Pix to Pix to Pix Mesh

Hello all,
   I'm attempting to setup a VPN mesh between 2 PIX 501's and a PIX 506e.
Here's a quick overview of the environment.
There are 3 Devices
Largo - PIX 501
Lindon - PIX 506e
Orem - PIX 501
Each device is also the gateway for it's location.
Each will also need to (if possible) be able to allow connections for the Cisco VPN client.
    The Largo PIX (and possibly all of them) need to be able to authenticate to an Windows AD Server
I currently only have access to the Largo and Lindon devices I will gain access to the Orem device on Monday

I've been trying this for the past 3 days and I've got (or had at least, I've likely broken it by now) the RADIUS functionality working on the Largo PIX .
But the VPN tunnel between the Largo and Lindon device is eluding me.
I've followed this document from cisco http://www.cisco.com/warp/public/110/pixmeshed.html

I've turned on 'debug crypo ipsec sa' and 'debug crypto isakmp' and debug crypto engine' on both devices but I'm not recieving any extra information.
here is the output for a 'show ipsec sa' and a 'show isakmp sa' for both devices.
Largo(config)# show ipsec sa
Largo(config)# show isakmp sa
Total     : 0
Embryonic : 0
        dst               src        state     pending     created
       
       
lindon# show ipsec sa
lindon# show isakmp sa
Total     : 0
Embryonic : 0
        dst               src        state     pending     created
lindon#

Here are the configs. (Be kind they have a lot in them I need to clean up still :)
: Saved
: Written by enable_15 at 15:03:45.761 EDT Fri Sep 8 2006
PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password <snipped> encrypted
passwd <snipped> encrypted
hostname Largo
domain-name dpbureau.net
clock timezone EST -5
clock summer-time EDT recurring
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 192.168.40.2 dpbureau-mail
name 192.168.40.20 dpbureau-ftp
name 10.0.0.0 Lindon
name 10.10.0.0 Orem
name 192.168.40.0 Largo
access-list inside_outbound_nat0_acl permit ip any 192.168.40.32 255.255.255.224
access-list outside_acl permit tcp host dpbureau-mail any eq smtp
access-list outside_acl permit ip interface inside Orem 255.255.0.0
access-list radius_vpn_acl permit ip 192.168.41.0 255.255.255.0 Largo 255.255.255.0
access-list radius_vpn_acl permit ip Largo 255.255.255.0 192.168.41.0 255.255.255.0
access-list nat0_acl permit ip Largo 255.255.255.0 Lindon 255.255.0.0
access-list nat0_acl permit ip Largo 255.255.255.0 Orem 255.255.0.0
access-list inside_acl permit ip any any
access-list largo_to_lindon permit ip Largo 255.255.255.0 Lindon 255.255.0.0
access-list largo_to_orem permit ip Largo 255.255.255.0 Orem 255.255.0.0
pager lines 24
logging on
logging timestamp
logging trap informational
logging facility 23
logging device-id hostname
logging host inside 192.168.40.126
icmp permit any outside
icmp permit any inside
mtu outside 1500
mtu inside 1500
ip address outside <snipped>.143.164 255.0.0.0
ip address inside 192.168.40.4 255.255.255.0
ip verify reverse-path interface outside
ip audit info action alarm
ip audit attack action alarm
ip local pool VPN-pool 192.168.40.40-192.168.40.60
ip local pool radius_pool 192.168.41.200-192.168.41.254
pdm location 0.0.0.0 255.0.0.0 outside
pdm location 192.168.40.32 255.255.255.224 outside
pdm location Orem 255.255.0.0 outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list nat0_acl
nat (inside) 1 access-list inside_acl 0 0
static (inside,outside) <snipped>.143.163 dpbureau-mail netmask 255.255.255.255 0 0
static (inside,outside) <snipped>.143.173 dpbureau-ftp netmask 255.255.255.255 0 0
access-group outside_acl in interface outside
access-group inside_acl in interface inside
rip inside default version 1
route outside 0.0.0.0 0.0.0.0 <snipped>.143.161 1
timeout xlate 1:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 1:00:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
aaa-server radius_ad_auth protocol radius
aaa-server radius_ad_auth max-failed-attempts 3
aaa-server radius_ad_auth deadtime 10
aaa-server radius_ad_auth (inside) host 192.168.40.12 <snipped> timeout 5
aaa authentication ssh console LOCAL
http server enable
http Largo 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
sysopt connection permit-pptp
crypto ipsec transform-set radius_set esp-des esp-md5-hmac
crypto ipsec transform-set strong_enc esp-des esp-md5-hmac
crypto dynamic-map radius_vpn_dynamic_map 10 match address radius_vpn_acl
crypto dynamic-map radius_vpn_dynamic_map 10 set transform-set radius_set
crypto map radius_map 10 ipsec-isakmp dynamic radius_vpn_dynamic_map
crypto map radius_map client authentication radius_ad_auth
crypto map vpn_tunnel_map 30 ipsec-isakmp
crypto map vpn_tunnel_map 30 match address largo_to_orem
crypto map vpn_tunnel_map 30 set peer <snipped>.134.99
crypto map vpn_tunnel_map 30 set transform-set strong_enc
crypto map vpn_tunnel_map 50 ipsec-isakmp
crypto map vpn_tunnel_map 50 match address largo_to_lindon
crypto map vpn_tunnel_map 50 set peer <snipped>.193.45
crypto map vpn_tunnel_map 50 set transform-set strong_enc
isakmp enable outside
isakmp key <snipped> address <snipped>.134.99 netmask 255.255.255.255 no-xauth no-config-mode
isakmp key <snipped> address <snipped>.193.45 netmask 255.255.255.255 no-xauth no-config-mode
isakmp identity address
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
vpngroup dpbureau address-pool radius_pool
vpngroup dpbureau dns-server 192.168.40.12
vpngroup dpbureau default-domain tampahq.dpbureau.com
vpngroup dpbureau split-tunnel radius_vpn_acl
vpngroup dpbureau idle-time 1800
vpngroup dpbureau password <snipped>
telnet timeout 60
ssh Largo 255.255.255.0 inside
ssh timeout 60
management-access inside
console timeout 0
vpdn group PPTP-VPDN-GROUP accept dialin pptp
vpdn group PPTP-VPDN-GROUP ppp authentication mschap
vpdn group PPTP-VPDN-GROUP ppp encryption mppe 128 required
vpdn group PPTP-VPDN-GROUP client configuration address local VPN-pool
vpdn group PPTP-VPDN-GROUP pptp echo 60
vpdn group PPTP-VPDN-GROUP client authentication local
vpdn username fmosuch password <snipped>
vpdn username VPN1 password <snipped>
vpdn enable outside
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
username mirwin password <snipped> encrypted privilege 15
username fmosuch password <snipped> encrypted privilege 15
terminal width 80
banner login Largo Cisco Pix 501 Firewall
Cryptochecksum:<snipped>
: end
===============================================
 : Saved
: Written by enable_15 at 14:03:38.942 MDT Fri Sep 8 2006
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password <snipped> encrypted
passwd <snipped> encrypted
hostname lindon
domain-name clverify.com
clock timezone MST -7
clock summer-time MDT recurring
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 192.168.40.0 Largo
name 10.10.0.0 Orem
name 10.0.0.0 Lindon
access-list inside_acl permit ip any any
access-list nat0_acl permit ip Lindon 255.255.0.0 Largo 255.255.255.0
access-list nat0_acl permit ip Lindon 255.255.0.0 Orem 255.255.0.0
access-list lindon_to_orem permit ip Lindon 255.255.0.0 Orem 255.255.0.0
access-list lindon_to_largo permit ip Lindon 255.255.0.0 Largo 255.255.255.0
pager lines 24
logging on
logging timestamp
logging trap informational
logging facility 23
logging device-id hostname
logging host inside 10.0.0.240
icmp permit any outside
icmp permit any inside
mtu outside 1500
mtu inside 1500
ip address outside <snipped>.193.45 255.255.255.248
ip address inside 10.0.0.5 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool VPN 10.0.0.40-10.0.0.50
pdm location Lindon 255.255.255.0 inside
pdm location 10.0.0.32 255.255.255.224 outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-group outside_acl in interface outside
access-group inside_acl in interface inside
route outside 0.0.0.0 0.0.0.0 <snipped>.193.41 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
aaa authentication ssh console LOCAL
http server enable
http Lindon 255.255.255.0 inside
snmp-server host inside 10.0.0.5
snmp-server location Lindon
snmp-server contact admin
snmp-server community clverify
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
sysopt connection permit-pptp
crypto ipsec transform-set strong_enc esp-des esp-md5-hmac
crypto map vpn_tunnel_map 30 ipsec-isakmp
crypto map vpn_tunnel_map 30 match address lindon_to_orem
crypto map vpn_tunnel_map 30 set peer <snipped>.134.99
crypto map vpn_tunnel_map 30 set transform-set strong_enc
crypto map vpn_tunnel_map 40 ipsec-isakmp
crypto map vpn_tunnel_map 40 match address lindon_to_largo
crypto map vpn_tunnel_map 40 set peer <snipped>.143.164
crypto map vpn_tunnel_map 40 set transform-set strong_enc
isakmp enable outside
isakmp key <snipped> address <snipped>.134.99 netmask 255.255.255.255 no-xauth no-config-mode
isakmp key <snipped> address <snipped>.143.164 netmask 255.255.255.255 no-xauth no-config-mode
isakmp identity address
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
telnet timeout 5
ssh <snipped>.143.164 255.255.255.255 outside
ssh Lindon 255.255.255.0 inside
ssh timeout 60
management-access inside
console timeout 0
vpdn group PPTP-VPDN-GROUP accept dialin pptp
vpdn group PPTP-VPDN-GROUP ppp authentication mschap
vpdn group PPTP-VPDN-GROUP ppp encryption mppe auto required
vpdn group PPTP-VPDN-GROUP client configuration address local VPN
vpdn group PPTP-VPDN-GROUP client configuration dns 198.60.22.2 198.60.22.22
vpdn group PPTP-VPDN-GROUP pptp echo 60
vpdn group PPTP-VPDN-GROUP client authentication local
vpdn username VPN1 password <snipped>
vpdn enable outside
dhcpd address 10.0.0.20-10.0.0.39 inside
dhcpd dns 198.60.22.2 198.60.22.22
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd domain clverify.com
dhcpd auto_config outside
dhcpd enable inside
username mirwin password <snipped> encrypted privilege 15
username admin password <snipped> encrypted privilege 15
username administrator password <snipped> encrypted privilege 15
terminal width 80
banner exec CLVerify Lindon Firewall
banner login CLVerify Lindon Firewall
Cryptochecksum:<snipped>
: end
===============================================

Thanks in advance!

Mark Irwin

albinoanteaterAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Les MooreSr. Systems EngineerCommented:
>access-group inside_acl in interface inside
First, remove the acl from the inside interface. It is not necessary. Everything is allowed outbound by default

Otherwise, it looks like you are simply missing applying the crypto map to the interface

add this:
  crypto map vpn_tunnel_map interface outside


Note: if you want both the Lan-Lan and the dynamic, you have to have just one crypto map:

crypto dynamic-map radius_vpn_dynamic_map 10 match address radius_vpn_acl
crypto dynamic-map radius_vpn_dynamic_map 10 set transform-set radius_set
crypto map vpn_tunnel_map 30 ipsec-isakmp
crypto map vpn_tunnel_map 30 match address largo_to_orem
crypto map vpn_tunnel_map 30 set peer <snipped>.134.99
crypto map vpn_tunnel_map 30 set transform-set strong_enc
crypto map vpn_tunnel_map 50 ipsec-isakmp
crypto map vpn_tunnel_map 50 match address largo_to_lindon
crypto map vpn_tunnel_map 50 set peer <snipped>.193.45
crypto map vpn_tunnel_map 50 set transform-set strong_enc

\\-- dynamic map must be the highest number, but the same map name
crypto map vpn_tunnel_map 6500 ipsec-isakmp dynamic radius_vpn_dynamic_map
crypto map vpn_tunnel_map client authentication radius_ad_auth

crypto map vpn_tunnel_map interface outside

>access-list inside_outbound_nat0_acl permit ip any 192.168.40.32 255.255.255.224

You also have to have all the remote sites and the vpn pool included in the nat-0 acl, and don't use "any".
Combine both your inside_outbound_nat0_acl and your nat0_acl

 no access-list inside_outbound_nat0_acl permit ip any 192.168.40.32 255.255.255.224
 access-list nat0_acl permit ip 192.168.40.0 255.255.255.0 192.168.41.0 255.255.255.0
nat (inside) 0 access-list nat0_acl




Les MooreSr. Systems EngineerCommented:
Almost missed this:

access-list radius_vpn_acl permit ip 192.168.41.0 255.255.255.0 Largo 255.255.255.0
access-list radius_vpn_acl permit ip Largo 255.255.255.0 192.168.41.0 255.255.255.0
crypto dynamic-map radius_vpn_dynamic_map 10 match address radius_vpn_acl

The radius_vpn is only dynamic and should only include your local subnet and the vpn pool:
NOTE: You cannot connect to Largo with VPN client, then cross back out through the Lan-Lan
VPN tunnel to another site. Each site will have to have the dynamic set up. If you need to access
something in largo, you must connect to largo PIX.

no access-list radius_vpn_acl
access-list radius_vpn_acl permit ip 192.168.40.0 255.255.255.0 192.168.41.0 255.255.255.0
crypto dynamic-map radius_vpn_dynamic_map 10 match address radius_vpn_acl



Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
harbor235Commented:
Post your debugs if you can:
For debugging:

debug crypto isakmp
debug crypto ipsec

FW(config)#logging console debug


Add this:
crypto dynamic-map radius_vpn_dynamic_map 50 set transform-set strong_enc, looks like you are mixing up your two
transforms.

harbor235


albinoanteaterAuthor Commented:
Hi lrmoore,
albinoanteaterAuthor Commented:
Hi lrmoore,

    I'm sorry for the late response on this. Another project came up and became the most important item of the moment :P
This was exactly what I needed. Everything is working perfectly now.


Thanks for the assistance!

Mark Irwin
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
VPN

From novice to tech pro — start learning today.