837 -> ASA5510 / PIX 501


I’ve been trying to around 3 days to establish a site to site VPN first from a Cisco 837 router to our new ASA5510 and when that didn’t work out, now from to a test PIX 501 6.3. The tunnel just doesn’t come up. I’ve attached the configs of both but for the life of me I cannot see where the problem is. I’ve read just about every solution there is on the site. Static IP not available form Telco here for DSL… Thank you in advance

Building configuration...
: Saved
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password NuLKvvWGg.x9HEKO encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname FW03
domain-name STG.CO.ZA
clock timezone SAST 2
fixup protocol dns maximum-length 896
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
access-list NONAT permit ip
access-list inside_access_in permit ip any any
pager lines 24
logging on
logging timestamp
logging console emergencies
logging monitor informational
icmp permit any outside
icmp permit any inside
mtu outside 1500
mtu inside 1500
ip address outside ***.***.***.***
ip address inside
ip audit name cosira.co.za attack action drop
ip audit info action alarm
ip audit attack action alarm drop
pdm location inside
pdm location inside
pdm location inside
pdm location outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list NONAT
nat (inside) 1 0 0
access-group inside_access_in in interface inside
route outside 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http inside
http inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
service resetinbound
service resetoutside
crypto ipsec transform-set router-set esp-des esp-md5-hmac
crypto dynamic-map cisco 1 set transform-set router-set
crypto map dyn-map 10 ipsec-isakmp dynamic cisco
crypto map dyn-map interface outside
isakmp enable outside
isakmp key ******** address netmask no-xauth
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 1
isakmp policy 10 lifetime 86400
telnet timeout 20
ssh timeout 5
console timeout 30
terminal width 80
: end

Building configuration...

Current configuration : 2512 bytes
version 12.4
no service pad
service timestamps debug uptime
service timestamps log uptime
service password-encryption
no service dhcp
hostname DZM
enable secret 5 $1$WK1U$xSrnkiADVftmt9faBa1r3.
enable password 7 142713181F1325392079
no aaa new-model
resource policy
no ip source-route
ip cef
no ip domain lookup
ip domain name local
no ip bootp server
crypto isakmp policy 1
 hash md5
 authentication pre-share
crypto isakmp key cisco123 address ***.***.***.***
crypto ipsec transform-set pix-set esp-des esp-md5-hmac
crypto map pix 10 ipsec-isakmp
 set peer ***.***.***.***
 set transform-set pix-set
 match address 101
interface Ethernet0
 description ETH0
 ip address
 ip nat inside
 ip virtual-reassembly
 ip tcp adjust-mss 1452
 hold-queue 100 out
interface Ethernet2
 no ip address
 hold-queue 100 out
interface ATM0
 no ip address
 atm vc-per-vp 64
 no atm ilmi-keepalive
 dsl operating-mode auto
 pvc 8/35
  pppoe-client dial-pool-number 1
interface FastEthernet1
 duplex auto
 speed auto
interface FastEthernet2
 duplex auto
 speed auto
interface FastEthernet3
 duplex auto
 speed auto
interface FastEthernet4
 duplex auto
 speed auto
interface Virtual-PPP1
 no ip address
interface Dialer0
 bandwidth 640
 ip address negotiated
 no ip redirects
 no ip unreachables
 ip mtu 1492
 ip nat outside
 ip virtual-reassembly
 encapsulation ppp
 no ip route-cache cef
 no ip route-cache
 no ip mroute-cache
 dialer pool 1
 dialer remote-name redback
 dialer-group 1
 no cdp enable
 ppp pap sent-username online509526@dsl512telkomsa.net password 7 051A141B28
 ppp ipcp dns request
 crypto map pix
interface Dialer1
 no ip address
ip route Dialer0
no ip http server
no ip http secure-server
ip nat inside source route-map nonat interface Dialer0 overload
access-list 101 permit ip
access-list 102 permit ip any
access-list 110 deny   ip
access-list 110 permit ip any
dialer-list 1 protocol ip permit
route-map nonat permit 10
 match ip address 110
line con 0
 exec-timeout 120 0
 no modem enable
 stopbits 1
line aux 0
line vty 0 4
 access-class 2 in
 exec-timeout 120 0
 login local
 length 0
 transport input telnet ssh
 transport output none
scheduler max-task-time 5000

Who is Participating?
lrmooreConnect With a Mentor Commented:
Are you still working on this? Can you close out this question before the cleanup crew gets around to it?
Does your ASA end have a static IP?
Can you post your ASA config, too?
It should be a piece of cake to support the 501 / ASA link.
savannahmicroAuthor Commented:
It does, but I gave up on that and decided to try and get the VPN working between the 837 DSL router first and then try it again on the ASA. It should really be simple this, but the router just does nothing.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.