December 4, 2008 09:44pm pst

09.08.2006 at 01:23PM PDT, ID: 21983057

	[x] Attachment Details

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

9.4

Pix to Pix to Pix Mesh

Asked by albinoanteater in Virtual Private Networking (VPN)

Tags: clverify, dpbureau, nat0_acl

Hello all,
I'm attempting to setup a VPN mesh between 2 PIX 501's and a PIX 506e.
Here's a quick overview of the environment.
There are 3 Devices
Largo - PIX 501
Lindon - PIX 506e
Orem - PIX 501
Each device is also the gateway for it's location.
Each will also need to (if possible) be able to allow connections for the Cisco VPN client.
The Largo PIX (and possibly all of them) need to be able to authenticate to an Windows AD Server
I currently only have access to the Largo and Lindon devices I will gain access to the Orem device on Monday

I've been trying this for the past 3 days and I've got (or had at least, I've likely broken it by now) the RADIUS functionality working on the Largo PIX .
But the VPN tunnel between the Largo and Lindon device is eluding me.
I've followed this document from cisco http://www.cisco.com/warp/public/110/pixmeshed.html

I've turned on 'debug crypo ipsec sa' and 'debug crypto isakmp' and debug crypto engine' on both devices but I'm not recieving any extra information.
here is the output for a 'show ipsec sa' and a 'show isakmp sa' for both devices.
Largo(config)# show ipsec sa
Largo(config)# show isakmp sa
Total : 0
Embryonic : 0
dst src state pending created

lindon# show ipsec sa
lindon# show isakmp sa
Total : 0
Embryonic : 0
dst src state pending created
lindon#

Here are the configs. (Be kind they have a lot in them I need to clean up still :)
: Saved
: Written by enable_15 at 15:03:45.761 EDT Fri Sep 8 2006
PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password <snipped> encrypted
passwd <snipped> encrypted
hostname Largo
domain-name dpbureau.net
clock timezone EST -5
clock summer-time EDT recurring
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 192.168.40.2 dpbureau-mail
name 192.168.40.20 dpbureau-ftp
name 10.0.0.0 Lindon
name 10.10.0.0 Orem
name 192.168.40.0 Largo
access-list inside_outbound_nat0_acl permit ip any 192.168.40.32 255.255.255.224
access-list outside_acl permit tcp host dpbureau-mail any eq smtp
access-list outside_acl permit ip interface inside Orem 255.255.0.0
access-list radius_vpn_acl permit ip 192.168.41.0 255.255.255.0 Largo 255.255.255.0
access-list radius_vpn_acl permit ip Largo 255.255.255.0 192.168.41.0 255.255.255.0
access-list nat0_acl permit ip Largo 255.255.255.0 Lindon 255.255.0.0
access-list nat0_acl permit ip Largo 255.255.255.0 Orem 255.255.0.0
access-list inside_acl permit ip any any
access-list largo_to_lindon permit ip Largo 255.255.255.0 Lindon 255.255.0.0
access-list largo_to_orem permit ip Largo 255.255.255.0 Orem 255.255.0.0
pager lines 24
logging on
logging timestamp
logging trap informational
logging facility 23
logging device-id hostname
logging host inside 192.168.40.126
icmp permit any outside
icmp permit any inside
mtu outside 1500
mtu inside 1500
ip address outside <snipped>.143.164 255.0.0.0
ip address inside 192.168.40.4 255.255.255.0
ip verify reverse-path interface outside
ip audit info action alarm
ip audit attack action alarm
ip local pool VPN-pool 192.168.40.40-192.168.40.60
ip local pool radius_pool 192.168.41.200-192.168.41.254
pdm location 0.0.0.0 255.0.0.0 outside
pdm location 192.168.40.32 255.255.255.224 outside
pdm location Orem 255.255.0.0 outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list nat0_acl
nat (inside) 1 access-list inside_acl 0 0
static (inside,outside) <snipped>.143.163 dpbureau-mail netmask 255.255.255.255 0 0
static (inside,outside) <snipped>.143.173 dpbureau-ftp netmask 255.255.255.255 0 0
access-group outside_acl in interface outside
access-group inside_acl in interface inside
rip inside default version 1
route outside 0.0.0.0 0.0.0.0 <snipped>.143.161 1
timeout xlate 1:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 1:00:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
aaa-server radius_ad_auth protocol radius
aaa-server radius_ad_auth max-failed-attempts 3
aaa-server radius_ad_auth deadtime 10
aaa-server radius_ad_auth (inside) host 192.168.40.12 <snipped> timeout 5
aaa authentication ssh console LOCAL
http server enable
http Largo 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
sysopt connection permit-pptp
crypto ipsec transform-set radius_set esp-des esp-md5-hmac
crypto ipsec transform-set strong_enc esp-des esp-md5-hmac
crypto dynamic-map radius_vpn_dynamic_map 10 match address radius_vpn_acl
crypto dynamic-map radius_vpn_dynamic_map 10 set transform-set radius_set
crypto map radius_map 10 ipsec-isakmp dynamic radius_vpn_dynamic_map
crypto map radius_map client authentication radius_ad_auth
crypto map vpn_tunnel_map 30 ipsec-isakmp
crypto map vpn_tunnel_map 30 match address largo_to_orem
crypto map vpn_tunnel_map 30 set peer <snipped>.134.99
crypto map vpn_tunnel_map 30 set transform-set strong_enc
crypto map vpn_tunnel_map 50 ipsec-isakmp
crypto map vpn_tunnel_map 50 match address largo_to_lindon
crypto map vpn_tunnel_map 50 set peer <snipped>.193.45
crypto map vpn_tunnel_map 50 set transform-set strong_enc
isakmp enable outside
isakmp key <snipped> address <snipped>.134.99 netmask 255.255.255.255 no-xauth no-config-mode
isakmp key <snipped> address <snipped>.193.45 netmask 255.255.255.255 no-xauth no-config-mode
isakmp identity address
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
vpngroup dpbureau address-pool radius_pool
vpngroup dpbureau dns-server 192.168.40.12
vpngroup dpbureau default-domain tampahq.dpbureau.com
vpngroup dpbureau split-tunnel radius_vpn_acl
vpngroup dpbureau idle-time 1800
vpngroup dpbureau password <snipped>
telnet timeout 60
ssh Largo 255.255.255.0 inside
ssh timeout 60
management-access inside
console timeout 0
vpdn group PPTP-VPDN-GROUP accept dialin pptp
vpdn group PPTP-VPDN-GROUP ppp authentication mschap
vpdn group PPTP-VPDN-GROUP ppp encryption mppe 128 required
vpdn group PPTP-VPDN-GROUP client configuration address local VPN-pool
vpdn group PPTP-VPDN-GROUP pptp echo 60
vpdn group PPTP-VPDN-GROUP client authentication local
vpdn username fmosuch password <snipped>
vpdn username VPN1 password <snipped>
vpdn enable outside
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
username mirwin password <snipped> encrypted privilege 15
username fmosuch password <snipped> encrypted privilege 15
terminal width 80
banner login Largo Cisco Pix 501 Firewall
Cryptochecksum:<snipped>
: end
===============================================
: Saved
: Written by enable_15 at 14:03:38.942 MDT Fri Sep 8 2006
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password <snipped> encrypted
passwd <snipped> encrypted
hostname lindon
domain-name clverify.com
clock timezone MST -7
clock summer-time MDT recurring
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 192.168.40.0 Largo
name 10.10.0.0 Orem
name 10.0.0.0 Lindon
access-list inside_acl permit ip any any
access-list nat0_acl permit ip Lindon 255.255.0.0 Largo 255.255.255.0
access-list nat0_acl permit ip Lindon 255.255.0.0 Orem 255.255.0.0
access-list lindon_to_orem permit ip Lindon 255.255.0.0 Orem 255.255.0.0
access-list lindon_to_largo permit ip Lindon 255.255.0.0 Largo 255.255.255.0
pager lines 24
logging on
logging timestamp
logging trap informational
logging facility 23
logging device-id hostname
logging host inside 10.0.0.240
icmp permit any outside
icmp permit any inside
mtu outside 1500
mtu inside 1500
ip address outside <snipped>.193.45 255.255.255.248
ip address inside 10.0.0.5 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool VPN 10.0.0.40-10.0.0.50
pdm location Lindon 255.255.255.0 inside
pdm location 10.0.0.32 255.255.255.224 outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-group outside_acl in interface outside
access-group inside_acl in interface inside
route outside 0.0.0.0 0.0.0.0 <snipped>.193.41 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
aaa authentication ssh console LOCAL
http server enable
http Lindon 255.255.255.0 inside
snmp-server host inside 10.0.0.5
snmp-server location Lindon
snmp-server contact admin
snmp-server community clverify
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
sysopt connection permit-pptp
crypto ipsec transform-set strong_enc esp-des esp-md5-hmac
crypto map vpn_tunnel_map 30 ipsec-isakmp
crypto map vpn_tunnel_map 30 match address lindon_to_orem
crypto map vpn_tunnel_map 30 set peer <snipped>.134.99
crypto map vpn_tunnel_map 30 set transform-set strong_enc
crypto map vpn_tunnel_map 40 ipsec-isakmp
crypto map vpn_tunnel_map 40 match address lindon_to_largo
crypto map vpn_tunnel_map 40 set peer <snipped>.143.164
crypto map vpn_tunnel_map 40 set transform-set strong_enc
isakmp enable outside
isakmp key <snipped> address <snipped>.134.99 netmask 255.255.255.255 no-xauth no-config-mode
isakmp key <snipped> address <snipped>.143.164 netmask 255.255.255.255 no-xauth no-config-mode
isakmp identity address
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
telnet timeout 5
ssh <snipped>.143.164 255.255.255.255 outside
ssh Lindon 255.255.255.0 inside
ssh timeout 60
management-access inside
console timeout 0
vpdn group PPTP-VPDN-GROUP accept dialin pptp
vpdn group PPTP-VPDN-GROUP ppp authentication mschap
vpdn group PPTP-VPDN-GROUP ppp encryption mppe auto required
vpdn group PPTP-VPDN-GROUP client configuration address local VPN
vpdn group PPTP-VPDN-GROUP client configuration dns 198.60.22.2 198.60.22.22
vpdn group PPTP-VPDN-GROUP pptp echo 60
vpdn group PPTP-VPDN-GROUP client authentication local
vpdn username VPN1 password <snipped>
vpdn enable outside
dhcpd address 10.0.0.20-10.0.0.39 inside
dhcpd dns 198.60.22.2 198.60.22.22
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd domain clverify.com
dhcpd auto_config outside
dhcpd enable inside
username mirwin password <snipped> encrypted privilege 15
username admin password <snipped> encrypted privilege 15
username administrator password <snipped> encrypted privilege 15
terminal width 80
banner exec CLVerify Lindon Firewall
banner login CLVerify Lindon Firewall
Cryptochecksum:<snipped>
: end
===============================================

Thanks in advance!

Mark Irwin

Start Free Trial

Keywords: Pix to Pix to Pix Mesh

	Title
1	Remote access to a Pix from a Pix prot…
2	PIX
3	PIX to PIX VPN issue
4	Pix to Pix VPN
5	How to configure PIX 515E for VPN …
6	Changing Cisco Pix Static Route to RA…

Loading Advertisement...

20081112-EE-VQP-42 - Hierarchy

1. RobWill 462,142
2. lrmoore 338,728
3. batry_boy 259,729
4. arnold 147,233
5. dpk_wal 113,722
6. mwecom... 80,224
7. Qlemo 63,674
8. ebjers 54,825
9. MrHusy 54,220
10. JFrederic... 45,680
11. Voltz-dk 45,170
12. mkielar 42,800
13. tigermatt 42,675
14. keith_ala... 42,496
15. TechSoEasy 41,389
16. PeteLong 39,110
17. Cyclops3... 37,640
18. SysExpert 35,850
19. trinak96 28,315
20. rsivanandan 27,780
21. RPPreacher 27,450
22. from_exp 26,775
23. rowansmith 24,875
24. 2PiFL 24,725
25. _jesper_ 23,650

1. RobWill 1,615,035
2. lrmoore 1,139,471
3. batry_boy 434,439
4. grblades 217,809
5. dpk_wal 166,722
6. rsivanandan 156,746
7. arnold 149,233
8. TechSoEasy 114,468
9. calvinetter 112,805
10. mwecom... 98,024
11. keith_ala... 97,335
12. MrHusy 87,494
13. PeteLong 81,966
14. Qlemo 79,767
15. tim_holman 75,964
16. Voltz-dk 75,270
17. Cyclops3... 73,585
18. ewtaylor 68,324
19. SysExpert 65,925
20. plemieux72 64,143
21. trinak96 63,165
22. ebjers 59,825
23. nodisco 58,930
24. JFrederic... 56,880
25. blin2000 52,944

Pix to Pix to Pix Mesh

Asked by albinoanteater in Virtual Private Networking (VPN)

Tags: clverify, dpbureau, nat0_acl

About this solution