Solved

VPN tunnel not comming up on PIX and ASA. Any suggestions?

Posted on 2008-10-31
5
884 Views
Last Modified: 2011-10-19
Hello All,

I am having trouble establishing a VPN tunnel between a ASA and PIX. Everything looks right on my configuration and I am at a lose to explain why the tunnel is not coming up. I have included my configurations. Any suggestions. Thank you.


Main-Branch-PIX.txt
Remote-Branch-ASA.txt
0
Comment
Question by:greenbeanx81
  • 2
  • 2
5 Comments
 
LVL 7

Expert Comment

by:geergon
Comment Utility
Hi Sir!

It could be anything.

Please we can start testing with:
Add "sysopt connection permit-ipsec" int the PIX and in the ASA is "sysopt connection permit-vpn"
And delete "crypto map VPNmap 10 set pfs" in ASA.

Just to double check the sub-net behind the PIX is 172.21.173.0/24
And the subnet behind the ASA is: 172.21.174.0/24
Right?


So I recommend you to update this case with a capture of the debug and the show, in console mode:
Please type show crypto isakmp sa to see if the issue is related to phase 1.
And type show crypto ipsec sa if is something with phase 2.
And
"debug crypto isakmp 128"
or "debug crypto isakmp 254"
Copy an paste the debug.
Then "un all" --> refers to undebug all.

Also if would be a great idea if check this link too!
http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a00807e0aca.shtml#Solution12

Maybe I going to recreate this in my lab.
Bye!
0
 
LVL 79

Expert Comment

by:lrmoore
Comment Utility
Agree that you need the syspot commands on both sides.
Also agree that you need to remove the PFS on the ASA

On the PIX, this line:
 >isakmp key ******** address 24.x.x.x netmask 255.255.255.255

Should have added tags:
isakmp key ******** address 24.x.x.x netmask 255.255.255.255 no-xauth no-config-mode
0
 

Author Comment

by:greenbeanx81
Comment Utility
Yes, the PIX subnet is 172.21.173.0/24 and the ASA is 172.21.174.0/24. I have added and removed the required lines but the tunnel is still not coming up. No output from the debug crypto isakmp 150 command either.
0
 
LVL 7

Expert Comment

by:geergon
Comment Utility
What about:
debug crypto isakmp 254

&

debug crypto ipsec 254

Please attach the debugs.
0
 
LVL 79

Accepted Solution

by:
lrmoore earned 500 total points
Comment Utility
Since you do not have any deny statements in the acl, you can remove it from the Main branch:
  no access-group 101 in interface inside

on Remote, add:
  crypto isakmp identity address

what do you get with "show crypto is sa" ? Issue the command several times until you get something..

Do you have traffic from these two networks? Setup a continuous ping from a host on one side to a host on the other side.
Then post result of "show crypto ip sa"
0

Featured Post

How to improve team productivity

Quip adds documents, spreadsheets, and tasklists to your Slack experience
- Elevate ideas to Quip docs
- Share Quip docs in Slack
- Get notified of changes to your docs
- Available on iOS/Android/Desktop/Web
- Online/Offline

Join & Write a Comment

If you have an ASA5510 then this sort of thing would be better handled with a CSC Module, however on an ASA5505 thats not an option, and if you want to throw in a quick solution to stop your staff going to facebook during work time, then this is the…
Secure VPN Connection terminated locally by the Client.  Reason 442: Failed to enable Virtual Adapter. If you receive this error on Windows 8 or Windows 8.1 while trying to connect with the Cisco VPN Client then the solution is a simple registry f…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now