pix crypto ipsec or vpn not working for a subnet
1 have 2 pix(pix a & pix b), each on separate site(site y & z)
on site y pix a has 2 subnets, 192.168.1.0/24 is connected directly and 192.168.166.0/24 via a gateway at 192.168.1.111
from pix a, i can ping to all hosts in 192.168.1.0/24 & 192.168.166.0/24
on site z, pix b has 1 subnet, 192.168.150.0/24
site-site vpn is configured the same on both pix
below is the output from "sh crypto ipsec sa" from pix a on site y
as you can see nothing is encrypt/decrypt for 192.168.166.0/24
just to verify, on site y i can only ping to host in site z 192.168.150.0 from 192.168.1.0/24 and vice versa
but i cant ping any host in 192.168.150.0 from 192.168.166.0/24
any idea why?
on site y pix a has 2 subnets, 192.168.1.0/24 is connected directly and 192.168.166.0/24 via a gateway at 192.168.1.111
from pix a, i can ping to all hosts in 192.168.1.0/24 & 192.168.166.0/24
on site z, pix b has 1 subnet, 192.168.150.0/24
site-site vpn is configured the same on both pix
below is the output from "sh crypto ipsec sa" from pix a on site y
as you can see nothing is encrypt/decrypt for 192.168.166.0/24
just to verify, on site y i can only ping to host in site z 192.168.150.0 from 192.168.1.0/24 and vice versa
but i cant ping any host in 192.168.150.0 from 192.168.166.0/24
any idea why?
pixfirewall# sh crypto ipsec sa
interface: outside
Crypto map tag: outside_map, local addr. 110.16.39.2
local ident (addr/mask/prot/port): (192.168.166.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.150.0/255.255.255.0/0/0)
current_peer: KLPIX:0
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 110.16.39.2, remote crypto endpt.: KLPIX
path mtu 1500, ipsec overhead 0, media mtu 1500
current outbound spi: 0
inbound esp sas:
inbound ah sas:
inbound pcp sas:
outbound esp sas:
outbound ah sas:
outbound pcp sas:
local ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.150.0/255.255.255.0/0/0)
current_peer: KLPIX:500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 8808, #pkts encrypt: 8808, #pkts digest 8808
#pkts decaps: 8619, #pkts decrypt: 8629, #pkts verify 8629
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 110.16.39.2, remote crypto endpt.: KLPIX
path mtu 1500, ipsec overhead 56, media mtu 1500
current outbound spi: 2c4852d8
inbound esp sas:
spi: 0x2369b5e4(594130404)
transform: esp-3des esp-md5-hmac ,
in use settings ={Tunnel, }
slot: 0, conn id: 1, crypto map: outside_map
sa timing: remaining key lifetime (k/sec): (4605691/25070)
IV size: 8 bytes
replay detection support: Y
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0x2c4852d8(742937304)
transform: esp-3des esp-md5-hmac ,
in use settings ={Tunnel, }
slot: 0, conn id: 2, crypto map: outside_map
sa timing: remaining key lifetime (k/sec): (4607321/25070)
IV size: 8 bytes
replay detection support: Y
outbound ah sas:
outbound pcp sas:ASKER
from pix a
pixfirewall# sh run
: Saved
:
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password .HXY4T2VixJHxciC encrypted
passwd wJ8x5XK/QBYJ8yTP encrypted
hostname pixfirewall
domain-name robxusevanscd.com
clock timezone CST 8
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 221.54.169.2 KLPIX
name 192.168.166.0 test
access-list inside_access_in permit ip 192.168.1.0 255.255.255.0 any
access-list inside_access_in permit ip host 192.168.1.5 any
access-list outside_access_in permit tcp any host 110.16.39.3 eq pcanywhere-data
access-list outside_access_in permit tcp any host 110.16.39.3 eq 3389
access-list outside_access_in permit udp any host 110.16.39.3 eq pcanywhere-statu
s
access-list outside_access_in permit tcp any host 110.16.39.3 eq smtp
access-list outside_access_in permit tcp any host 110.16.39.3 eq www
access-list outside_access_in permit tcp any host 110.16.39.3 eq https
access-list outside_access_in permit tcp any host 110.16.39.3 eq 1688
access-list robxus1_splitTunnelAcl permit ip 192.168.1.0 255.255.255.0 any
access-list inside_outbound_nat0_acl permit ip any 192.168.101.0 255.255.255.248
access-list inside_outbound_nat0_acl permit ip 192.168.1.0 255.255.255.0 192.168
.150.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip test 255.255.255.0 192.168.150.0
255.255.255.0
access-list outside_cryptomap_dyn_20 permit ip any 192.168.101.0 255.255.255.248
access-list outside_cryptomap_20 permit ip 192.168.1.0 255.255.255.0 192.168.150
.0 255.255.255.0
access-list outside_cryptomap_20 permit ip test 255.255.255.0 192.168.150.0 255.
255.255.0
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 110.16.39.2 255.255.255.240
ip address inside 192.168.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool robxus 192.168.101.1-192.168.101.
pdm location 192.168.1.5 255.255.255.255 inside
pdm location 221.54.169.0 255.255.255.0 outside
pdm location 192.168.101.0 255.255.255.248 inside
pdm location 192.168.150.0 255.255.255.0 outside
pdm location 192.168.150.1 255.255.255.255 inside
pdm location 192.168.1.2 255.255.255.255 inside
pdm location 218.104.216.0 255.255.255.0 outside
pdm location test 255.255.255.0 inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) 110.16.39.3 192.168.1.5 netmask 255.255.255.255 0 0
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 110.16.39.1 1
route inside test 255.255.255.0 192.168.1.111 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 192.168.101.0 255.255.255.248 inside
http 192.168.1.1 255.255.255.255 inside
http 192.168.1.2 255.255.255.255 inside
http 192.168.1.5 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 20 ipsec-isakmp
crypto map outside_map 20 match address outside_cryptomap_20
crypto map outside_map 20 set peer KLPIX
crypto map outside_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
isakmp enable outside
isakmp key ******** address KLPIX netmask 255.255.255.255 no-xauth no-config-mod
e
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup robxus1 address-pool robxus
vpngroup robxus1 dns-server 192.168.1.5 221.10.251.191
vpngroup robxus1 wins-server 192.168.1.5
vpngroup robxus1 split-tunnel robxus1_splitTunnelAcl
vpngroup robxus1 idle-time 1800
vpngroup robxus1 password ********
telnet 0.0.0.0 0.0.0.0 outside
telnet 0.0.0.0 0.0.0.0 inside
telnet timeout 15
ssh 221.54.169.0 255.255.255.0 outside
ssh 218.104.216.0 255.255.255.0 outside
ssh timeout 10
console timeout 0
dhcpd address 192.168.1.50-192.168.1.254
dhcpd dns 192.168.1.5 221.10.251.196
dhcpd wins 192.168.1.5
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd domain robxusevanscd.com
dhcpd auto_config outside
dhcpd enable inside
terminal width 80
Cryptochecksum:dcd44f9e553
: end
pixfirewall# sh run
: Saved
:
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password .HXY4T2VixJHxciC encrypted
passwd wJ8x5XK/QBYJ8yTP encrypted
hostname pixfirewall
domain-name robxusevanscd.com
clock timezone CST 8
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 221.54.169.2 KLPIX
name 192.168.166.0 test
access-list inside_access_in permit ip 192.168.1.0 255.255.255.0 any
access-list inside_access_in permit ip host 192.168.1.5 any
access-list outside_access_in permit tcp any host 110.16.39.3 eq pcanywhere-data
access-list outside_access_in permit tcp any host 110.16.39.3 eq 3389
access-list outside_access_in permit udp any host 110.16.39.3 eq pcanywhere-statu
s
access-list outside_access_in permit tcp any host 110.16.39.3 eq smtp
access-list outside_access_in permit tcp any host 110.16.39.3 eq www
access-list outside_access_in permit tcp any host 110.16.39.3 eq https
access-list outside_access_in permit tcp any host 110.16.39.3 eq 1688
access-list robxus1_splitTunnelAcl permit ip 192.168.1.0 255.255.255.0 any
access-list inside_outbound_nat0_acl permit ip any 192.168.101.0 255.255.255.248
access-list inside_outbound_nat0_acl permit ip 192.168.1.0 255.255.255.0 192.168
.150.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip test 255.255.255.0 192.168.150.0
255.255.255.0
access-list outside_cryptomap_dyn_20 permit ip any 192.168.101.0 255.255.255.248
access-list outside_cryptomap_20 permit ip 192.168.1.0 255.255.255.0 192.168.150
.0 255.255.255.0
access-list outside_cryptomap_20 permit ip test 255.255.255.0 192.168.150.0 255.
255.255.0
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 110.16.39.2 255.255.255.240
ip address inside 192.168.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool robxus 192.168.101.1-192.168.101.
pdm location 192.168.1.5 255.255.255.255 inside
pdm location 221.54.169.0 255.255.255.0 outside
pdm location 192.168.101.0 255.255.255.248 inside
pdm location 192.168.150.0 255.255.255.0 outside
pdm location 192.168.150.1 255.255.255.255 inside
pdm location 192.168.1.2 255.255.255.255 inside
pdm location 218.104.216.0 255.255.255.0 outside
pdm location test 255.255.255.0 inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) 110.16.39.3 192.168.1.5 netmask 255.255.255.255 0 0
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 110.16.39.1 1
route inside test 255.255.255.0 192.168.1.111 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 192.168.101.0 255.255.255.248 inside
http 192.168.1.1 255.255.255.255 inside
http 192.168.1.2 255.255.255.255 inside
http 192.168.1.5 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 20 ipsec-isakmp
crypto map outside_map 20 match address outside_cryptomap_20
crypto map outside_map 20 set peer KLPIX
crypto map outside_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
isakmp enable outside
isakmp key ******** address KLPIX netmask 255.255.255.255 no-xauth no-config-mod
e
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup robxus1 address-pool robxus
vpngroup robxus1 dns-server 192.168.1.5 221.10.251.191
vpngroup robxus1 wins-server 192.168.1.5
vpngroup robxus1 split-tunnel robxus1_splitTunnelAcl
vpngroup robxus1 idle-time 1800
vpngroup robxus1 password ********
telnet 0.0.0.0 0.0.0.0 outside
telnet 0.0.0.0 0.0.0.0 inside
telnet timeout 15
ssh 221.54.169.0 255.255.255.0 outside
ssh 218.104.216.0 255.255.255.0 outside
ssh timeout 10
console timeout 0
dhcpd address 192.168.1.50-192.168.1.254
dhcpd dns 192.168.1.5 221.10.251.196
dhcpd wins 192.168.1.5
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd domain robxusevanscd.com
dhcpd auto_config outside
dhcpd enable inside
terminal width 80
Cryptochecksum:dcd44f9e553
: end
I don't see anything wrong with this config.
If the other side has mirror image acls for nat_0 and crypto map then it comes down to routing.
If the other side has mirror image acls for nat_0 and crypto map then it comes down to routing.
ASKER
this is from pix b
: Saved
: Written by enable_15 at 11:54:04.076 MYT Thu Oct 16 2008
!
PIX Version 7.2(4)
!
hostname pixfirewall
domain-name ciscopix.com
enable password Z4XZfE8U0nFs9RAV encrypted
passwd wJ8x5XK/QBYJ8yTP encrypted
names
name 192.168.3.0 Cyprus
name 192.168.14.0 London2
name 192.168.162.0 CapeTown
name 192.168.222.0 vpnnet
name 192.168.100.0 Sydney
name 192.168.200.0 Melbourne
name 192.168.1.0 cdnet
dns-guard
!
interface Ethernet0
description Primary Internet via TIME 6Mbps leased
nameif outside
security-level 0
ip address 221.54.169.2 255.255.255.0
!
interface Ethernet1
speed 100
duplex full
nameif inside
security-level 100
ip address 192.168.150.10 255.255.255.0
!
interface Ethernet2
description Backup Internet via TM 1.5Mbps ADSL
nameif Backup
security-level 0
ip address 66.49.18.121 255.255.255.248
!
boot system flash:/image.bin
ftp mode passive
clock timezone MYT 8
dns server-group DefaultDNS
domain-name ciscopix.com
object-group service Video tcp
port-object range 5555 5587
object-group service Audio udp
port-object range 2326 2387
object-group service Ironport tcp
port-object eq ssh
port-object eq https
port-object eq 83
port-object eq smtp
object-group service RDP tcp
description Remote desktop protocol/Terminal Service for Windows
port-object eq 3389
access-list inside_access_in extended permit ip 192.168.150.0 255.255.255.0 any
access-list inside_access_in extended permit udp 192.168.150.0 255.255.255.0 any
access-list inside_access_in extended permit tcp 192.168.150.0 255.255.255.0 any
access-list inside_access_in extended permit ip 192.168.151.0 255.255.255.0 any
access-list inside_access_in extended permit udp 192.168.151.0 255.255.255.0 any
access-list inside_access_in extended permit tcp 192.168.151.0 255.255.255.0 any
access-list inside_access_in extended permit tcp 192.168.101.0 255.255.255.0 any
access-list inside_access_in extended permit udp 192.168.101.0 255.255.255.0 any
access-list inside_access_in extended permit ip 192.168.101.0 255.255.255.0 any
access-list inside_outbound_nat0_acl extended permit ip 192.168.150.0 255.255.255.0 cdnet 255.255.255.0
access-list inside_outbound_nat0_acl extended permit ip 192.168.150.0 255.255.255.0 192.168.166.0 255.255.255.0
access-list outside_cryptomap_dyn_20 extended permit ip any 192.168.101.0 255.255.255.248
access-list outside_cryptomap_dyn_40 extended permit ip any 192.168.101.0 255.255.255.248
access-list outside_cryptomap_100 extended permit ip 192.168.150.0 255.255.255.0 cdnet 255.255.255.0
access-list outside_cryptomap_100 remark test for cdnet
access-list outside_cryptomap_100 extended permit ip 192.168.150.0 255.255.255.0 192.168.166.0 255.255.255.0
access-list mevpnxs_splitTunnelAcl standard permit any
access-list outside_1_cryptomap extended permit ip 192.168.150.0 255.255.255.0 CapeTown 255.255.255.0
pager lines 24
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu Backup 1500
ip local pool robxus 192.168.101.1-192.168.101.
icmp unreachable rate-limit 1 burst-size 1
arp timeout 14400
nat-control
global (outside) 1 interface
global (Backup) 1 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 212.24.16.11 1 track 1
route inside 192.168.101.0 255.255.255.0 192.168.150.3 1
route inside 192.168.151.0 255.255.255.0 192.168.150.3 1
route inside 192.168.153.0 255.255.255.0 192.168.150.3 1
route inside vpnnet 255.255.255.0 192.168.150.3 1
route Backup 0.0.0.0 0.0.0.0 60.49.189.121 200
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server MEKL protocol tacacs+
aaa-server MEKL (inside) host 192.168.150.2
timeout 5
key xxxxxxx
http server enable
http 0.0.0.0 0.0.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
snmp-server enable traps snmp authentication linkup linkdown coldstart
auth-prompt prompt Welcome
sla monitor 123
type echo protocol ipIcmpEcho 208.67.222.222 interface outside
num-packets 3
frequency 15
sla monitor schedule 123 life forever start-time now
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 40 match address outside_cryptomap_dyn_40
crypto dynamic-map outside_dyn_map 40 set transform-set ESP-3DES-MD5
crypto dynamic-map outside_dyn_map 60 set pfs group1
crypto dynamic-map outside_dyn_map 60 set transform-set ESP-3DES-SHA
crypto map outside_map 100 match address outside_cryptomap_100
crypto map outside_map 100 set peer 119.6.39.2
crypto map outside_map 100 set transform-set ESP-3DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp identity hostname
crypto isakmp enable outside
crypto isakmp policy 20
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400
crypto isakmp policy 40
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 60
authentication pre-share
encryption des
hash md5
group 2
lifetime 86400
crypto isakmp policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
!
track 1 rtr 123 reachability
telnet 192.168.150.0 255.255.255.0 inside
telnet timeout 10
ssh timeout 15
console timeout 0
group-policy mevpnxs internal
group-policy mevpnxs attributes
wins-server value 192.168.150.14 192.168.152.254
dns-server value 192.168.150.14 192.168.152.254
split-tunnel-policy tunnelspecified
split-tunnel-network-list value mevpnxs_splitTunnelAcl
default-domain value ap.sheraton.com
group-policy robxusvpn internal
group-policy robxusvpn attributes
wins-server value 192.168.150.14
dns-server value 192.168.150.14
vpn-idle-timeout 30
split-tunnel-policy tunnelspecified
split-tunnel-network-list value robxusvpn_splitTunnelAcl
default-domain value ap.sheraton.com
username robertn password 35ebXJ6HwYXzEsJi encrypted privilege 15
tunnel-group 119.6.39.2 type ipsec-l2l
tunnel-group 119.6.39.2 ipsec-attributes
pre-shared-key xxxxxxxxx
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns migrated_dns_map_1
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns migrated_dns_map_1
inspect ftp
inspect h323 h225
inspect h323 ras
inspect http
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect sqlnet
inspect sunrpc
inspect sip
inspect xdmcp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:53a443b7023
: end
: Saved
: Written by enable_15 at 11:54:04.076 MYT Thu Oct 16 2008
!
PIX Version 7.2(4)
!
hostname pixfirewall
domain-name ciscopix.com
enable password Z4XZfE8U0nFs9RAV encrypted
passwd wJ8x5XK/QBYJ8yTP encrypted
names
name 192.168.3.0 Cyprus
name 192.168.14.0 London2
name 192.168.162.0 CapeTown
name 192.168.222.0 vpnnet
name 192.168.100.0 Sydney
name 192.168.200.0 Melbourne
name 192.168.1.0 cdnet
dns-guard
!
interface Ethernet0
description Primary Internet via TIME 6Mbps leased
nameif outside
security-level 0
ip address 221.54.169.2 255.255.255.0
!
interface Ethernet1
speed 100
duplex full
nameif inside
security-level 100
ip address 192.168.150.10 255.255.255.0
!
interface Ethernet2
description Backup Internet via TM 1.5Mbps ADSL
nameif Backup
security-level 0
ip address 66.49.18.121 255.255.255.248
!
boot system flash:/image.bin
ftp mode passive
clock timezone MYT 8
dns server-group DefaultDNS
domain-name ciscopix.com
object-group service Video tcp
port-object range 5555 5587
object-group service Audio udp
port-object range 2326 2387
object-group service Ironport tcp
port-object eq ssh
port-object eq https
port-object eq 83
port-object eq smtp
object-group service RDP tcp
description Remote desktop protocol/Terminal Service for Windows
port-object eq 3389
access-list inside_access_in extended permit ip 192.168.150.0 255.255.255.0 any
access-list inside_access_in extended permit udp 192.168.150.0 255.255.255.0 any
access-list inside_access_in extended permit tcp 192.168.150.0 255.255.255.0 any
access-list inside_access_in extended permit ip 192.168.151.0 255.255.255.0 any
access-list inside_access_in extended permit udp 192.168.151.0 255.255.255.0 any
access-list inside_access_in extended permit tcp 192.168.151.0 255.255.255.0 any
access-list inside_access_in extended permit tcp 192.168.101.0 255.255.255.0 any
access-list inside_access_in extended permit udp 192.168.101.0 255.255.255.0 any
access-list inside_access_in extended permit ip 192.168.101.0 255.255.255.0 any
access-list inside_outbound_nat0_acl extended permit ip 192.168.150.0 255.255.255.0 cdnet 255.255.255.0
access-list inside_outbound_nat0_acl extended permit ip 192.168.150.0 255.255.255.0 192.168.166.0 255.255.255.0
access-list outside_cryptomap_dyn_20 extended permit ip any 192.168.101.0 255.255.255.248
access-list outside_cryptomap_dyn_40 extended permit ip any 192.168.101.0 255.255.255.248
access-list outside_cryptomap_100 extended permit ip 192.168.150.0 255.255.255.0 cdnet 255.255.255.0
access-list outside_cryptomap_100 remark test for cdnet
access-list outside_cryptomap_100 extended permit ip 192.168.150.0 255.255.255.0 192.168.166.0 255.255.255.0
access-list mevpnxs_splitTunnelAcl standard permit any
access-list outside_1_cryptomap extended permit ip 192.168.150.0 255.255.255.0 CapeTown 255.255.255.0
pager lines 24
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu Backup 1500
ip local pool robxus 192.168.101.1-192.168.101.
icmp unreachable rate-limit 1 burst-size 1
arp timeout 14400
nat-control
global (outside) 1 interface
global (Backup) 1 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 212.24.16.11 1 track 1
route inside 192.168.101.0 255.255.255.0 192.168.150.3 1
route inside 192.168.151.0 255.255.255.0 192.168.150.3 1
route inside 192.168.153.0 255.255.255.0 192.168.150.3 1
route inside vpnnet 255.255.255.0 192.168.150.3 1
route Backup 0.0.0.0 0.0.0.0 60.49.189.121 200
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server MEKL protocol tacacs+
aaa-server MEKL (inside) host 192.168.150.2
timeout 5
key xxxxxxx
http server enable
http 0.0.0.0 0.0.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
snmp-server enable traps snmp authentication linkup linkdown coldstart
auth-prompt prompt Welcome
sla monitor 123
type echo protocol ipIcmpEcho 208.67.222.222 interface outside
num-packets 3
frequency 15
sla monitor schedule 123 life forever start-time now
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 40 match address outside_cryptomap_dyn_40
crypto dynamic-map outside_dyn_map 40 set transform-set ESP-3DES-MD5
crypto dynamic-map outside_dyn_map 60 set pfs group1
crypto dynamic-map outside_dyn_map 60 set transform-set ESP-3DES-SHA
crypto map outside_map 100 match address outside_cryptomap_100
crypto map outside_map 100 set peer 119.6.39.2
crypto map outside_map 100 set transform-set ESP-3DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp identity hostname
crypto isakmp enable outside
crypto isakmp policy 20
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400
crypto isakmp policy 40
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 60
authentication pre-share
encryption des
hash md5
group 2
lifetime 86400
crypto isakmp policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
!
track 1 rtr 123 reachability
telnet 192.168.150.0 255.255.255.0 inside
telnet timeout 10
ssh timeout 15
console timeout 0
group-policy mevpnxs internal
group-policy mevpnxs attributes
wins-server value 192.168.150.14 192.168.152.254
dns-server value 192.168.150.14 192.168.152.254
split-tunnel-policy tunnelspecified
split-tunnel-network-list value mevpnxs_splitTunnelAcl
default-domain value ap.sheraton.com
group-policy robxusvpn internal
group-policy robxusvpn attributes
wins-server value 192.168.150.14
dns-server value 192.168.150.14
vpn-idle-timeout 30
split-tunnel-policy tunnelspecified
split-tunnel-network-list value robxusvpn_splitTunnelAcl
default-domain value ap.sheraton.com
username robertn password 35ebXJ6HwYXzEsJi encrypted privilege 15
tunnel-group 119.6.39.2 type ipsec-l2l
tunnel-group 119.6.39.2 ipsec-attributes
pre-shared-key xxxxxxxxx
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns migrated_dns_map_1
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns migrated_dns_map_1
inspect ftp
inspect h323 h225
inspect h323 ras
inspect http
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect sqlnet
inspect sunrpc
inspect sip
inspect xdmcp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:53a443b7023
: end
ASKER
you are right now i also suspect routing problem, i traced this using ethereal
i tried ping from 192.168.150.0/24 the encrypted packet from pix b decrypted at pix a and routed to 192.168.166.0/24
but the ping reply never return back properly
i wonder where it goes :(
i tried ping from 192.168.150.0/24 the encrypted packet from pix b decrypted at pix a and routed to 192.168.166.0/24
but the ping reply never return back properly
i wonder where it goes :(
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Good catch... sorry I missed that the first time.
ASKER
thanks for your help...as usual :)
>via a gateway at 192.168.1.111
Does this router have a default pointing to the PIX, or any overlapping routes pointing 192.168.150.0 someplace else? perhaps with a supernet mask, i.e. route 192.168.0.0 255.255.0.0 --> someplace else