I have been tasked with setting up a VPN tunnel with a business partner so they can access our systems and vice versa. The range of IPs reachable has been limited on each side to a portion of a subnet. The problem is my firewall is a Cisco PIX, but their firewall is a Zyxel Zywall and is managed by a third party. You can only imagine the blame-shifting! We can get the VPN tunnels up and running, both phase I and phase II, but no data passes between them.
I had to (reluctantly) give the third party company access to my PIX and they have confirmed the configuration. They are now blaming it on an internal router on my network, which I have confirmed not to be the case (with a protocol analyser).
Thing is I was looking at my PIX again and I'm starting to think it is a problem with my side. I can see packets have been decrypted, but none encrypted which would suggest to me that my PIX isn't encapsulating my traffic. Can anyone give me any troubleshooting tips?
My output for the said tunnel for show crypto ipsec sa follows:
Crypto map tag: mydynamic, local addr: x.x.x.x (to protect the innocent)
local ident (addr/mask/prot/port): (10.1.2.48/255.255.255.248
/0/0)
remote ident (addr/mask/prot/port): (192.168.20.56/255.255.255
.248/0/0)
current_peer: x.x.x.x (to protect the innocent)
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 36, #pkts decrypt: 36, #pkts verify: 36
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: x.x.x.x (to protect the innocent), remote crypto endpt.: x.x.x.x (to protect the innocent)
path mtu 1500, ipsec overhead 60, media mtu 1500
current outbound spi: C6A9F88C
inbound esp sas:
spi: 0xDFD79CB5 (3755449525)
transform: esp-des esp-md5-hmac
in use settings ={L2L, Tunnel, }
slot: 0, conn_id: 3697, crypto-map: mydynamic
sa timing: remaining key lifetime (sec): 28601
IV size: 8 bytes
replay detection support: Y
outbound esp sas:
spi: 0xC6A9F88C (3333027980)
transform: esp-des esp-md5-hmac
in use settings ={L2L, Tunnel, }
slot: 0, conn_id: 3697, crypto-map: mydynamic
sa timing: remaining key lifetime (sec): 28601
IV size: 8 bytes
replay detection support: Y
Output for show crypto isakmp sa:
4 IKE Peer: x.x.x.x
Type : L2L Role : responder
Rekey : no State : MM_ACTIVE
Encrypt : aes Hash : SHA
Auth : preshared Lifetime: 86400
Thanks greatly for your help, in advance!
