[x]
Posted via EE Mobile

Search, ask, and monitor your questions on the go with EE Mobile. Visit Experts Exchange from your mobile device and never be out of touch again.
Question
[x]
Attachment Details
[x]
The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

  • The Grade of the Solution
  • The Zone Rank of the Expert Providing the Solution
  • The Number of Author and Expert Comments
  • The Number of Experts Contributing
  • The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!
6.4

Site-to-Site VPN Tunel between PIX-to-PIX and router

Asked by imtiazsh in Network Software Firewalls, Cisco PIX Firewall, Enterprise Firewalls

Tags: 10, authentication, crypto, pix, site

hi,

I have Site to site VPN tunnel between my Headoffice and Branch office-1, both the ends, we are using PIX506E firewalls.

we have another Branch office-2, here we are using cisco 1721 router, I want to establish a VPN tunnel between My PIX (headoffice) and router(branch office-2)
I configured, but there is no active ipsec tunnel between Headoffice-PIX and router.
Any suggestions would be highly appreciated.
Kindly check the following below Networklayout and : ( Headoffice-PIX ) & router config's.



               ( headoffice )                                                                                         ( Branch office-1 )
                                                      Site-to-Site Tunnel working perfectly.
 (eth1: 192.168.0.1)  PIX1 =====================================  PIX2 (eth1: 192.168.1.1)
                                   \\
                                     \\=====================\\
                                                                                         \\
                                                                                           \\
                                                                                Cisco1712- ( Branch office-2 )
                                                                                     (eth1: 192.168.1.1)
                                                           

( Headoffice - PIX Site-to-Site config.)
-----------------------------------------------


access-list 101 permit ip 192.168.0.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list 102 permit ip 192.168.0.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list nonat permit ip 192.168.0.0 255.255.255.0 192.168.1.0 255.255.255.0

nat (inside) 0 access-list 102
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set cisco2 esp-des esp-md5-hmac
crypto map example_map 10 ipsec-isakmp
crypto map example_map 10 match address 101
crypto map example_map 10 set peer 225.45.156.122
crypto map example_map 10 set transform-set cisco2
crypto map example_map 20 ipsec-isakmp
crypto map example_map 20 match address nonat
crypto map example_map 20 set peer 86.34.144.113
crypto map example_map 20 set transform-set cisco2
crypto map example_map interface outside
isakmp enable outside
isakmp key pixcisco address 225.45.156.122 netmask 255.255.255.255
isakmp key pixcisco address 86.34.144.113 netmask 255.255.255.255
isakmp identity address
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
telnet 192.168.0.0 255.255.255.0 inside


--------------------------------------------------

 # sh crypto ipsec sa

interface: outside
    Crypto map tag: example_map, local addr. 64.164.38.117

   local  ident (addr/mask/prot/port): (192.168.0.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
   current_peer: 225.45.156.122:500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 391017, #pkts encrypt: 391017, #pkts digest 391017
    #pkts decaps: 306703, #pkts decrypt: 306703, #pkts verify 306703
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0
    #send errors 1, #recv errors 10

     local crypto endpt.: 64.164.38.117, remote crypto endpt.: 225.45.156.122
     path mtu 1500, ipsec overhead 56, media mtu 1500
     current outbound spi: 33ce5d07

     inbound esp sas:
      spi: 0x82c1641(137107009)
        transform: esp-des esp-md5-hmac ,
        in use settings ={Tunnel, }
        slot: 0, conn id: 1, crypto map: example_map
        sa timing: remaining key lifetime (k/sec): (4431430/891)
        IV size: 8 bytes
        replay detection support: Y
     inbound ah sas:
     inbound pcp sas:
     outbound esp sas:
      spi: 0x33ce5d07(869162247)
        transform: esp-des esp-md5-hmac ,
        in use settings ={Tunnel, }
        slot: 0, conn id: 2, crypto map: example_map
        sa timing: remaining key lifetime (k/sec): (4248766/890)
        IV size: 8 bytes
        replay detection support: Y
     outbound ah sas:
     outbound pcp sas:


     local crypto endpt.: 64.164.38.117, remote crypto endpt.: 86.34.144.113
     path mtu 1500, ipsec overhead 0, media mtu 1500
     current outbound spi: 0

     inbound esp sas:

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:

     outbound ah sas:

     outbound pcp sas:

HDpix#   sh crypto isakmp sa
Total     : 1
Embryonic : 0
        dst                      src                state      pending     created
   225.45.156.122   64.164.38.117    QM_IDLE         0           1
HDpix#

-----------------------------------------------------------------------------------------
Router config : cisco 1721:
----------

dashnt#sh run
Building configuration...

Current configuration : 1647 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname dashnt#
!
boot-start-marker
boot-end-marker
!
enable secret 5 xxxxxxxxxxxxxxxxx
!
no aaa new-model
!
resource policy
!
ip cef
!
ip name-server 224.xxx.xxx.34
ip name-server 224.xxx.xxx.35
!
crypto isakmp policy 10
 encr 3des
 authentication pre-share
crypto isakmp key pixcisco address 64.164.38.117
!
crypto ipsec transform-set ESP-3DES-SHA esp-des esp-md5-hmac
!
crypto map outside_map 20 ipsec-isakmp
 set peer 64.164.38.117
 set transform-set ESP-3DES-SHA
 match address encrypt-imti
!
interface FastEthernet0
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 speed auto
 crypto map outside_map
!
interface Serial0
 no ip address
 encapsulation frame-relay IETF
 no fair-queue
 frame-relay lmi-type ansi
!
interface Serial0.1 point-to-point
 ip address 112.xxx.xxx.130 255.255.255.252
 ip nat outside
 ip virtual-reassembly
 frame-relay interface-dlci 20
!
ip route 0.0.0.0 0.0.0.0 112.xxx.xxx.129
!
no ip http server
no ip http secure-server
ip nat pool dash 86.34.144.113 86.34.144.118 netmask 255.255.255.248
ip nat source static 192.168.1.1 86.34.144.114
ip nat inside source list 1 pool dash overload
ip nat inside source static 192.168.1.1 86.34.144.113
!
ip access-list extended encrypt-imti
 permit ip 192.168.1.0 0.0.0.255 192.168.0.0 0.0.0.255
!
access-list 1 permit 192.168.1.0 0.0.0.255
!
control-plane
!!
line con 0
line aux 0
line vty 0 4
 password dkXXXXX&(*
 login
!
end

dashnt#

dashnt#sh crypto ipsec sa

interface: FastEthernet0
    Crypto map tag: outside_map, local addr 192.168.1.1

   protected vrf: (none)
   local  ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (192.168.0.0/255.255.255.0/0/0)
   current_peer 64.164.38.117 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

     local crypto endpt.: 192.168.1.1, remote crypto endpt.: 64.164.38.117
     path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0
     current outbound spi: 0x0(0)

     inbound esp sas:

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:

     outbound ah sas:

     outbound pcp sas:
--------------------------------------------------------------
dashnt# sh crypto isakmp sa
dst             src             state          conn-id slot status

dashnt#
'
'

Any suggestions would be highly appreciated.

Thanks
Mike..















































[+][-]07/02/06 08:50 AM, ID: 17026986Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]07/02/06 11:01 PM, ID: 17029114Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]07/03/06 08:04 AM, ID: 17031360Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]07/04/06 09:15 AM, ID: 17037682Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]07/04/06 09:18 AM, ID: 17037694Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]07/04/06 09:42 AM, ID: 17037818Accepted Solution

View this solution now by starting your 30-day free trial. Setting up your free trial is quick, easy, and secure. We will return you to this solution, unlocked, when you're done.

About this solution

Zones: Network Software Firewalls, Cisco PIX Firewall, Enterprise Firewalls
Tags: 10, authentication, crypto, pix, site
Sign Up Now!
Solution Provided By: lrmoore
Participating Experts: 1
Solution Grade: A
 
[+][-]07/04/06 09:43 AM, ID: 17037821Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]07/04/06 10:20 AM, ID: 17037998Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]07/04/06 10:32 AM, ID: 17038051Administrative Comment

Experts Exchange has a courteous staff of administrators who help members get the most out of the website by means of administrative comments like this one.

Start your 30-day free trial to view this Administrative Comment or ask the Experts your question.

 
[+][-]07/08/06 05:31 AM, ID: 17064683Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]07/08/06 09:35 AM, ID: 17065313Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]07/08/06 11:07 AM, ID: 17065548Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]07/08/06 12:05 PM, ID: 17065667Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]07/08/06 01:28 PM, ID: 17065823Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]07/08/06 09:42 PM, ID: 17066980Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]07/08/06 10:04 PM, ID: 17067018Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]07/09/06 11:38 AM, ID: 17068931Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]07/09/06 11:05 PM, ID: 17070762Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]07/10/06 01:07 AM, ID: 17071131Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]07/11/06 07:35 AM, ID: 17081896Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]07/11/06 07:59 AM, ID: 17082132Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
 
Loading Advertisement...
20091021-EE-VQP-81