Solved

pix crypto ipsec or vpn not working for a subnet

Posted on 2008-10-15
8
1,280 Views
Last Modified: 2012-08-13
1 have 2 pix(pix a & pix b), each on separate site(site y & z)
on site y pix a has 2 subnets, 192.168.1.0/24 is connected directly and 192.168.166.0/24 via a gateway at 192.168.1.111
from pix a, i can ping to all hosts in 192.168.1.0/24 & 192.168.166.0/24
on site z, pix b has 1 subnet, 192.168.150.0/24
site-site vpn is configured the same on both pix
below is the output from "sh crypto ipsec sa" from pix a on site y
as you can see nothing is encrypt/decrypt for 192.168.166.0/24
just to verify, on site y i can only ping to host in site z 192.168.150.0 from 192.168.1.0/24 and vice versa
but i cant ping any host in 192.168.150.0 from 192.168.166.0/24
any idea why?



pixfirewall# sh crypto ipsec sa

 

 

interface: outside

    Crypto map tag: outside_map, local addr. 110.16.39.2

 

   local  ident (addr/mask/prot/port): (192.168.166.0/255.255.255.0/0/0)

   remote ident (addr/mask/prot/port): (192.168.150.0/255.255.255.0/0/0)

   current_peer: KLPIX:0

     PERMIT, flags={origin_is_acl,}

    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0

    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0

    #pkts compressed: 0, #pkts decompressed: 0

    #pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0

    #send errors 0, #recv errors 0

 

     local crypto endpt.: 110.16.39.2, remote crypto endpt.: KLPIX

     path mtu 1500, ipsec overhead 0, media mtu 1500

     current outbound spi: 0

 

     inbound esp sas:

 

 

     inbound ah sas:

 

 

     inbound pcp sas:

 

 

     outbound esp sas:

 

 

     outbound ah sas:

 

 

     outbound pcp sas:

 

 

 

   local  ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)

   remote ident (addr/mask/prot/port): (192.168.150.0/255.255.255.0/0/0)

   current_peer: KLPIX:500

     PERMIT, flags={origin_is_acl,}

    #pkts encaps: 8808, #pkts encrypt: 8808, #pkts digest 8808

    #pkts decaps: 8619, #pkts decrypt: 8629, #pkts verify 8629

    #pkts compressed: 0, #pkts decompressed: 0

    #pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0

    #send errors 0, #recv errors 0

 

     local crypto endpt.: 110.16.39.2, remote crypto endpt.: KLPIX

     path mtu 1500, ipsec overhead 56, media mtu 1500

     current outbound spi: 2c4852d8

 

     inbound esp sas:

      spi: 0x2369b5e4(594130404)

        transform: esp-3des esp-md5-hmac ,

        in use settings ={Tunnel, }

        slot: 0, conn id: 1, crypto map: outside_map

        sa timing: remaining key lifetime (k/sec): (4605691/25070)

        IV size: 8 bytes

        replay detection support: Y

 

 

     inbound ah sas:

 

 

     inbound pcp sas:

 

 

     outbound esp sas:

      spi: 0x2c4852d8(742937304)

        transform: esp-3des esp-md5-hmac ,

        in use settings ={Tunnel, }

        slot: 0, conn id: 2, crypto map: outside_map

        sa timing: remaining key lifetime (k/sec): (4607321/25070)

        IV size: 8 bytes

        replay detection support: Y

 

 

     outbound ah sas:

 

 

     outbound pcp sas:

Open in new window

0
Comment
Question by:ryder0707
  • 5
  • 3
8 Comments
 
LVL 79

Expert Comment

by:lrmoore
ID: 22727909
Can't tell much without seeing both configs.

>via a gateway at 192.168.1.111
Does this router have a default pointing to the PIX, or any overlapping routes pointing 192.168.150.0 someplace else? perhaps with a supernet mask, i.e. route 192.168.0.0 255.255.0.0 --> someplace else

0
 
LVL 24

Author Comment

by:ryder0707
ID: 22727970
from pix a

pixfirewall# sh run
: Saved
:
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password .HXY4T2VixJHxciC encrypted
passwd wJ8x5XK/QBYJ8yTP encrypted
hostname pixfirewall
domain-name robxusevanscd.com
clock timezone CST 8
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 221.54.169.2 KLPIX
name 192.168.166.0 test
access-list inside_access_in permit ip 192.168.1.0 255.255.255.0 any
access-list inside_access_in permit ip host 192.168.1.5 any
access-list outside_access_in permit tcp any host 110.16.39.3 eq pcanywhere-data
access-list outside_access_in permit tcp any host 110.16.39.3 eq 3389
access-list outside_access_in permit udp any host 110.16.39.3 eq pcanywhere-statu
s
access-list outside_access_in permit tcp any host 110.16.39.3 eq smtp
access-list outside_access_in permit tcp any host 110.16.39.3 eq www
access-list outside_access_in permit tcp any host 110.16.39.3 eq https
access-list outside_access_in permit tcp any host 110.16.39.3 eq 1688
access-list robxus1_splitTunnelAcl permit ip 192.168.1.0 255.255.255.0 any
access-list inside_outbound_nat0_acl permit ip any 192.168.101.0 255.255.255.248

access-list inside_outbound_nat0_acl permit ip 192.168.1.0 255.255.255.0 192.168
.150.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip test 255.255.255.0 192.168.150.0
255.255.255.0
access-list outside_cryptomap_dyn_20 permit ip any 192.168.101.0 255.255.255.248

access-list outside_cryptomap_20 permit ip 192.168.1.0 255.255.255.0 192.168.150
.0 255.255.255.0
access-list outside_cryptomap_20 permit ip test 255.255.255.0 192.168.150.0 255.
255.255.0
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 110.16.39.2 255.255.255.240
ip address inside 192.168.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool robxus 192.168.101.1-192.168.101.5
pdm location 192.168.1.5 255.255.255.255 inside
pdm location 221.54.169.0 255.255.255.0 outside
pdm location 192.168.101.0 255.255.255.248 inside
pdm location 192.168.150.0 255.255.255.0 outside
pdm location 192.168.150.1 255.255.255.255 inside
pdm location 192.168.1.2 255.255.255.255 inside
pdm location 218.104.216.0 255.255.255.0 outside
pdm location test 255.255.255.0 inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) 110.16.39.3 192.168.1.5 netmask 255.255.255.255 0 0
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 110.16.39.1 1
route inside test 255.255.255.0 192.168.1.111 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 192.168.101.0 255.255.255.248 inside
http 192.168.1.1 255.255.255.255 inside
http 192.168.1.2 255.255.255.255 inside
http 192.168.1.5 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 20 ipsec-isakmp
crypto map outside_map 20 match address outside_cryptomap_20
crypto map outside_map 20 set peer KLPIX
crypto map outside_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
isakmp enable outside
isakmp key ******** address KLPIX netmask 255.255.255.255 no-xauth no-config-mod
e
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup robxus1 address-pool robxus
vpngroup robxus1 dns-server 192.168.1.5 221.10.251.191
vpngroup robxus1 wins-server 192.168.1.5
vpngroup robxus1 split-tunnel robxus1_splitTunnelAcl
vpngroup robxus1 idle-time 1800
vpngroup robxus1 password ********
telnet 0.0.0.0 0.0.0.0 outside
telnet 0.0.0.0 0.0.0.0 inside
telnet timeout 15
ssh 221.54.169.0 255.255.255.0 outside
ssh 218.104.216.0 255.255.255.0 outside
ssh timeout 10
console timeout 0
dhcpd address 192.168.1.50-192.168.1.254 inside
dhcpd dns 192.168.1.5 221.10.251.196
dhcpd wins 192.168.1.5
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd domain robxusevanscd.com
dhcpd auto_config outside
dhcpd enable inside
terminal width 80
Cryptochecksum:dcd44f9e553052b062791755105fef88
: end
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 22728032
I don't see anything wrong with this config.

If the other side has mirror image acls for nat_0 and crypto map then it comes down to routing.
0
 
LVL 24

Author Comment

by:ryder0707
ID: 22728057
this is from pix b

: Saved
: Written by enable_15 at 11:54:04.076 MYT Thu Oct 16 2008
!
PIX Version 7.2(4)
!
hostname pixfirewall
domain-name ciscopix.com
enable password Z4XZfE8U0nFs9RAV encrypted
passwd wJ8x5XK/QBYJ8yTP encrypted
names
name 192.168.3.0 Cyprus
name 192.168.14.0 London2
name 192.168.162.0 CapeTown
name 192.168.222.0 vpnnet
name 192.168.100.0 Sydney
name 192.168.200.0 Melbourne
name 192.168.1.0 cdnet

dns-guard
!
interface Ethernet0
 description Primary Internet via TIME 6Mbps leased
 nameif outside
 security-level 0
 ip address 221.54.169.2 255.255.255.0
!
interface Ethernet1
 speed 100
 duplex full
 nameif inside
 security-level 100
 ip address 192.168.150.10 255.255.255.0
!
interface Ethernet2
 description Backup Internet via TM 1.5Mbps ADSL
 nameif Backup
 security-level 0
 ip address 66.49.18.121 255.255.255.248
!
boot system flash:/image.bin
ftp mode passive
clock timezone MYT 8
dns server-group DefaultDNS
 domain-name ciscopix.com
object-group service Video tcp
 port-object range 5555 5587
object-group service Audio udp
 port-object range 2326 2387
object-group service Ironport tcp
 port-object eq ssh
 port-object eq https
 port-object eq 83
 port-object eq smtp
object-group service RDP tcp
 description Remote desktop protocol/Terminal Service for Windows
 port-object eq 3389
access-list inside_access_in extended permit ip 192.168.150.0 255.255.255.0 any
access-list inside_access_in extended permit udp 192.168.150.0 255.255.255.0 any
access-list inside_access_in extended permit tcp 192.168.150.0 255.255.255.0 any
access-list inside_access_in extended permit ip 192.168.151.0 255.255.255.0 any
access-list inside_access_in extended permit udp 192.168.151.0 255.255.255.0 any
access-list inside_access_in extended permit tcp 192.168.151.0 255.255.255.0 any
access-list inside_access_in extended permit tcp 192.168.101.0 255.255.255.0 any
access-list inside_access_in extended permit udp 192.168.101.0 255.255.255.0 any
access-list inside_access_in extended permit ip 192.168.101.0 255.255.255.0 any
access-list inside_outbound_nat0_acl extended permit ip 192.168.150.0 255.255.255.0 cdnet 255.255.255.0
access-list inside_outbound_nat0_acl extended permit ip 192.168.150.0 255.255.255.0 192.168.166.0 255.255.255.0
access-list outside_cryptomap_dyn_20 extended permit ip any 192.168.101.0 255.255.255.248
access-list outside_cryptomap_dyn_40 extended permit ip any 192.168.101.0 255.255.255.248
access-list outside_cryptomap_100 extended permit ip 192.168.150.0 255.255.255.0 cdnet 255.255.255.0
access-list outside_cryptomap_100 remark test for cdnet
access-list outside_cryptomap_100 extended permit ip 192.168.150.0 255.255.255.0 192.168.166.0 255.255.255.0
access-list mevpnxs_splitTunnelAcl standard permit any
access-list outside_1_cryptomap extended permit ip 192.168.150.0 255.255.255.0 CapeTown 255.255.255.0
pager lines 24
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu Backup 1500
ip local pool robxus 192.168.101.1-192.168.101.5
icmp unreachable rate-limit 1 burst-size 1
arp timeout 14400
nat-control
global (outside) 1 interface
global (Backup) 1 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 212.24.16.11 1 track 1
route inside 192.168.101.0 255.255.255.0 192.168.150.3 1
route inside 192.168.151.0 255.255.255.0 192.168.150.3 1
route inside 192.168.153.0 255.255.255.0 192.168.150.3 1
route inside vpnnet 255.255.255.0 192.168.150.3 1
route Backup 0.0.0.0 0.0.0.0 60.49.189.121 200
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server MEKL protocol tacacs+
aaa-server MEKL (inside) host 192.168.150.2
 timeout 5
 key xxxxxxx
http server enable
http 0.0.0.0 0.0.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
snmp-server enable traps snmp authentication linkup linkdown coldstart
auth-prompt prompt Welcome
sla monitor 123
 type echo protocol ipIcmpEcho 208.67.222.222 interface outside
 num-packets 3
 frequency 15
sla monitor schedule 123 life forever start-time now
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 40 match address outside_cryptomap_dyn_40
crypto dynamic-map outside_dyn_map 40 set transform-set ESP-3DES-MD5
crypto dynamic-map outside_dyn_map 60 set pfs group1
crypto dynamic-map outside_dyn_map 60 set transform-set ESP-3DES-SHA

crypto map outside_map 100 match address outside_cryptomap_100
crypto map outside_map 100 set peer 119.6.39.2
crypto map outside_map 100 set transform-set ESP-3DES-MD5

crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp identity hostname
crypto isakmp enable outside
crypto isakmp policy 20
 authentication pre-share
 encryption 3des
 hash md5
 group 2
 lifetime 86400
crypto isakmp policy 40
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
crypto isakmp policy 60
 authentication pre-share
 encryption des
 hash md5
 group 2
 lifetime 86400
crypto isakmp policy 65535
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
!
track 1 rtr 123 reachability
telnet 192.168.150.0 255.255.255.0 inside
telnet timeout 10
ssh timeout 15
console timeout 0
group-policy mevpnxs internal
group-policy mevpnxs attributes
 wins-server value 192.168.150.14 192.168.152.254
 dns-server value 192.168.150.14 192.168.152.254
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value mevpnxs_splitTunnelAcl
 default-domain value ap.sheraton.com
group-policy robxusvpn internal
group-policy robxusvpn attributes
 wins-server value 192.168.150.14
 dns-server value 192.168.150.14
 vpn-idle-timeout 30
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value robxusvpn_splitTunnelAcl
 default-domain value ap.sheraton.com
username robertn password 35ebXJ6HwYXzEsJi encrypted privilege 15
tunnel-group 119.6.39.2 type ipsec-l2l
tunnel-group 119.6.39.2 ipsec-attributes
 pre-shared-key xxxxxxxxx

!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns migrated_dns_map_1
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns migrated_dns_map_1
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect http
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny
  inspect sqlnet
  inspect sunrpc
  inspect sip
  inspect xdmcp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:53a443b7023df9fc8ce03dba099053c5
: end
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 
LVL 24

Author Comment

by:ryder0707
ID: 22728686
you are right now i also suspect routing problem, i traced this using ethereal
i tried ping from 192.168.150.0/24 the encrypted packet from pix b decrypted at pix a and routed to 192.168.166.0/24
but the ping reply never return back properly
i wonder where it goes :(
0
 
LVL 24

Accepted Solution

by:
ryder0707 earned 0 total points
ID: 22729055
i found the solution, actually it is not routing problem
but because of this access-list access-list inside_access_in permit ip 192.168.1.0 255.255.255.0 any
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 22730447
Good catch... sorry I missed that the first time.

0
 
LVL 24

Author Comment

by:ryder0707
ID: 22737401
thanks for your help...as usual :)
0

Featured Post

Enabling OSINT in Activity Based Intelligence

Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

Join & Write a Comment

Hi All,  Recently I have installed and configured a Sonicwall NS220 in the network as a firewall and Internet access gateway. All was working fine until users started reporting that they cannot use the Cisco VPN client to connect to the customer'…
This article offers some helpful and general tips for safe browsing and online shopping. It offers simple and manageable procedures that help to ensure the safety of one's personal information and the security of any devices.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now