With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.
The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community
Your Input Matters Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.
If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.
Hello, Im trying to set up an IPSec VPN tunnel between a PIX 515 and a Cisco 851 Router. I cant get the tunnel to work. Below is the VPN information from the router and PIX. Am I missing something? (The outside IPs have been xed out)
interface FastEthernet4 description Internet connection ip address x.x.x.x 255.255.255.0 ip nat outside ip virtual-reassembly duplex auto speed auto crypto map avalanche
crypto isakmp policy 1 encr 3des hash sha authentication pre-share group 2 crypto isakmp key ******** address x.x.x.x <= x.x.x.x is PIX address ! ! crypto ipsec transform-set avalanche esp-3des esp-sha-hmac ! crypto map avalanche 1 ipsec-isakmp description Tunnel to HQ set peer x.x.x.x <= x.x.x.x is PIX address set transform-set avalanche match address 101
ip nat inside source route-map RMAP interface FastEthernet4 overload
route-map RMAP permit 1 match ip address 102
access-list 101 remark IPSec Rule access-list 101 permit ip 10.1.30.0 0.0.0.255 10.1.5.0 0.0.3.255 access-list 102 remark route-map rule access-list 102 deny ip 10.109.30.0 0.0.0.255 10.1.5.0 0.0.3.255 access-list 102 permit ip 10.109.30.0 0.0.0.255 any
Debug information from router:
*Mar 11 19:19:02.987: ISAKMP:(0): SA request profile is (NULL) *Mar 11 19:19:02.987: ISAKMP: Created a peer struct for x.x.x.x, peer port 500 *Mar 11 19:19:02.987: ISAKMP: New peer created peer = 0x82E13234 peer_handle = 0x80000052 *Mar 11 19:19:02.991: ISAKMP: Locking peer struct 0x82E13234, refcount 1 for isakmp_initiator *Mar 11 19:19:02.991: ISAKMP: local port 500, remote port 500 *Mar 11 19:19:02.991: ISAKMP: set new node 0 to QM_IDLE *Mar 11 19:19:02.991: ISAKMP: Find a dup sa in the avl tree during calling isadb_insert sa = 82C01C44 *Mar 11 19:19:02.991: ISAKMP:(0):Can not start Aggressive mode, trying Main mode. *Mar 11 19:19:02.991: ISAKMP:(0):found peer pre-shared key matching x.x.x.x *Mar 11 19:19:02.991: ISAKMP:(0): constructed NAT-T vendor-rfc3947 ID *Mar 11 19:19:02.991: ISAKMP:(0): constructed NAT-T vendor-07 ID *Mar 11 19:19:02.991: ISAKMP:(0): constructed NAT-T vendor-03 ID *Mar 11 19:19:02.991: ISAKMP:(0): constructed NAT-T vendor-02 ID *Mar 11 19:19:02.991: ISAKMP:(0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM *Mar 11 19:19:02.991: ISAKMP:(0):Old State = IKE_READY New State = IKE_I_MM1
*Mar 11 19:19:02.991: ISAKMP:(0): beginning Main Mode exchange *Mar 11 19:19:02.991: ISAKMP:(0): sending packet to x.x.x.x my_port 500 peer_port 500 (I) MM_NO_STATE *Mar 11 19:19:02.991: ISAKMP:(0):Sending an IKE IPv4 Packet. *Mar 11 19:19:03.059: ISAKMP (0:0): received packet from x.x.x.x dport 500 sport 500 Global (I) MM_NO_STATE *Mar 11 19:19:03.059: ISAKMP:(0):Notify has no hash. Rejected. *Mar 11 19:19:03.059: ISAKMP (0:0): Unknown Input IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY: state = IKE_I_MM1 *Mar 11 19:19:03.059: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY *Mar 11 19:19:03.059: ISAKMP:(0):Old State = IKE_I_MM1 New State = IKE_I_MM1
*Mar 11 19:19:03.059: %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Informational mode failed with peer at x.x.x.x *Mar 11 19:19:12.991: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE... *Mar 11 19:19:12.991: ISAKMP (0:0): incrementing error counter on sa, attempt 1 of 5: retransmit phase 1 *Mar 11 19:19:12.991: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE *Mar 11 19:19:12.991: ISAKMP:(0): sending packet to x.x.x.x my_port 500 peer_port 500 (I) MM_NO_STATE *Mar 11 19:19:12.991: ISAKMP:(0):Sending an IKE IPv4 Packet. *Mar 11 19:19:22.991: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE... *Mar 11 19:19:22.991: ISAKMP (0:0): incrementing error counter on sa, attempt 2 of 5: retransmit phase 1 *Mar 11 19:19:22.991: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE *Mar 11 19:19:22.991: ISAKMP:(0): sending packet to x.x.x.x my_port 500 peer_port 500 (I) MM_NO_STATE *Mar 11 19:19:22.991: ISAKMP:(0):Sending an IKE IPv4 Packet. *Mar 11 19:19:32.987: IPSEC(key_engine): request timer fired: count = 1, (identity) local= x.x.x.x, remote= x.x.x.x, local_proxy= 10.1.30.0/255.255.255.0/0/0 (type=4), remote_proxy= 10.1.5.0/255.255.252.0/0/0 (type=4) *Mar 11 19:19:32.987: IPSEC(sa_request): , (key eng. msg.) OUTBOUND local= x.x.x.x, remote= x.x.x.x, local_proxy= 10.1.30.0/255.255.255.0/0/0 (type=4), remote_proxy= 10.1.5.0/255.255.252.0/0/0 (type=4), protocol= ESP, transform= esp-3des esp-sha-hmac (Tunnel), lifedur= 3600s and 4608000kb, spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x0 *Mar 11 19:19:32.987: ISAKMP: set new node 0 to QM_IDLE *Mar 11 19:19:32.987: ISAKMP:(0):SA is still budding. Attached new ipsec request to it. (local x.x.x.x, remote x.x.x.x) *Mar 11 19:19:32.987: ISAKMP: Error while processing SA request: Failed to initialize SA *Mar 11 19:19:32.987: ISAKMP: Error while processing KMI message 0, error 2. *Mar 11 19:19:32.991: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE... *Mar 11 19:19:32.991: ISAKMP (0:0): incrementing error counter on sa, attempt 3 of 5: retransmit phase 1 *Mar 11 19:19:32.991: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE *Mar 11 19:19:32.991: ISAKMP:(0): sending packet to x.x.x.x my_port 500 peer_port 500 (I) MM_NO_STATE *Mar 11 19:19:32.991: ISAKMP:(0):Sending an IKE IPv4 Packet. *Mar 11 19:19:42.991: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE... *Mar 11 19:19:42.991: ISAKMP (0:0): incrementing error counter on sa, attempt 4 of 5: retransmit phase 1 *Mar 11 19:19:42.991: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE *Mar 11 19:19:42.991: ISAKMP:(0): sending packet to x.x.x.x my_port 500 peer_port 500 (I) MM_NO_STATE *Mar 11 19:19:42.991: ISAKMP:(0):Sending an IKE IPv4 Packet. *Mar 11 19:19:47.271: ISAKMP:(0):purging node 147234572 *Mar 11 19:19:47.271: ISAKMP:(0):purging node 2120078446 *Mar 11 19:19:52.991: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE... *Mar 11 19:19:52.991: ISAKMP (0:0): incrementing error counter on sa, attempt 5 of 5: retransmit phase 1 *Mar 11 19:19:52.991: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE *Mar 11 19:19:52.991: ISAKMP:(0): sending packet to x.x.x.x my_port 500 peer_port 500 (I) MM_NO_STATE *Mar 11 19:19:52.991: ISAKMP:(0):Sending an IKE IPv4 Packet. *Mar 11 19:19:57.271: ISAKMP:(0):purging SA., sa=82E1282C, delme=82E1282C *Mar 11 19:20:02.987: IPSEC(key_engine): request timer fired: count = 2, (identity) local= x.x.x.x, remote= x.x.x.x, local_proxy= 10.1.30.0/255.255.255.0/0/0 (type=4), remote_proxy= 10.1.5.0/255.255.252.0/0/0 (type=4) *Mar 11 19:20:02.991: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE... *Mar 11 19:20:02.991: ISAKMP:(0):peer does not do paranoid keepalives. *Mar 11 19:20:02.991: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE... *Mar 11 19:20:02.991: ISAKMP:(0):peer does not do paranoid keepalives.
*Mar 11 19:20:02.991: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer x.x.x.x) *Mar 11 19:20:02.991: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer x.x.x.x) *Mar 11 19:20:02.991: ISAKMP: Unlocking peer struct 0x82E13234 for isadb_mark_sa_deleted(), count 0 *Mar 11 19:20:02.991: ISAKMP: Deleting peer node by peer_reap for x.x.x.x: 82E13234 *Mar 11 19:20:02.991: ISAKMP:(0):deleting node 1689572035 error FALSE reason "IKE deleted" *Mar 11 19:20:02.991: ISAKMP:(0):deleting node -1742316464 error FALSE reason "IKE deleted" *Mar 11 19:20:02.991: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL *Mar 11 19:20:02.991: ISAKMP:(0):Old State = IKE_I_MM1 New State = IKE_DEST_SA
Batry Boy, Thank you for the advice. Adding group 1 to the router fixed the problem. The tunnel is now established but traffic won't pass across it. The access-lists on both the router and PIX are being hit but I can't access anything on either side of the tunnel. Any ideas?
The configuration is the same as in my original post except I added group 1 to the router.
Cisco recommends that you use separate ACL's when defining the NAT exemption traffic and the ACL defining the traffic to be sent down the tunnel. You are currently using the "nonat" ACL on the PIX for both purposes, so I would do the following:
access-list outside_1_cryptomap permit 10.1.5.0 255.255.252.0 10.1.30.0 255.255.255.0 no crypto map remote 10 match address nonat crypto map remote 10 match address outside_1_cryptomap clear crypto isakmp sa clear crypto ipsec sa
then try to pass traffic across the tunnel and see what you get. Be advised that the last two commands will kill any existing VPN connections, whether they are remote users or other site-to-site VPN connections. Therefore, unless you know that there are no other VPN connections, you may want to check to see if there are any currently with the following command:
Thank you for the other quick reply. I created another access list and made the changes you suggested. I am still unable to ping or connect to anything on the other side of the tunnel. What is confusing is that the ACLs are being hit. I'm baffled. Do you have anything other suggestions or recommendations?
Thanks for your help with this. I greatly appreciate it.
access-list ipsec permit ip 10.1.5.0 255.255.252.0 10.1.30.0 255.255.255.0 access-list nonat permit ip 10.1.5.0 255.255.252.0 10.1.30.0 255.255.255.0
access-list ipsec; 1 elements access-list ipsec line 1 permit ip 10.1.5.0 255.255.252.0 10.1.30.0 255.255.255.0 (hitcnt=16) access-list nonat; 1 elements access-list nonat line 1 permit ip 10.1.5.0 255.255.252.0 10.1.30.0 255.255.255.0 (hitcnt=136)
access-list 102 deny ip 10.109.30.0 0.0.0.255 10.1.5.0 0.0.3.255
I believe that you need to deny the defined tunnel traffic so that it is exempted from the NAT process. Add the following lines to the router and see if this helps:
no access-list 102 access-list 102 remark route-map rule access-list 102 deny ip 10.1.30.0 0.0.0.255 10.1.5.0 0.0.3.255 access-list 102 permit ip 10.1.30.0 0.0.0.255 any
The access list entries you mentioned were already in the config
access-list 102 remark route-map rule access-list 102 deny ip 10.109.30.0 0.0.0.255 10.1.5.0 0.0.3.255 access-list 102 permit ip 10.109.30.0 0.0.0.255 any
I'm still scratching my head on this one. As I mentioned, the tunnel is up, the ACL's are getting hit but I can't get any traffic to cross the tunnel. There are no ACL's on the router or PIX that would be preventing any traffic flow. I'm baffled.
You may want to take a look at the "sh cryp ip sa" output to see the number of packets being encrypted and decrypted, and then encapsulated and decapsulated for the SA that is related to this particular tunnel. If you have multiple tunnels (other site-to-site tunnels or remote access tunnels), then you will get the output of all of those tunnels, so be sure and just look at the one that is for your specific tunnel peer in question.
There is only one VPN connection. The tunnel just reconnected. Below is the output. I have no clue why traffic won't traverse the tunnel. I x'ed out the outside IP's.
CORP-PIX-1# show crypto isakmp sa Total : 1 Embryonic : 0 dst src state pending created x.x.x.x x.x.x.x QM_IDLE 0 1 CORP-PIX-1# show crypto ipsec sa
interface: outside Crypto map tag: thunder, local addr. x.x.x.x
The "pkts encaps" and "pkts encrypt" values are the packets that are going down the tunnel from the PIX to the remote site, and the "pkts decaps" and "pkts decrypt" values are the packets coming from the remote site to the PIX.
If there was an ACL blocking the traffic, these numbers wouldn't be incrementing because the ACL's are checked before the traffic is allowed into the tunnel. How are you testing the traffic through the tunnel?
