837 -> ASA5510 / PIX 501

Hello,

I’ve been trying to around 3 days to establish a site to site VPN first from a Cisco 837 router to our new ASA5510 and when that didn’t work out, now from to a test PIX 501 6.3. The tunnel just doesn’t come up. I’ve attached the configs of both but for the life of me I cannot see where the problem is. I’ve read just about every solution there is on the site. Static IP not available form Telco here for DSL… Thank you in advance

Building configuration...
: Saved
:
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password NuLKvvWGg.x9HEKO encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname FW03
domain-name STG.CO.ZA
clock timezone SAST 2
fixup protocol dns maximum-length 896
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list NONAT permit ip 192.99.99.0 255.255.255.0 192.168.0.0 255.255.255.0
access-list inside_access_in permit ip any any
pager lines 24
logging on
logging timestamp
logging console emergencies
logging monitor informational
icmp permit any outside
icmp permit any inside
mtu outside 1500
mtu inside 1500
ip address outside ***.***.***.*** 255.255.255.248
ip address inside 192.99.99.96 255.255.255.0
ip audit name cosira.co.za attack action drop
ip audit info action alarm
ip audit attack action alarm drop
pdm location 192.99.99.0 255.255.255.0 inside
pdm location 192.99.99.0 255.255.255.255 inside
pdm location 192.99.99.155 255.255.255.255 inside
pdm location 192.168.0.0 255.255.255.0 outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list NONAT
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 196.37.171.233 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 192.99.99.0 255.255.255.255 inside
http 192.99.99.155 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
service resetinbound
service resetoutside
crypto ipsec transform-set router-set esp-des esp-md5-hmac
crypto dynamic-map cisco 1 set transform-set router-set
crypto map dyn-map 10 ipsec-isakmp dynamic cisco
crypto map dyn-map interface outside
isakmp enable outside
isakmp key ******** address 0.0.0.0 netmask 0.0.0.0 no-xauth
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 1
isakmp policy 10 lifetime 86400
telnet timeout 20
ssh timeout 5
console timeout 30
terminal width 80
Cryptochecksum:4faf1615f2579b29b7ff7d6481e12d38
: end
[OK]


Building configuration...

Current configuration : 2512 bytes
!
version 12.4
no service pad
service timestamps debug uptime
service timestamps log uptime
service password-encryption
no service dhcp
!
hostname DZM
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$WK1U$xSrnkiADVftmt9faBa1r3.
enable password 7 142713181F1325392079
!
no aaa new-model
!
resource policy
!
no ip source-route
!
!
ip cef
no ip domain lookup
ip domain name local
no ip bootp server
!
!
!
!
!
!
crypto isakmp policy 1
 hash md5
 authentication pre-share
crypto isakmp key cisco123 address ***.***.***.***
!
!
crypto ipsec transform-set pix-set esp-des esp-md5-hmac
!
crypto map pix 10 ipsec-isakmp
 set peer ***.***.***.***
 set transform-set pix-set
 match address 101
!
!
!
interface Ethernet0
 description ETH0
 ip address 192.168.0.100 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 ip tcp adjust-mss 1452
 hold-queue 100 out
!
interface Ethernet2
 no ip address
 shutdown
 hold-queue 100 out
!
interface ATM0
 no ip address
 atm vc-per-vp 64
 no atm ilmi-keepalive
 dsl operating-mode auto
 pvc 8/35
  pppoe-client dial-pool-number 1
 !
!
interface FastEthernet1
 duplex auto
 speed auto
!
interface FastEthernet2
 duplex auto
 speed auto
!
interface FastEthernet3
 duplex auto
 speed auto
!
interface FastEthernet4
 duplex auto
 speed auto
!
interface Virtual-PPP1
 no ip address
 shutdown
!
interface Dialer0
 bandwidth 640
 ip address negotiated
 no ip redirects
 no ip unreachables
 ip mtu 1492
 ip nat outside
 ip virtual-reassembly
 encapsulation ppp
 no ip route-cache cef
 no ip route-cache
 no ip mroute-cache
 dialer pool 1
 dialer remote-name redback
 dialer-group 1
 no cdp enable
 ppp pap sent-username online509526@dsl512telkomsa.net password 7 051A141B28
071D
 ppp ipcp dns request
 crypto map pix
!
interface Dialer1
 no ip address
!
ip route 0.0.0.0 0.0.0.0 Dialer0
no ip http server
no ip http secure-server
!
ip nat inside source route-map nonat interface Dialer0 overload
!
access-list 101 permit ip 192.168.0.0 0.0.0.255 192.99.99.0 0.0.0.255
access-list 102 permit ip 192.168.0.0 0.0.0.255 any
access-list 110 deny   ip 192.168.0.0 0.0.0.255 192.99.99.0 0.0.0.255
access-list 110 permit ip 192.168.0.0 0.0.0.255 any
dialer-list 1 protocol ip permit
route-map nonat permit 10
 match ip address 110
!
!
control-plane
!
!
line con 0
 exec-timeout 120 0
 no modem enable
 stopbits 1
line aux 0
line vty 0 4
 access-class 2 in
 exec-timeout 120 0
 login local
 length 0
 transport input telnet ssh
 transport output none
!
scheduler max-task-time 5000
end

Start Free Trial