Need help with Cisco 501 PIX to Cisco 501 PIX VPN

[jlsanderson]

I have a remote location with DSL and Cisco 501 PIX.
I want to establish a peer VPN connection to Main Office with DSL and Cisco 501 PIX. Can you look at the config files and tell me why they do not connect? How to debug?

I am taking over some of the networking from a small company. I am mostly a WinTel guy. trying to get comfortable with the IOS.


Remote location config.

PIX Version 6.3 (4)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password x
passwd x
hostname x
domain-name x
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list 100 permit tcp any any eq 6502
access-list 100 permit udp any any eq 6502
access-list 100 permit icmp any any echo-reply
access-list 100 permit tcp any any eq 1603
access-list 100 permit tcp any any eq telnet
access-list 100 permit udp any any eq 23
access-list 150 permit ip 192.168.126.0 255.255.255.0 192.168.125.0 255.255.255.0
access-list nonat permit ip 192.168.126.0 255.255.255.0 192.168.125.0 255.255.255.0
access-list nonat permit ip 192.168.126.0 255.255.255.0 192.168.127.0 255.255.255.0
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside xx.xx.xx.xx 255.255.255.0
ip address inside 192.168.xx.xx 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool ippool 192.168.127.11-192.168.127.20
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list nonat
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-group 100 in interface outside
route outside 0.0.0.0 0.0.0.0 xx.xx.xx.xx 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection tcpmss 1200
sysopt connection permit-ipsec
crypto ipsec transform-set ESP-3DES esp-3des esp-md5-hmac
crypto ipsec transform-set myset esp-des esp-md5-hmac
crypto dynamic-map dynmap 10 set transform-set myset
crypto map VPN 10 ipsec-isakmp
crypto map VPN 10 match address 150
crypto map VPN 10 set peer xx.xx.xx.xx
crypto map VPN 10 set transform-set ESP-3DES
crypto map mymap 10 ipsec-isakmp dynamic dynmap
crypto map mymap interface outside
isakmp enable outside
isakmp key ******** address xx.xx.xx.xx netmask 255.255.255.255 no-xauth no-config-mode
isakmp identity address
isakmp nat-traversal 20
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash md5
isakmp policy 10 group 1
isakmp policy 10 lifetime 84600
vpngroup vpnclient address-pool ippool
vpngroup vpnclient dns-server
vpngroup vpnclient wins-server
vpngroup vpnclient default-domain ciscopix.com
vpngroup vpnclient idle-time 1800
vpngroup vpnclient password ********
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 60
management-access inside
console timeout 0
dhcpd dns
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
terminal width 80
: end

Main Office Config.

PIX Version 6.3 (3)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password
passwd
hostname
domain-name
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list 100 permit icmp any any echo-reply
access-list 100 permit tcp any any eq 6502
access-list 100 permit udp any any eq 6502
access-list 100 permit tcp any any eq 1603
access-list 100 permit udp any any eq 1603
access-list 100 permit tcp any any eq telnet
access-list 100 permit udp any any eq 23
access-list 100 permit tcp any any eq 4148
access-list 100 permit udp any any eq 4148
access-list nonat permit ip 192.168.125.0 255.255.255.0 192.168.126.0 255.255.255.0
access-list nonat permit ip 192.168.125.0 255.255.255.0 192.168.127.0 255.255.255.0
access-list nonat permit ip 192.168.127.0 255.255.255.0 192.168.126.0 255.255.255.0
access-list 150 permit ip 192.168.125.0 255.255.255.0 192.168.126.0 255.255.255.0
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside xx.xx.xx.xx 255.255.255.0
ip address inside 192.168.125.xx 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool ippool 192.168.127.1-192.168.127.10
pdm location 0.0.0.0 255.255.255.0 outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list nonat
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp interface 6502 192.168.xx.2 6502 netmask 255.255.255.255 0 0
static (inside,outside) udp interface 6502 192.168.xx.2 6502 netmask 255.255.255.255 0 0
static (inside,outside) tcp interface 4148 192.168.xx.2 4148 netmask 255.255.255.255 0 0
static (inside,outside) udp interface 4148 192.168.xx.2 4148 netmask 255.255.255.255 0 0
rip inside default version 2
route outside 0.0.0.0 0.0.0.0 xx.xx.xx.x 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 192.168.125.0 255.255.255.0 inside
http 192.168.127.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection tcpmss 1200
sysopt connection permit-ipsec
crypto ipsec transform-set ESP-3DES esp-3des esp-md5-hmac
crypto ipsec transform-set myset esp-des esp-md5-hmac
crypto dynamic-map dynmap 10 set transform-set myset
crypto map VPN 10 ipsec-isakmp
crypto map VPN 10 match address 150
crypto map VPN 10 set peer xx.xx.xx.xx
crypto map VPN 10 set transform-set ESP-3DES
crypto map mymap 10 ipsec-isakmp dynamic dynmap
crypto map mymap interface outside
isakmp enable outside
isakmp key ******** address xx.xx.xx.xx netmask 255.255.255.255 no-xauth no-config-mode
isakmp identity address
isakmp nat-traversal 20
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
vpngroup vpnclient address-pool ippool
vpngroup vpnclient dns-server 192.168.xx.xx
vpngroup vpnclient wins-server 192.168.xx.xx
vpngroup vpnclient default-domain ciscopix.com
vpngroup vpnclient idle-time 1800
vpngroup vpnclient password ********
telnet 0.0.0.0 0.0.0.0 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 60
management-access inside
console timeout 0
dhcpd address 192.168.xx.195-192.168.xx.199 inside
dhcpd dns
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
dhcpd enable inside
terminal width 80

: end

I also have a VPN client setup to the main office that works fine, but when I use the same setup for the remote office PIX, it does not work.
vpngroup vpnclient address-pool ippool
vpngroup vpnclient dns-server 192.168.xx.xx
vpngroup vpnclient wins-server 192.168.xx.xx
vpngroup vpnclient default-domain ciscopix.com
vpngroup vpnclient idle-time 1800
vpngroup vpnclient password ********

Also I have a T1 going to both areas. Coming in to 1720 Router. I assume I would not need this if the Peer to peer works?

 

[GM2005]

What setup are you using? You have a router in front of each firewall, is it forwarding VPN traffic to the PIX outside interface OK? If the VPN is on the PIX and the router is NAT'ing, then you need to port forward VPN traffic coming to the router public IP to the outside PIX address.

To debug:

conf t
line con 0
logg synch
exit
line vty 0 4
logg synch
exit

debug crypto ipsec
debug crypto isa
term mon
conf t
logg con
exit

Try and capture the output to a text file if on hyperterminal or teraterm if using them.

Post the output here , remove anything sensitive, and cut it down as it will replicate a lot.

To stop debug (Do not leave it on)

un all
term no mon
conf t
no logg con
exit
wr mem

 

[jlsanderson]

GM2005, I do not know. They have two DSL connections and two T1 connections? I want to take the T1's out of the equation. Do you think it's wise to just use DSL Peer to Peer VPN between PIX's. I thought it could also save money.

It seems as if the Peer to peer VPN between the PIX's did not work so they are using the T1's between the Cisco 1720 on both ends. On the DSL connection the PIX comes first and then the Netgear switch to the client computers. At the same time the T1 is going into the Cisco 1750 Router then runs to the switch?

The configuration is just concerning the PIX's. I have not reset the password on the Routers to know the config.

I was hoping to just run the DSL/PIX traffic to the other DSL/PIX in a peer setup.

The PIX on both ends are doing the PATing. I think the Routers are just strictly routing the traffic between the two T1's the with no NAT/PAT.

I will try to debug with your commands.

 

[brianinms]

If the default gateway on each end isn't the pix then the connection isn't going to come up.

 

[jlsanderson]

brianinms,

The default gateway on each is the DSL gateway. Clients on the inside have no problem reaching the Internet.

 

[brianinms]

Right, but are the workstations configured with the PIX as their default gateway or is the router with the T1 their default gateway?

 

[karmic]

Wouldn't the router belong to the ISP for managed internet? It was stated that the password for the routers is unknown. Is the IP on the outside of the pix a public or private?

~ K.I.S.S - Don't make it any more complex than it has to be ~

 

[jlsanderson]

The Default route or gateway for clients is the PIX inside address.

The router is connected to a switch as well as the PIX. It looks as though traffic handled locally by the router for the other subnet of 192.168.126.X. Any traffic for the Internet is going out the PIX. Looks as thought the T1 is internal only. Tracert from side A node is
192.168.125.2 Client Node Side A
192.168.125.254 T1 Router Side A
10.0.0.2 T1 Router Side B
192.168.126.56 Client Node Side B.

Conversely
192.168.126.56 Client Node Side B
192.168.126.254 T1 Router Side B
10.0.0.1 T1 Router Side A
192.168.125.2 Client Node Side A

When I look at the stats for the IKE it shows no hit count for the other peer.