Pix Help - Getting Subnets To Talk Between 2 Pixes

[judgestone]

I have posted this under router and sorry for the cross post, but I am trying to get this resolved. I will post scenario and configs from both pix's to try and get some help. Also Sorry for a long post, but I have been working on this for weeks.

Scenario - Location 1 (NorthShore) firewall ip: 10.10.60.1, with an 209.XX.XX.XX external address with a DLink Layer 3 switch (ip 10.10.60.254 default VLAN, DGW: 10.10.60.1), and on the DLink I have vlans of 10.10.66.254, 10.10.67.254, 10.10.68.254, and 10.10.69.254. All subnets can ping each other and can ping 10.10.60.1, and reach the internet. This is what I wanted, and all works great as long as you are on that switch itself.

Location 2 (South Shore) firewall ip: 10.10.62.1, with an 70.XX.XX.XX external address with a DLink Layer 3 switch (ip: 10.10.62.254 default VLAN, DGW: 10.10.62.1), and on the DLink I have vlans of 10.10.63.254, 10.10.64.254, and 10.10.65.254. All subnets can ping each other and can ping 10.10.62.1, and reach the internet. This is what I wanted, and all works great as long as you are on that switch itself.

The two pix's are connected via site to site VPN.

If you are in the default 10.10.60 or 10.10.62 subnets with a default gateway of 10.10.60.1, or 10.10.62.1 you can ping either subnet and the Northshore can access resources in the Southshore; and visa versa, but again only on the 10.10.60 or 10.10.62 subnets with the pix's as your default gateway.

What I want to do is to be able to ping 10.10.63.X on the SouthShore pix/Dlink from a 10.10.68.X address on the NorthShore pix/Dlink. And this would hold true for each of the other vlans or subnets.

I know it seems to be access rules, but I have tried them under access rules, and I believe it has something to do with the VPN rules.

Any help will be greatly appreciated.

NorthShore Pix Config - 10.10.60.1

-------

Building configuration...
: Saved
:
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password XXXXX encrypted
passwd XXXXXX encrypted
hostname XXX
domain-name XXXXX.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 192.168.1.0 XXXX
name 10.10.62.0 SouthShore
name 192.168.5.0 vlan5
object-group service XXXXX tcp
port-object range 20000 20999
access-list inside_outbound_nat0_acl permit ip 10.10.60.0 255.255.255.0 192.168.60.0 255.255.255.192
access-list inside_outbound_nat0_acl permit ip 10.10.60.0 255.255.255.0 XXX 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.60.0 255.255.255.0 SouthShore 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.60.0 255.255.255.0 XXXX 255.255.255.0
access-list outside_access_in remark Ping
access-list outside_access_in permit tcp any any
access-list outside_cryptomap_40 permit ip 10.10.60.0 255.255.255.0 SouthShore 255.255.255.0
access-list vlan3_access_in permit tcp interface vlan2 any
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 209.XXX.XXX.XXX 255.255.255.252
ip address inside 10.10.60.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool XXXXXXX 192.168.60.10-192.168.60.40
pdm location 192.168.60.0 255.255.255.192 outside
pdm location XXX 255.255.255.0 outside
pdm location SouthShore 255.255.255.0 outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 209.XXX.XXX.XXX 1
route inside 10.10.66.0 255.255.255.0 10.10.60.254 1
route inside 10.10.67.0 255.255.255.0 10.10.60.254 1
route inside 10.10.68.0 255.255.255.0 10.10.60.254 1
route inside 10.10.69.0 255.255.255.0 10.10.60.254 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 10.10.60.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community XXXX
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
sysopt connection permit-pptp
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto map outside_map 20 ipsec-isakmp
crypto map outside_map 20 match address outside_cryptomap_20
crypto map outside_map 20 set peer 69.XX.XX.XX
crypto map outside_map 20 set transform-set ESP-DES-MD5
crypto map outside_map 40 ipsec-isakmp
crypto map outside_map 40 match address outside_cryptomap_40
crypto map outside_map 40 set peer 70.XX.XX.XXX
crypto map outside_map 40 set transform-set ESP-3DES-MD5
crypto map outside_map interface outside
isakmp enable outside
isakmp key ******** address 69.XX.XX.XX netmask 255.255.255.255 no-xauth no-config-mode
isakmp key ******** address 70.XX.XX.XXX netmask 255.255.255.255 no-xauth no-config-mode
isakmp identity address
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
isakmp policy 40 authentication pre-share
isakmp policy 40 encryption 3des
isakmp policy 40 hash md5
isakmp policy 40 group 2
isakmp policy 40 lifetime 86400
telnet timeout 5
ssh timeout 5
management-access outside
console timeout 0
vpdn group PPTP-VPDN-GROUP accept dialin pptp
vpdn group PPTP-VPDN-GROUP ppp authentication pap
vpdn group PPTP-VPDN-GROUP ppp authentication chap
vpdn group PPTP-VPDN-GROUP ppp authentication mschap
vpdn group PPTP-VPDN-GROUP ppp encryption mppe auto
vpdn group PPTP-VPDN-GROUP client configuration address local XXXXXXXXXX
vpdn group PPTP-VPDN-GROUP client configuration dns 69.XX.XX.XX
vpdn group PPTP-VPDN-GROUP pptp echo 60
vpdn group PPTP-VPDN-GROUP client authentication local
vpdn username XX password *********
vpdn username XX password *********
vpdn username XX password *********
vpdn username XX password *********
vpdn username XX password *********
vpdn username XX password *********
vpdn username XX password *********
vpdn username XX password *********
vpdn username XX password *********
vpdn username XX password *********
vpdn enable outside
dhcpd address 10.10.60.200-10.10.60.254 inside
dhcpd dns 69.XX.XX.XX 216.XX.XX.XXX
dhcpd lease 86400
dhcpd ping_timeout 750
dhcpd auto_config outside
dhcpd enable inside
terminal width 80
Cryptochecksum:XXXXXXXXXX
: end
[OK]
--------------------------

SouthShore Pix Config (10.10.62.1)

Building configuration...
: Saved
:
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password XXXXXXX
encrypted passwd XXXXXX
encrypted hostname XXXX
domain-name XXX.local
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 10.10.60.0
MainLocation access-list inside_outbound_nat0_acl permit ip 10.10.62.0 255.255.255.0
MainLocation 255.255.255.0 access-list outside_cryptomap_20 permit ip 10.10.62.0 255.255.255.0
mtu outside 1500
mtu inside 1500
ip address outside 70.XX.XX.XXX 255.255.255.252
ip address inside 10.10.62.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location MainLocation 255.255.255.0 outside
pdm location 10.10.63.0 255.255.255.0 inside
pdm location 10.10.64.0 255.255.255.0 inside
pdm location 10.10.65.0 255.255.255.0 inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 70.43.98.109 1
route inside 10.10.63.0 255.255.255.0 10.10.62.254 1
route inside 10.10.64.0 255.255.255.0 10.10.62.254 1
route inside 10.10.65.0 255.255.255.0 10.10.62.254 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 10.10.62.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community XXXXX
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto map outside_map 20 ipsec-isakmp
crypto map outside_map 20 match address outside_cryptomap_20
crypto map outside_map 20 set peer 209.XXX.XXX.XXX
crypto map outside_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map interface outside isakmp enable outside
isakmp key ******** address 209.XXX.XXX.XXX netmask 255.255.255.255 no-xauth
no-config-mode
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5 isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 10.10.62.101-10.10.62.151 inside
dhcpd dns 69.XX.XX.XXX 216.XX.XXX.XXX
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
dhcpd enable inside
terminal width 80
Cryptochecksum:XXXXXX
: end
[OK]
------------------------
Again any help in this matter or at least point me in the right direction will be greatly appreciated.

Judge

 

[judgestone]

I will be disabling DCHP once I can get this configured for the VLANs. There will only be the PIXs/DLinks, and maybe a server or two on the default 10.10.60, or 10.10.62 subnets. No end clients, all IP Address will be static pertainent to their vlan/subnet.

 

[Supergrrover]

You need to to tell the pix(s) what is interesting traffic for the VPN and what not to NAT as well.

For each subnet behind the pix you will need an ACL entry that tells it to be encrypted and to not NAT it

access-list inside_outbound_nat0_acl permit ip 10.10.[local].0 255.255.255.0 10.10.[remote].0 255.255.255.0
(one for each local and remote pair - so if you have 3 networks on each side, you will need 9 ACL entries for that pix) and the same for the interesting traffic
access-list outside_cryptomap_20 permit ip 10.10.[local].0 255.255.255.0 10.10.[remote].0 255.255.255.0

Add the routes and you should be up and running.

Here is quick guide if you get into trouble

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00804619d8.shtml

Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[judgestone]

Thanks for the reply, I will try this tommorrow. I am going down to New Orleans tommorrow with a new server that I can setup on the SouthShore with a 10.10.63.X address and I can also get to the 10.10.62.1 firewall to do configs to it. Will update.

 

[judgestone]

I tried suggestion from above with these entries on 10.10.60.1 (NorthShore)

access-list inside_outbound_nat0_acl permit ip 10.10.60.0 255.255.255.0 192.168.60.0 255.255.255.192
access-list inside_outbound_nat0_acl permit ip 10.10.60.0 255.255.255.0 IMC 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.60.0 255.255.255.0 SouthShore 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.66.0 255.255.255.0 SouthShore 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.66.0 255.255.255.0 10.10.63.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.66.0 255.255.255.0 10.10.64.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.67.0 255.255.255.0 SouthShore 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.67.0 255.255.255.0 10.10.63.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.67.0 255.255.255.0 10.10.64.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.68.0 255.255.255.0 SouthShore 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.68.0 255.255.255.0 10.10.63.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.68.0 255.255.255.0 10.10.64.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.69.0 255.255.255.0 SouthShore 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.69.0 255.255.255.0 10.10.63.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.69.0 255.255.255.0 10.10.64.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.66.0 255.255.255.0 10.10.65.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.67.0 255.255.255.0 10.10.65.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.68.0 255.255.255.0 10.10.65.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.69.0 255.255.255.0 10.10.65.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.60.0 255.255.255.0 10.10.63.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.60.0 255.255.255.0 10.10.64.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.60.0 255.255.255.0 10.10.65.0 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.60.0 255.255.255.0 IMC 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.66.0 255.255.255.0 SouthShore 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.66.0 255.255.255.0 10.10.63.0 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.66.0 255.255.255.0 10.10.64.0 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.67.0 255.255.255.0 SouthShore 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.67.0 255.255.255.0 10.10.63.0 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.67.0 255.255.255.0 10.10.64.0 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.67.0 255.255.255.0 10.10.65.0 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.66.0 255.255.255.0 10.10.65.0 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.68.0 255.255.255.0 SouthShore 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.68.0 255.255.255.0 10.10.63.0 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.68.0 255.255.255.0 10.10.64.0 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.68.0 255.255.255.0 10.10.65.0 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.69.0 255.255.255.0 SouthShore 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.69.0 255.255.255.0 10.10.63.0 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.69.0 255.255.255.0 10.10.64.0 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.69.0 255.255.255.0 10.10.65.0 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.60.0 255.255.255.0 SouthShore 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.60.0 255.255.255.0 10.10.63.0 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.60.0 255.255.255.0 10.10.64.0 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.60.0 255.255.255.0 10.10.65.0 255.255.255.0

and these entries on 10.10.62.1 (SouthShore)

access-list inside_outbound_nat0_acl permit ip 10.10.62.0 255.255.255.0 MainLocation 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.62.0 255.255.255.0 10.10.66.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.62.0 255.255.255.0 10.10.67.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.62.0 255.255.255.0 10.10.68.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.62.0 255.255.255.0 10.10.69.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.63.0 255.255.255.0 MainLocation 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.63.0 255.255.255.0 10.10.66.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.63.0 255.255.255.0 10.10.67.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.63.0 255.255.255.0 10.10.68.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.63.0 255.255.255.0 10.10.69.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.64.0 255.255.255.0 MainLocation 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.64.0 255.255.255.0 10.10.66.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.64.0 255.255.255.0 10.10.67.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.64.0 255.255.255.0 10.10.68.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.64.0 255.255.255.0 10.10.69.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.65.0 255.255.255.0 MainLocation 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.65.0 255.255.255.0 10.10.66.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.65.0 255.255.255.0 10.10.67.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.65.0 255.255.255.0 10.10.68.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.65.0 255.255.255.0 10.10.69.0 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.62.0 255.255.255.0 MainLocation 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.62.0 255.255.255.0 10.10.66.0 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.62.0 255.255.255.0 10.10.67.0 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.62.0 255.255.255.0 10.10.68.0 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.62.0 255.255.255.0 10.10.69.0 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.63.0 255.255.255.0 MainLocation 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.63.0 255.255.255.0 10.10.66.0 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.63.0 255.255.255.0 10.10.67.0 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.63.0 255.255.255.0 10.10.68.0 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.63.0 255.255.255.0 10.10.69.0 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.64.0 255.255.255.0 MainLocation 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.64.0 255.255.255.0 10.10.66.0 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.64.0 255.255.255.0 10.10.67.0 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.64.0 255.255.255.0 10.10.68.0 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.64.0 255.255.255.0 10.10.69.0 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.65.0 255.255.255.0 MainLocation 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.65.0 255.255.255.0 10.10.66.0 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.65.0 255.255.255.0 10.10.67.0 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.65.0 255.255.255.0 10.10.68.0 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.10.65.0 255.255.255.0 10.10.69.0 255.255.255.0

And I still can't ping 10.10.63.2 from 10.10.68.2? Do I need to add some sort of route outside statement or something? I thought it might be a default gateway issue from certain machines, but I have tried different configs from using the default subnet .254 gateway and even changing it back to 10.10.60.1 or 10.10.62.1 since other subnets can at least see it from the switch they are on. Did not work that way either.

Also, I went on the pix 10.10.60.1 NorthShore, and tried to ping 10.10.62.1 and it did not ping and even tried 10.10.62.103 that I know is up and can ping from a dos command line from the same pc that I have connected to the pix and on the same subnet as the pix. The PC 10.10.60.65 on the NorthShore can ping 10.10.62.103 on the SouthShore, but the Pix 10.10.60.1 cannot, and the PC is using 10.10.60.1 as it's default gateway.

Any help will be greatly appreciated. Can post configs if needed.

 

[judgestone]

I think I may have it figured out and that is I noticed that 10.10.62.1 (southshore) had

access-list outside_cryptomap_20 permit ip 10.10.62.0 255.255.255.0 MainLocation 255.255.255.0

but 10.10.60.1 does not have an entry such as

access-list outside_cryptomap_20 permit ip 10.10.60.0 255.255.255.0 SouthShore 255.255.255.0

Could this be the issue and if I were to put this entry into 10.10.60.1 is this going to break any existing connections?

 

[judgestone]

I was mistaken, it was already entered. Sorry for the confusion.

 

[judgestone]

Here goes another question, shouldn't the the config for the southshores 10.10.62.1, or 70.XXXX, be static-40 versus static-20 since the static-20 shows a peer of 69.XXX which is IMC VPN connection? They are a company that has VPN connectivity to us for POS purposes.

 

[judgestone]

Here is what im talking about and I see two entries for 10.10.60.1 (SouthShore)

access-list outside_cryptomap_20 permit ip 10.10.60.0 255.255.255.0 IMC 255.255.255.0 (Reference in previous post)

access-list outside_cryptomap_20 permit ip 10.10.60.0 255.255.255.0 SouthShore 255.255.255.0

access-list outside_cryptomap_40 permit ip 10.10.60.0 255.255.255.0 SouthShore 255.255.255.0

so shouldn't:

access-list outside_cryptomap_20 permit ip 10.10.60.0 255.255.255.0 10.10.63.0 255.255.255.0

be

access-list outside_cryptomap_40 permit ip 10.10.60.0 255.255.255.0 10.10.63.0 255.255.255.0 (Since this is on the SouthShore and subnet'd on the 10.10.62.1 Pix)

and the reference/entry for:

access-list outside_cryptomap_20 permit ip 10.10.60.0 255.255.255.0 SouthShore 255.255.255.0

be removed?

 

[judgestone]

I tried to remove the double entries and somehow broke my VPN connection. I reloaded an old config file but it still was broken, so I just rebuilt the VPN between the two sites. I will work on the subnet routing tommorrow.

 

[Supergrrover]

I've been out all day. I will take a look tomorrow.


Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[Supergrrover]

A quick note about the pings.
Traffic generated by the pix is not encrypted over the ipsec tunnel.


Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[judgestone]

I got it to work by blowing out my vlans in the host inside/outside and rebuilding them, and using cryptomap_40 instead of 20 for my outside vlans and so far it is working fine.

Thanks for all who have helped.

 

[Supergrrover]

Good work.


Brent
Systems Engineer / Consultant
CCNP, CCSP