837 -> ASA5510 / PIX 501

Posted on 2006-11-16
Last Modified: 2012-06-27

I’ve been trying to around 3 days to establish a site to site VPN first from a Cisco 837 router to our new ASA5510 and when that didn’t work out, now from to a test PIX 501 6.3. The tunnel just doesn’t come up. I’ve attached the configs of both but for the life of me I cannot see where the problem is. I’ve read just about every solution there is on the site. Static IP not available form Telco here for DSL… Thank you in advance

Building configuration...
: Saved
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password NuLKvvWGg.x9HEKO encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname FW03
domain-name STG.CO.ZA
clock timezone SAST 2
fixup protocol dns maximum-length 896
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
access-list NONAT permit ip
access-list inside_access_in permit ip any any
pager lines 24
logging on
logging timestamp
logging console emergencies
logging monitor informational
icmp permit any outside
icmp permit any inside
mtu outside 1500
mtu inside 1500
ip address outside ***.***.***.***
ip address inside
ip audit name attack action drop
ip audit info action alarm
ip audit attack action alarm drop
pdm location inside
pdm location inside
pdm location inside
pdm location outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list NONAT
nat (inside) 1 0 0
access-group inside_access_in in interface inside
route outside 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http inside
http inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
service resetinbound
service resetoutside
crypto ipsec transform-set router-set esp-des esp-md5-hmac
crypto dynamic-map cisco 1 set transform-set router-set
crypto map dyn-map 10 ipsec-isakmp dynamic cisco
crypto map dyn-map interface outside
isakmp enable outside
isakmp key ******** address netmask no-xauth
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 1
isakmp policy 10 lifetime 86400
telnet timeout 20
ssh timeout 5
console timeout 30
terminal width 80
: end

Building configuration...

Current configuration : 2512 bytes
version 12.4
no service pad
service timestamps debug uptime
service timestamps log uptime
service password-encryption
no service dhcp
hostname DZM
enable secret 5 $1$WK1U$xSrnkiADVftmt9faBa1r3.
enable password 7 142713181F1325392079
no aaa new-model
resource policy
no ip source-route
ip cef
no ip domain lookup
ip domain name local
no ip bootp server
crypto isakmp policy 1
 hash md5
 authentication pre-share
crypto isakmp key cisco123 address ***.***.***.***
crypto ipsec transform-set pix-set esp-des esp-md5-hmac
crypto map pix 10 ipsec-isakmp
 set peer ***.***.***.***
 set transform-set pix-set
 match address 101
interface Ethernet0
 description ETH0
 ip address
 ip nat inside
 ip virtual-reassembly
 ip tcp adjust-mss 1452
 hold-queue 100 out
interface Ethernet2
 no ip address
 hold-queue 100 out
interface ATM0
 no ip address
 atm vc-per-vp 64
 no atm ilmi-keepalive
 dsl operating-mode auto
 pvc 8/35
  pppoe-client dial-pool-number 1
interface FastEthernet1
 duplex auto
 speed auto
interface FastEthernet2
 duplex auto
 speed auto
interface FastEthernet3
 duplex auto
 speed auto
interface FastEthernet4
 duplex auto
 speed auto
interface Virtual-PPP1
 no ip address
interface Dialer0
 bandwidth 640
 ip address negotiated
 no ip redirects
 no ip unreachables
 ip mtu 1492
 ip nat outside
 ip virtual-reassembly
 encapsulation ppp
 no ip route-cache cef
 no ip route-cache
 no ip mroute-cache
 dialer pool 1
 dialer remote-name redback
 dialer-group 1
 no cdp enable
 ppp pap sent-username password 7 051A141B28
 ppp ipcp dns request
 crypto map pix
interface Dialer1
 no ip address
ip route Dialer0
no ip http server
no ip http secure-server
ip nat inside source route-map nonat interface Dialer0 overload
access-list 101 permit ip
access-list 102 permit ip any
access-list 110 deny   ip
access-list 110 permit ip any
dialer-list 1 protocol ip permit
route-map nonat permit 10
 match ip address 110
line con 0
 exec-timeout 120 0
 no modem enable
 stopbits 1
line aux 0
line vty 0 4
 access-class 2 in
 exec-timeout 120 0
 login local
 length 0
 transport input telnet ssh
 transport output none
scheduler max-task-time 5000

Question by:savannahmicro
  • 2
LVL 79

Expert Comment

ID: 17961804
Does your ASA end have a static IP?
Can you post your ASA config, too?
It should be a piece of cake to support the 501 / ASA link.

Author Comment

ID: 17962498
It does, but I gave up on that and decided to try and get the VPN working between the 837 DSL router first and then try it again on the ASA. It should really be simple this, but the router just does nothing.
LVL 79

Accepted Solution

lrmoore earned 500 total points
ID: 18107903
Are you still working on this? Can you close out this question before the cleanup crew gets around to it?

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Separating Default Gateway from VPN 2 52
l2tp tunnel from pc to router 14 96
ASA - RV130 VPN tunnel, cannot pass traffic 8 80
SSIS with VPN COnnection 2 102
For a while, I have wanted to connect my HTC Incredible to my corporate network to take advantage of the phone's powerful capabilities. I searched online and came up with varied answers from "it won't work" to super complicated statements that I did…
OpenVPN is a great open source VPN server that is capable of providing quick and easy VPN access to your network on the cheap.  By default the software is configured to allow open access to your network.  But what if you want to restrict users to on…
After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…

830 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question