Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

pix site to site and vpn client simultaneously dropped

i ve got a pix 501 and once i get one vpn site to site working, immediately after 5 minutes all vpn clients are dropped. And my copnfig looks good...

sysopt connection permit-ipsec

crypto ipsec transform-set DeCloudOfficeLandCrypt esp-3des esp-sha-hmac

crypto ipsec transform-set UKCloudDataWareHouseCrypt esp-3des esp-sha-hmac

crypto ipsec transform-set RasSet esp-3des esp-md5-hmac

crypto dynamic-map outside_dyn_map 20 set transform-set RasSet

crypto map VPNList 10 ipsec-isakmp

crypto map VPNList 10 match address DeCloudOfficeLandVPN

crypto map VPNList 10 set pfs group2

crypto map VPNList 10 set peer y.y.y.y

crypto map VPNList 10 set transform-set DeCloudOfficeLandCrypt

crypto map VPNList 10 set security-association lifetime seconds 3600 kilobytes 4608000

crypto map VPNList 20 ipsec-isakmp

crypto map VPNList 20 match address DataWarehouseVPN

crypto map VPNList 20 set pfs group2

crypto map VPNList 20 set peer x.x.x.x

crypto map VPNList 20 set transform-set UKCloudDataWareHouseCrypt

crypto map VPNList 20 set security-association lifetime seconds 3600 kilobytes 4608000

crypto map VPNList 6000 ipsec-isakmp dynamic outside_dyn_map

crypto map VPNList client authentication vpnauth

crypto map VPNList interface outside

isakmp enable outside

isakmp key dasdsdasdas address <ip-address> netmask 255.255.255.255

isakmp key dasdsadsaddf address <ip-address2> netmask 255.255.255.255

isakmp policy 1 authentication pre-share

isakmp policy 1 encryption aes-256

isakmp policy 1 hash sha

isakmp policy 1 group 2

isakmp policy 1 lifetime 86400

isakmp policy 20 authentication pre-share

isakmp policy 20 encryption 3des

isakmp policy 20 hash sha

isakmp policy 20 group 2

isakmp policy 20 lifetime 86400

isakmp policy 30 authentication pre-share

isakmp policy 30 encryption 3des

isakmp policy 30 hash sha

isakmp policy 30 group 2

isakmp policy 30 lifetime 28800

isakmp policy 40 authentication pre-share

isakmp policy 40 encryption 3des

isakmp policy 40 hash md5

isakmp policy 40 group 2

isakmp policy 40 lifetime 86400

isakmp policy 50 authentication pre-share

isakmp policy 50 encryption des

isakmp policy 50 hash sha

isakmp policy 50 group 2

isakmp policy 50 lifetime 28800

isakmp policy 60 authentication pre-share

isakmp policy 60 encryption des

isakmp policy 60 hash md5

isakmp policy 60 group 2

isakmp policy 60 lifetime 28800

vpngroup UKVPNUSER address-pool UKDialInIP2

vpngroup UKVPNUSER dns-server 192.168.20.3

vpngroup UKVPNUSER wins-server 192.168.20.3

vpngroup UKVPNUSER default-domain corp-thecloud.net

vpngroup UKVPNUSER split-tunnel UKUserAccessVPN2

vpngroup UKVPNUSER idle-time 1800

vpngroup UKVPNUSER password dsadsad

access-list InsideNetNAT permit ip object-group UKCloudOfficePrivate any

access-list UKVPNUSER_splitTunnelAcl permit ip 192.168.20.0 255.255.255.0 any

access-list outside_cryptomap_dyn_20 permit ip any 10.5.248.0 255.255.255.128

access-list OutsideACL remark ## Specifies what to allow in from the Internet

access-list OutsideACL permit object-group TunnelProtocols any object-group UKCloudOfficePublicaccess-list InsideNetRouting permit ip 192.168.20.0 255.255.255.0 10.5.248.0 255.255.255.128

access-list DeCloudOfficeLandVPN permit ip object-group UKCloudOfficePrivate object-group DeCloudOfficeLandPrivate

access-group OutsideACL in interface outside

global (outside) 1 interface

nat (inside) 0 access-list InsideNetRouting

nat (inside) 1 access-list InsideNetNAT 0 0

access-group OutsideACL in interface outside

and if i try to get connected again i get

ISAKMP (0): Total payload length: 26

return status is IKMP_NO_ERROR

crypto_isakmp_process_block:src:public_ip, dest:outside_ip spt:500 dpt:500

VPN Peer:ISAKMP: Peer Info for public_ip/500 not found - peers:1

ISAKMP: larval sa found

ISAKMP (0): retransmitting phase 1 (2)...

I really don t unsderstand why i get this issue i tried to change the crypto map priority from 6000 to 1 but still doesn't work. thanks for your help

1 REPLY
Bronze

Re: pix site to site and vpn client simultaneously dropped

124
Views
0
Helpful
1
Replies
CreatePlease to create content