I am having trouble creating a site-to-site IPSec VPN tunnel between two PIX devices. The two seperate sites/networks are configured as class A but I was forced to configure the PIX as class C.. so I dont expect the Server03 sites to talk until I reconfigure them to Class C. My question is, how can I test that the pix’s are establishing a secure tunnel at this point?
PIX 1:
sysopt connection permit-ipsec
sysopt connection permit-pptp
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set strong esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map company2 20 ipsec-isakmp
crypto map company2 20 match address 90
crypto map company2 20 set peer 64.190.140.10
crypto map company2 20 set transform-set strong
crypto map company2 interface outside
isakmp enable outside
isakmp key ******** address 64.190.140.10 netmask 255.255.255.255
isakmp policy 9 authentication pre-share
isakmp policy 9 encryption 3des
isakmp policy 9 hash sha
isakmp policy 9 group 1
isakmp policy 9 lifetime 86400
global (outside) 1 interface
nat (inside) 0 access-list 90
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-list splitTunnelAcl permit ip 10.0.0.0 255.255.255.0 any
access-list 101 permit ip 10.0.0.0 255.255.255.0 10.0.1.0 255.255.255.0
access-list 90 permit ip 10.0.0.0 255.255.255.0 10.0.1.0 255.255.255.0
access-list inbound permit ip 10.0.0.0 255.255.255.0 10.0.1.0 255.255.255.0
PIX 2:
sysopt connection permit-ipsec
sysopt connection permit-pptp
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set strong esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map company2 10 ipsec-isakmp
crypto map company2 10 match address 80
crypto map company2 10 set peer 64.130.208.2
crypto map company2 10 set transform-set strong
crypto map company2 interface outside
isakmp enable outside
isakmp key ******** address 64.130.208.2 netmask 255.255.255.255
isakmp policy 8 authentication pre-share
isakmp policy 8 encryption 3des
isakmp policy 8 hash sha
isakmp policy 8 group 1
isakmp policy 8 lifetime 86400
global (outside) 1 interface
nat (inside) 0 access-list 80
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-list outside_cryptomap_dyn_20 permit ip any any
access-list splitTunnelAcl permit ip 10.0.1.0 255.255.255.0 any
access-list 101 permit ip 10.0.1.0 255.255.255.0 192.168.0.0 255.255.255.0
access-list 80 permit ip 10.0.1.0 255.255.255.0 10.0.0.0 255.255.255.0
I can provide more detail if needed. I did the site-to-site by the book. The only piece I skipped was a step in their book;
Step 8 Assign a pool of global addresses for NAT and PAT:
global (outside) 1 209.165.202.129-209.165.202.159
global (outside) 1 209.165.202.160
I was not able to add this command, it said the subnets overlapped.
This is what I followed: http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_62/config/sit2site.htm
Any help is GREATLY appreciated !!!