674, seq# expected = 3951445674

122    09:57:54.291  09/03/12  Sev=Info/6    IKE/0x63000055

Sent a keepalive on the IPSec SA

123    09:58:04.306  09/03/12  Sev=Info/6    IKE/0x63000055

Sent a keepalive on the IPSec SA

124    09:58:14.320  09/03/12  Sev=Info/6    IKE/0x63000055

Sent a keepalive on the IPSec SA

125    09:58:24.334  09/03/12  Sev=Info/6    IKE/0x63000055

Sent a keepalive on the IPSec SA

126    09:58:34.349  09/03/12  Sev=Info/6    IKE/0x63000055

Sent a keepalive on the IPSec SA

127    09:58:41.359  09/03/12  Sev=Info/4    IKE/0x63000013

SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to a.b.c.d

128    09:58:41.359  09/03/12  Sev=Info/6    IKE/0x6300003D

Sending DPD request to a.b.c.d, our seq# = 3951445675

129    09:58:41.389  09/03/12  Sev=Info/5    IKE/0x6300002F

Received ISAKMP packet: peer = a.b.c.d

130    09:58:41.389  09/03/12  Sev=Info/4    IKE/0x63000014

RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:DPD_ACK) from a.b.c.d

131    09:58:41.389  09/03/12  Sev=Info/5    IKE/0x63000040

Received DPD ACK from a.b.c.d, seq# received = 3951445675, seq# expected = 3951445675

132    09:58:54.378  09/03/12  Sev=Info/6    IKE/0x63000055

Sent a keepalive on the IPSec SA

133    09:59:04.392  09/03/12  Sev=Info/6    IKE/0x63000055

Sent a keepalive on the IPSec SA

134    09:59:14.406  09/03/12  Sev=Info/6    IKE/0x63000055

Sent a keepalive on the IPSec SA

135    09:59:24.421  09/03/12  Sev=Info/6    IKE/0x63000055

Sent a keepalive on the IPSec SA

136    09:59:34.435  09/03/12  Sev=Info/6    IKE/0x63000055

Sent a keepalive on the IPSec SA

137    09:59:41.946  09/03/12  Sev=Info/4    IKE/0x63000013

SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to a.b.c.d

138    09:59:41.946  09/03/12  Sev=Info/6    IKE/0x6300003D

Sending DPD request to a.b.c.d, our seq# = 3951445676

139    09:59:41.976  09/03/12  Sev=Info/5    IKE/0x6300002F

Received ISAKMP packet: peer = a.b.c.d

140    09:59:41.976  09/03/12  Sev=Info/4    IKE/0x63000014

RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:DPD_ACK) from a.b.c.d

141    09:59:41.976  09/03/12  Sev=Info/5    IKE/0x63000040

Received DPD ACK from a.b.c.d, seq# received = 3951445676, seq# expected = 3951445676

142    09:59:54.464  09/03/12  Sev=Info/6    IKE/0x63000055

Sent a keepalive on the IPSec SA

New Member

Can't Connect to Pix 501 VPN on Network

Hi Deryck,

Sorry for  responding late... was in office actually...hmmm..the issue over here is  that i find it hard to beleive that your machine is not encrypting the  packets. The reason why is say that is because in the output of " show  crypto ipsec sa " we do see decrypted packets but not encrypted packets.  The only way that we could see the decrytped packets over here is  because PIX is actually receving the packets from your VPN client.

Can you please open up your vpn client, go to statistics and send me a screenshot of statistics and route details ?

Shikhar Sharma

CCIE Security # 29741

Cisco TAC - VPN Team

New Member

Can't Connect to Pix 501 VPN on Network

Hi Shikhar,

It looks like you may be right about the packets not being encrypted. It looks like it's coming from the Pix???

Below are the screenshots.

Thanks,

Deryck

New Member

Can't Connect to Pix 501 VPN on Network

Apply captures on the inside interface of the pix to see if you are receiving any replies from the internal network or not. Here are the commands that you need to apply:

access-list capture permit ip host (ip address assigned to vpn client from pool) host (ip address on your internal network which you are pinging from vpn client)

access-list capture permit ip host (ip address on your internal network which you are pinging from vpn client) host (ip address assigned to vpn client from pool)

capture capin access-list capture interface inside

Now to check the captures issue the command:

show capture capin

Please run around 10 pings to the internal ip address and send me the output.

Also issue the command:

management inside

After issuing this command try to ping the inside interface of your pix and see if you can do that from the vpn client.

New Member

Can't Connect to Pix 501 VPN on Network

Ok. I ran the command and I got:

0 packet captured

0 packet shown

For the record, I am testing with a Windows 7 client and a Windows XP client at the same location. On Tuesday, I will give this to another person to test from another location in case my firewall is blocking something here.

Thanks,

Deryck

New Member

Can't Connect to Pix 501 VPN on Network

Hi Deryck,

This is the main problem here. The packets which are coming from the VPN client are getting decrypted on the PIX but never leave the inside interface. This means that PIX is dropping the packets or sending it to some other tunnel. I found another problem in your config. Can you tell me why do you have this statement:

crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20

Please try removing it and then try the connection.

Shikhar Sharma

CCIE Security # 29741

Cisco TAC - VPN Team

New Member

Can't Connect to Pix 501 VPN on Network

Hi Shikhar,

I just removed that line but there is no difference in the VPN. I checked the statistics and pinging hosts on the LAN, but no change.

Thanks,

Deryck

New Member

Can't Connect to Pix 501 VPN on Network

Hi Deryck,

Do you have a support contract with cisco ? If yes i would recommend opening a TAC case...we can then actually check why exactly packets are not coming on the inside interface.

Also try reloading your pix to see if it makes any difference

Shikhar Sharma

CCIE Security # 29741

Cisco TAC - VPN Team

1405
Views
0
Helpful
11
Replies