Solved

837 -> ASA5510 / PIX 501

Posted on 2006-11-16
3
520 Views
Last Modified: 2012-06-27
Hello,

I’ve been trying to around 3 days to establish a site to site VPN first from a Cisco 837 router to our new ASA5510 and when that didn’t work out, now from to a test PIX 501 6.3. The tunnel just doesn’t come up. I’ve attached the configs of both but for the life of me I cannot see where the problem is. I’ve read just about every solution there is on the site. Static IP not available form Telco here for DSL… Thank you in advance

Building configuration...
: Saved
:
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password NuLKvvWGg.x9HEKO encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname FW03
domain-name STG.CO.ZA
clock timezone SAST 2
fixup protocol dns maximum-length 896
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list NONAT permit ip 192.99.99.0 255.255.255.0 192.168.0.0 255.255.255.0
access-list inside_access_in permit ip any any
pager lines 24
logging on
logging timestamp
logging console emergencies
logging monitor informational
icmp permit any outside
icmp permit any inside
mtu outside 1500
mtu inside 1500
ip address outside ***.***.***.*** 255.255.255.248
ip address inside 192.99.99.96 255.255.255.0
ip audit name cosira.co.za attack action drop
ip audit info action alarm
ip audit attack action alarm drop
pdm location 192.99.99.0 255.255.255.0 inside
pdm location 192.99.99.0 255.255.255.255 inside
pdm location 192.99.99.155 255.255.255.255 inside
pdm location 192.168.0.0 255.255.255.0 outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list NONAT
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 196.37.171.233 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 192.99.99.0 255.255.255.255 inside
http 192.99.99.155 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
service resetinbound
service resetoutside
crypto ipsec transform-set router-set esp-des esp-md5-hmac
crypto dynamic-map cisco 1 set transform-set router-set
crypto map dyn-map 10 ipsec-isakmp dynamic cisco
crypto map dyn-map interface outside
isakmp enable outside
isakmp key ******** address 0.0.0.0 netmask 0.0.0.0 no-xauth
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 1
isakmp policy 10 lifetime 86400
telnet timeout 20
ssh timeout 5
console timeout 30
terminal width 80
Cryptochecksum:4faf1615f2579b29b7ff7d6481e12d38
: end
[OK]


Building configuration...

Current configuration : 2512 bytes
!
version 12.4
no service pad
service timestamps debug uptime
service timestamps log uptime
service password-encryption
no service dhcp
!
hostname DZM
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$WK1U$xSrnkiADVftmt9faBa1r3.
enable password 7 142713181F1325392079
!
no aaa new-model
!
resource policy
!
no ip source-route
!
!
ip cef
no ip domain lookup
ip domain name local
no ip bootp server
!
!
!
!
!
!
crypto isakmp policy 1
 hash md5
 authentication pre-share
crypto isakmp key cisco123 address ***.***.***.***
!
!
crypto ipsec transform-set pix-set esp-des esp-md5-hmac
!
crypto map pix 10 ipsec-isakmp
 set peer ***.***.***.***
 set transform-set pix-set
 match address 101
!
!
!
interface Ethernet0
 description ETH0
 ip address 192.168.0.100 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 ip tcp adjust-mss 1452
 hold-queue 100 out
!
interface Ethernet2
 no ip address
 shutdown
 hold-queue 100 out
!
interface ATM0
 no ip address
 atm vc-per-vp 64
 no atm ilmi-keepalive
 dsl operating-mode auto
 pvc 8/35
  pppoe-client dial-pool-number 1
 !
!
interface FastEthernet1
 duplex auto
 speed auto
!
interface FastEthernet2
 duplex auto
 speed auto
!
interface FastEthernet3
 duplex auto
 speed auto
!
interface FastEthernet4
 duplex auto
 speed auto
!
interface Virtual-PPP1
 no ip address
 shutdown
!
interface Dialer0
 bandwidth 640
 ip address negotiated
 no ip redirects
 no ip unreachables
 ip mtu 1492
 ip nat outside
 ip virtual-reassembly
 encapsulation ppp
 no ip route-cache cef
 no ip route-cache
 no ip mroute-cache
 dialer pool 1
 dialer remote-name redback
 dialer-group 1
 no cdp enable
 ppp pap sent-username online509526@dsl512telkomsa.net password 7 051A141B28
071D
 ppp ipcp dns request
 crypto map pix
!
interface Dialer1
 no ip address
!
ip route 0.0.0.0 0.0.0.0 Dialer0
no ip http server
no ip http secure-server
!
ip nat inside source route-map nonat interface Dialer0 overload
!
access-list 101 permit ip 192.168.0.0 0.0.0.255 192.99.99.0 0.0.0.255
access-list 102 permit ip 192.168.0.0 0.0.0.255 any
access-list 110 deny   ip 192.168.0.0 0.0.0.255 192.99.99.0 0.0.0.255
access-list 110 permit ip 192.168.0.0 0.0.0.255 any
dialer-list 1 protocol ip permit
route-map nonat permit 10
 match ip address 110
!
!
control-plane
!
!
line con 0
 exec-timeout 120 0
 no modem enable
 stopbits 1
line aux 0
line vty 0 4
 access-class 2 in
 exec-timeout 120 0
 login local
 length 0
 transport input telnet ssh
 transport output none
!
scheduler max-task-time 5000
end

0
Comment
Question by:savannahmicro
  • 2
3 Comments
 
LVL 79

Expert Comment

by:lrmoore
ID: 17961804
Does your ASA end have a static IP?
Can you post your ASA config, too?
It should be a piece of cake to support the 501 / ASA link.
0
 

Author Comment

by:savannahmicro
ID: 17962498
It does, but I gave up on that and decided to try and get the VPN working between the 837 DSL router first and then try it again on the ASA. It should really be simple this, but the router just does nothing.
0
 
LVL 79

Accepted Solution

by:
lrmoore earned 500 total points
ID: 18107903
Are you still working on this? Can you close out this question before the cleanup crew gets around to it?
Thanks!
0

Featured Post

Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

Like many others, when I created a Windows 2008 RRAS VPN server, I connected via PPTP, and still do, but there are problems that can arise from solely using PPTP.  One particular problem was that the CFO of the company used a Virgin Broadband Wirele…
Secure VPN Connection terminated locally by the Client.  Reason 442: Failed to enable Virtual Adapter. If you receive this error on Windows 8 or Windows 8.1 while trying to connect with the Cisco VPN Client then the solution is a simple registry f…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now