Solved

VPN tunnel not comming up on PIX and ASA. Any suggestions?

Posted on 2008-10-31
5
886 Views
Last Modified: 2011-10-19
Hello All,

I am having trouble establishing a VPN tunnel between a ASA and PIX. Everything looks right on my configuration and I am at a lose to explain why the tunnel is not coming up. I have included my configurations. Any suggestions. Thank you.


Main-Branch-PIX.txt
Remote-Branch-ASA.txt
0
Comment
Question by:greenbeanx81
  • 2
  • 2
5 Comments
 
LVL 7

Expert Comment

by:geergon
ID: 22855517
Hi Sir!

It could be anything.

Please we can start testing with:
Add "sysopt connection permit-ipsec" int the PIX and in the ASA is "sysopt connection permit-vpn"
And delete "crypto map VPNmap 10 set pfs" in ASA.

Just to double check the sub-net behind the PIX is 172.21.173.0/24
And the subnet behind the ASA is: 172.21.174.0/24
Right?


So I recommend you to update this case with a capture of the debug and the show, in console mode:
Please type show crypto isakmp sa to see if the issue is related to phase 1.
And type show crypto ipsec sa if is something with phase 2.
And
"debug crypto isakmp 128"
or "debug crypto isakmp 254"
Copy an paste the debug.
Then "un all" --> refers to undebug all.

Also if would be a great idea if check this link too!
http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a00807e0aca.shtml#Solution12

Maybe I going to recreate this in my lab.
Bye!
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 22855583
Agree that you need the syspot commands on both sides.
Also agree that you need to remove the PFS on the ASA

On the PIX, this line:
 >isakmp key ******** address 24.x.x.x netmask 255.255.255.255

Should have added tags:
isakmp key ******** address 24.x.x.x netmask 255.255.255.255 no-xauth no-config-mode
0
 

Author Comment

by:greenbeanx81
ID: 22869595
Yes, the PIX subnet is 172.21.173.0/24 and the ASA is 172.21.174.0/24. I have added and removed the required lines but the tunnel is still not coming up. No output from the debug crypto isakmp 150 command either.
0
 
LVL 7

Expert Comment

by:geergon
ID: 22873370
What about:
debug crypto isakmp 254

&

debug crypto ipsec 254

Please attach the debugs.
0
 
LVL 79

Accepted Solution

by:
lrmoore earned 500 total points
ID: 22873547
Since you do not have any deny statements in the acl, you can remove it from the Main branch:
  no access-group 101 in interface inside

on Remote, add:
  crypto isakmp identity address

what do you get with "show crypto is sa" ? Issue the command several times until you get something..

Do you have traffic from these two networks? Setup a continuous ping from a host on one side to a host on the other side.
Then post result of "show crypto ip sa"
0

Featured Post

VMware Disaster Recovery and Data Protection

In this expert guide, you’ll learn about the components of a Modern Data Center. You will use cases for the value-added capabilities of Veeam®, including combining backup and replication for VMware disaster recovery and using replication for data center migration.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
Concerto Cloud Services, a provider of fully managed private, public and hybrid cloud solutions, announced today it was named to the 20 Coolest Cloud Infrastructure Vendors Of The 2017 Cloud  (http://www.concertocloud.com/about/in-the-news/2017/02/0…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …

806 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question