PIX 501 site-to-site help required

[dfgdfgxfg]

I ran the VPN setup wizard on pix1 with no errors reported.
Ran VPN setup wizard on pix2 with error reported (see below). I have not setup a site-to-site VPN connection before and require assistance to remedy this situation.

[OK] no isakmp key *** address X.X.X.X
[OK] isakmp key abcinc address X.X.X.X netmask 255.255.255.255 no-xauth no-config-mode
[OK] access-list 101 line 2 permit ip interface inside host X.X.X.X
[OK] nat (inside) 0 access-list 101
[OK] access-list outside_cryptomap_20 permit ip interface inside host X.X.X.X
[ERR]crypto map mymap 20 set peer X.X.X.X
WARNING: This crypto map is incomplete.
To remedy the situation add a peer and a valid access-list to this crypto map.
[OK] crypto map mymap 20 match address outside_cryptomap_20
[OK] crypto map mymap 20 set transform-set ESP-DES-SHA
[OK] crypto map mymap 20 set security-association lifetime seconds 28800 kilobytes 4608000
[OK] crypto map mymap interface outside
[OK] sysopt connection permit-ipsec


My pix2 config is as follows;

PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password X encrypted
passwd X encrypted
hostname abcinc(FORT)
domain-name abcinc
clock timezone MST -7
clock summer-time MDT recurring
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names

name X.X.X.X ABCInc

access-list split permit ip 192.168.1.0 255.255.255.0 10.1.2.0 255.255.255.0
access-list 101 permit ip 192.168.1.0 255.255.255.0 10.1.2.0 255.255.255.0
access-list 101 permit ip interface inside host ABCInc
access-list outside_cryptomap_20 permit ip interface inside host ABCInc
pager lines 24
logging on
mtu outside 1500
mtu inside 1500
ip address outside dhcp setroute
ip address inside 192.168.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool ippool 10.1.2.1-10.1.2.254
pdm location 192.168.1.2 255.255.255.255 inside
pdm location 10.1.2.0 255.255.255.0 outside

pdm location ABCInc 255.255.255.255 outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list 101
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable

http 192.168.1.0 255.255.255.0 inside
http 192.168.1.2 255.255.255.255 inside

no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set myset esp-des esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto dynamic-map dynmap 10 set transform-set myset
crypto map mymap 20 ipsec-isakmp
crypto map mymap 20 match address outside_cryptomap_20
crypto map mymap 20 set peer ABCInc
crypto map mymap 20 set transform-set ESP-DES-SHA
crypto map mymap 65535 ipsec-isakmp dynamic dynmap
crypto map mymap interface outside
isakmp enable outside
isakmp key ******** address ABCInc netmask 255.255.255.255 no-xauth no-config-mode
isakmp identity address
isakmp nat-traversal 20
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
isakmp policy 30 authentication pre-share
isakmp policy 30 encryption des
isakmp policy 30 hash sha
isakmp policy 30 group 2
isakmp policy 30 lifetime 86400
vpngroup abcinc address-pool ippool
vpngroup abcinc default-domain abcinc
vpngroup abcinc split-tunnel split
vpngroup abcinc split-dns abcinc.local
vpngroup abcinc idle-time 1800
vpngroup abcinc password ********

telnet timeout 5

ssh timeout 5
management-access inside
console timeout 0
dhcpd address 192.168.1.100-192.168.1.120 inside
dhcpd lease 999999
dhcpd ping_timeout 750
dhcpd domain abcinc
dhcpd auto_config outside
dhcpd enable inside
terminal width 80


Robin

 

[dfgdfgxfg]

I'm disappointed to see no one on this website has decided to provide any feedback on my request. It must be the Cisco "I am above everyone, if you don't use the CLI you are a loser" attitude that prevails.

Well get over it, I wouldn't be here if I was a CLI master. Thanks for nothing!

Robin

 

[Supergrrover]

Now that is uncalled for and just plain rude.

1. I don't think anyone here has that attitude and if you search you will see plenty of posts regarding PDM and ASDM. I personally don't use it so I am not sure what the wizards do.
2. Sometimes things just slip through the cracks but you do realize that we all have lives outside of this board. I can only speak for myself but a lot of the time I may not have the time/energy to delve into a problem that I am not familiar with and figured that someone with more experience in that area would post.

So, seeing as the board has failed you - Here is a site-to-site guide via the PDM -

http://www.cisco.com/en/US/products...s_configuration_example09186a008055bd85.shtml

Pick through it and see what doesn't fit with your config. If all else fails, start over.

Here is link to ALL the published Cisco examples - ASDM/PDM/CLI

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/prod_configuration_examples_list.html

Google is a marvelous thing.

Well, you can't be all bad - You forgot the please but at least you remembered the thank you.


Brent
Systems Engineer / Consultant
CCNP, CCSP