Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

pix 501 to pix 515 MM_NO_STATE problem..

Posted on 2006-04-03
2
Medium Priority
?
480 Views
Last Modified: 2013-11-16
hi there
I have a pix 515E and a 501E
515E has two other tunnels that are established between other pix es.
the 501E does not have any other tunnels.
I'm constantly getting a MM_NO_STATE when I do sh isakmp sa.

here are the configs:

501:

 sh run
: Saved
:
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password 2KFQnbNIdI.2KYOU encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname x
domain-name x
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names        
access-list outside-in permit icmp any any echo-reply
access-list outside-in permit ip 192.168.10.0 255.255.255.0 any
access-list outside-in permit ip host 217.107.137.x any
access-list inside-out permit tcp any any eq ftp
access-list inside-out permit tcp any any eq https
access-list inside-out permit tcp any any eq www
access-list inside-out permit ip host 192.168.30.51 any
access-list inside-out permit ip 192.168.30.0 255.255.255.0 192.168.10.0 255.255.255.0
access-list inside-out permit ip 192.168.30.0 255.255.255.0 192.168.20.0 255.255.255.0
access-list vpn-london permit ip 192.168.30.0 255.255.255.0 192.168.10.0 255.255.255.0
access-list no-nat permit ip 192.168.30.0 255.255.255.0 192.168.10.0 255.255.255.0
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 82.108.93.x 255.255.255.240
ip address inside 192.168.30.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list vpn-london
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-group outside-in in interface outside
access-group inside-out in interface inside
route outside 0.0.0.0 0.0.0.0 82.108.93.x 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set myset esp-aes-256 esp-md5-hmac
crypto map mymap 10 ipsec-isakmp
crypto map mymap 10 match address vpn-london
crypto map mymap 10 set peer 217.107.137.x
crypto map mymap 10 set transform-set myset
crypto map mymap interface outside
isakmp enable outside
isakmp key ******** address 217.107.137.x netmask 255.255.255.255
isakmp identity address
isakmp nat-traversal 20
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption aes-256
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
telnet timeout 60
ssh 217.207.137.x 255.255.255.255 outside
ssh 192.168.30.0 255.255.255.0 inside
ssh timeout 60
console timeout 0
username kynixa password FIC0okgUk2itj9Sp encrypted privilege 15
terminal width 80
Cryptochecksum:a457c181f34f12b536815ed94242b79c
: end      

and here's the 515

PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto shutdown
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security40
enable password 2KFQnbNIdI.2KYOU encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname x
domain-name x
fixup protocol dns maximum-length 600
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol pptp 1723
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list outside-in permit icmp any any echo-reply
access-list outside-in permit tcp 193.109.x.0 255.255.254.0 host 217.207.137.x eq smtp
access-list outside-in permit tcp 195.245.x.0 255.255.254.0 host 217.207.137.x eq smtp
access-list outside-in permit tcp host 195.216.16.x host 217.207.137.x eq smtp
access-list outside-in permit tcp host 195.70.75.x host 217.207.137.x eq smtp
access-list outside-in permit ip host 87.74.63.x host 217.207.137.x
access-list inside-out permit tcp any any eq www
access-list inside-out permit tcp any any eq https
access-list inside-out permit tcp any any eq ftp
access-list inside-out permit ip host 192.168.10.52 any
access-list inside-out permit ip host 192.168.10.10 any
access-list inside-out permit tcp host 192.168.10.54 193.109.254.0 255.255.254.0 eq smtp
access-list inside-out permit tcp host 192.168.10.54 195.245.230.0 255.255.254.0 eq smtp
access-list inside-out permit ip 192.168.10.0 255.255.255.0 192.168.30.0 255.255.255.0
access-list inside-out permit ip 192.168.10.0 255.255.255.0 192.168.11.0 255.255.255.0
access-list inside-out permit tcp host 192.168.10.54 host 195.216.16.211 eq smtp
access-list inside-out permit icmp any any echo-reply
access-list inside-out permit tcp any any eq 3389
access-list inside-out permit ip host 192.168.10.51 any
access-list inside-out permit ip host 192.168.10.53 any
access-list inside-out permit ip host 192.168.10.54 any
access-list vpnclients permit ip 192.168.10.0 255.255.255.0 10.0.0.0 255.255.255.0
access-list vpnclients permit ip 192.168.10.0 255.255.255.0 192.168.11.0 255.255.255.0
access-list vpnclients permit ip 192.168.10.0 255.255.255.0 192.168.20.0 255.255.255.0
access-list vpnclients permit ip any 10.0.0.0 255.255.255.0
access-list vpnclients permit ip interface inside 10.0.0.0 255.255.255.0
access-list vpnclients permit ip interface inside 192.168.10.192 255.255.255.192
access-list vpnclients permit ip 192.168.20.0 255.255.255.0 192.168.10.0 255.255.255.0
access-list vpnclients permit ip any 192.168.20.0 255.255.255.0
access-list vpnclients permit ip interface inside 192.168.20.0 255.255.255.0
access-list vpnclients permit ip 192.168.10.0 255.255.255.0 192.168.30.0 255.255.255.0
access-list staticvpn permit ip 192.168.10.0 255.255.255.0 192.168.11.0 255.255.255.0
access-list nonat_acl permit ip 192.168.10.0 255.255.255.0 192.168.20.0 255.255.255.0
access-list outside_cryptomap_dyn_40 permit ip any 10.0.0.0 255.255.255.0
access-list outside_cryptomap_dyn_60 permit ip any 10.0.0.0 255.255.255.0
access-list outside_cryptomap_dyn_80 permit ip any 10.0.0.0 255.255.255.0
access-list outside_cryptomap_dyn_100 permit ip any 10.0.0.0 255.255.255.0
access-list outside_cryptomap_dyn_120 permit ip any 10.0.0.0 255.255.255.0
access-list outside_cryptomap_dyn_140 permit ip any 10.0.0.0 255.255.255.0
access-list outside_cryptomap_dyn_160 permit ip any 10.0.0.0 255.255.255.0
access-list outside_cryptomap_dyn_180 permit ip any 10.0.0.0 255.255.255.0
access-list vpn-birmingham permit ip 192.168.10.0 255.255.255.0 192.168.30.0 255.255.255.0
pager lines 24
logging on    
logging buffered warnings
icmp deny any echo outside
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip address outside 217.207.137.x 255.255.255.240
ip address inside 192.168.10.1 255.255.255.0
no ip address dmz
ip audit info action alarm
ip audit attack action alarm
ip local pool vpn-client-ip-pool 10.0.0.1-10.0.0.254
ip local pool xxx 192.168.10.10-192.168.10.254
ip local pool ms 192.168.20.0-192.168.20.254
pdm location 192.168.10.52 255.255.255.255 inside
pdm location 10.0.0.0 255.255.255.0 inside
pdm location 192.168.10.10 255.255.255.255 inside
pdm location 192.168.10.51 255.255.255.255 inside
pdm location 192.168.10.53 255.255.255.255 inside
pdm location 192.168.10.54 255.255.255.255 inside
pdm location 192.168.10.100 255.255.255.255 inside
pdm location 0.0.0.0 0.0.0.0 outside
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list vpnclients
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) 217.207.137.x 192.168.10.54 netmask 255.255.255.255 0 0
access-group outside-in in interface outside
access-group inside-out in interface inside
route outside 0.0.0.0 0.0.0.0 217.207.137.x 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:00:00 absolute uauth 0:05:00 inactivity
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
aaa-server partnerauth protocol radius
aaa-server partnerauth (inside) host 192.168.10.52 redkeyboard5 timeout 5
aaa authentication secure-http-client
aaa authentication include http outside 192.168.10.54 255.255.255.255 0.0.0.0 0.0.0.0 partnerauth
ntp server 195.66.232.x source outside
ntp server 193.63.105.x source outside prefer
http server enable
http 192.168.10.52 255.255.255.255 inside
http 192.168.10.53 255.255.255.255 inside
http 192.168.10.54 255.255.255.255 inside
http 192.168.10.10 255.255.255.255 inside
http 192.168.11.10 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
sysopt connection permit-pptp
sysopt connection permit-l2tp
crypto ipsec transform-set myset esp-aes-256 esp-md5-hmac
crypto ipsec transform-set TRANS_ESP_DES_MD5 esp-des esp-md5-hmac
crypto ipsec transform-set TRANS_ESP_DES_MD5 mode transport
crypto ipsec transform-set TRANS_ESP_3DES_MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set TRANS_ESP_3DES_MD5 mode transport
crypto dynamic-map dynmap 20 set transform-set myset
crypto dynamic-map dynmap 40 match address outside_cryptomap_dyn_40
crypto dynamic-map dynmap 40 set transform-set TRANS_ESP_DES_MD5
crypto dynamic-map dynmap 60 match address outside_cryptomap_dyn_60
crypto dynamic-map dynmap 60 set transform-set TRANS_ESP_DES_MD5
crypto dynamic-map dynmap 80 match address outside_cryptomap_dyn_80
crypto dynamic-map dynmap 80 set transform-set TRANS_ESP_DES_MD5
crypto dynamic-map dynmap 100 match address outside_cryptomap_dyn_100
crypto dynamic-map dynmap 100 set transform-set TRANS_ESP_DES_MD5
crypto dynamic-map dynmap 120 match address outside_cryptomap_dyn_120
crypto dynamic-map dynmap 120 set transform-set TRANS_ESP_DES_MD5
crypto dynamic-map dynmap 140 match address outside_cryptomap_dyn_140
crypto dynamic-map dynmap 140 set transform-set TRANS_ESP_DES_MD5
crypto dynamic-map dynmap 160 match address outside_cryptomap_dyn_160
crypto dynamic-map dynmap 160 set transform-set TRANS_ESP_DES_MD5
crypto dynamic-map dynmap 180 match address outside_cryptomap_dyn_180
crypto dynamic-map dynmap 180 set transform-set TRANS_ESP_3DES_MD5
crypto map mymap 10 ipsec-isakmp
crypto map mymap 10 match address staticvpn
crypto map mymap 10 set peer 82.109.36.x <-- another vpn that is working fine with another 501.
crypto map mymap 10 set transform-set myset
crypto map mymap 20 ipsec-isakmp dynamic dynmap
crypto map mymap 30 ipsec-isakmp
! Incomplete
crypto map mymap 40 ipsec-isakmp
crypto map mymap 40 match address vpn-birmingham
crypto map mymap 40 set peer 82.108.93.x <-- the site for the PIX501
crypto map mymap 40 set transform-set myset
crypto map mymap client authentication partnerauth
crypto map mymap interface outside
isakmp enable outside
isakmp key ******** address 82.109.36.x netmask 255.255.255.255 no-xauth no-config-mode
isakmp key ******** address 0.0.0.0 netmask 0.0.0.0
isakmp key ******** address 82.108.93.x netmask 255.255.255.255 <--- the site for the PIX501
isakmp identity address
isakmp nat-traversal 20
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption aes-256
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
isakmp policy 30 authentication pre-share
isakmp policy 30 encryption 3des
isakmp policy 30 hash md5
isakmp policy 30 group 1
isakmp policy 30 lifetime 86400
vpngroup vpnclients address-pool vpn-client-ip-pool
vpngroup vpnclients dns-server 192.168.10.52 192.168.10.53
vpngroup vpnclients default-domain kynixa.co.uk
vpngroup vpnclients pfs
vpngroup vpnclients idle-time 1800
vpngroup vpnclients password ********
vpngroup 1 idle-time 1800
telnet 192.168.10.52 255.255.255.255 inside
telnet timeout 60
ssh 195.70.x.x 255.255.255.255 outside
ssh 192.168.10.52 255.255.255.255 inside

ssh timeout 60
management-access outside
console timeout 0
vpdn group 1 accept dialin pptp
vpdn group 1 ppp authentication mschap
vpdn group 1 ppp encryption mppe auto
vpdn group 1 client configuration address local ms
vpdn group 1 client configuration dns 192.168.10.52 192.168.10.53
vpdn group 1 client configuration wins 192.168.10.52 192.168.10.53
vpdn group 1 client authentication aaa partnerauth
vpdn group 1 client accounting partnerauth
vpdn group 1 pptp echo 60
vpdn username xxx password *********
vpdn enable outside
username xxx password 3bwiGy4kTRL0kCyt encrypted privilege 15
terminal width 80
Cryptochecksum:f3afbee113392908655706859290b9d6
: end
0
Comment
Question by:eggster34
2 Comments
 
LVL 15

Accepted Solution

by:
Frabble earned 2000 total points
ID: 16365641
On the 501, you have the wrong peer address (107 instead of 207):

isakmp key ******** address 217.107.137.x netmask 255.255.255.255
0
 

Author Comment

by:eggster34
ID: 16365984
how stupid of me.. thanks a lot. It's working perfectly now.
0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Many of the companies I’ve worked with have embraced cloud solutions due to their desire to “get out of the datacenter business.” The ability to achieve better security and availability, and the speed with which they are able to deploy, is far grea…
This article explains the fundamentals of industrial networking which ultimately is the backbone network which is providing communications for process devices like robots and other not so interesting stuff.
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…
Suggested Courses

810 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question