Networks

Ask something
Discussion Locked

Cisco PIX 501 VPN problem

0 helpful
8 replies

by jdelcalzo

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I have tried both to manually configure a 501 for a site to site VPN using ipsec. When I am finished it never even attempts to connect (as well as I can figure). When I go under monitoring and ipsec it reports 0 encapsulated packets. The admin of the other network says he can't even see any attempts to connect. I've checked the gateway IP a zillion times, as well as the pre-shared key. We've both confirmed everything possible in settings. Is there something I need to do to initiate the connection?

8 replies

by kryptos

Check weather there is attempt for Ipsec negotiate. You could initiate it by ?ping? any IP on other side of tunnel.

If there are not attempt to negotiate. Check the access-list which selects/qualifies interesting traffic (traffic which needs to be tunneled). Make the access-list matching on the both the ends.

Check If there are any access-list which may conflict with your VPN traffic. Use sysopt connection permit for ipsec traffic to by pass all access-lists.

thx,

by kryptos

VPN tunnels are only negotiated when there is flow of interesting traffic. A simple "ping" to other end is enough to initiate & establish VPN tunnel.

by jdelcalzo

I should have mentioned that I had tried to ping the inside of the other network. No response. And there was no attempt to connect that I could see when I had tried to ping.

by monice

Try using the following debug commands and post the results.

debug crypto ipsec ? Shows if a client is negotiating the IPSec portion of the VPN connection.

debug crypto isakmp ? Shows if the peers are negotiating the ISAKMP portion of the VPN connection.

These will help to determine if an attempt to connect is even made.

by kryptos

As you said there no attempt to even connect (assuming you have tried debug) It could be due to access-list , because VPN use the access list to determine the interesting traffic to be tunneled.
or probably your rules are conflicting.

Check the hit for access-list which select the VPN traffic.

This discussion is closed to new replies.