5 Point Full Mesh VPN Mistery 1

[PaoloZ]

I've installed a full mesh 5 point VPN between 506E Pixes.
After completing the deployment of the VPN it worked perfectly for about 24 hours, the IPSec tunnels collapsed and went completely dead.
Restarting the Pix was ineffective, nor rebuilding the configuration on each node...

I've tryed to rebuild the VPN for about 2 days (40 hours work), but I'm not able to create nothing, not even a site-to-site VPN between two nodes.

The ISP says it doesn't filter UDP port 500 or IP Protocol 50 (but the first answer came from a commercial guy).


HELP !!!!!!



These are the configurations of the 5 PIX

IX 1
PIX Version 6.3(1)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
hostname Assago
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
access-list inside_access_in permit ip any any
access-list inside_access_in permit icmp any any
access-list outside_access_in permit ip any any
access-list outside_access_in permit icmp any any
access-list inside_outbound_nat0_acl permit ip 10.100.2.0 255.255.255.0 10.100.3.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.100.2.0 255.255.255.0 10.100.20.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.100.2.0 255.255.255.0 10.100.21.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.100.2.0 255.255.255.0 10.100.22.0 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.100.2.0 255.255.255.0 10.100.3.0 255.255.255.0
access-list outside_cryptomap_40 permit ip 10.100.2.0 255.255.255.0 10.100.20.0 255.255.255.0
access-list outside_cryptomap_60 permit ip 10.100.2.0 255.255.255.0 10.100.21.0 255.255.255.0
access-list outside_cryptomap_80 permit ip 10.100.2.0 255.255.255.0 10.100.22.0 255.255.255.0
pager lines 24
icmp permit any outside
icmp permit any inside
mtu outside 1500
mtu inside 1500
ip address outside xx.xx.xx.xx 255.255.255.248
ip address inside 10.100.2.1 255.255.255.0
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 xx.xx.xx.xx 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
http server enable
http 0.0.0.0 0.0.0.0 outside
http 0.0.0.0 0.0.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto map outside_map 20 ipsec-isakmp
crypto map outside_map 20 match address outside_cryptomap_20
crypto map outside_map 20 set peer xx.xx.xx.xx
crypto map outside_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 40 ipsec-isakmp
crypto map outside_map 40 match address outside_cryptomap_40
crypto map outside_map 40 set peer xx.xx.xx.xx
crypto map outside_map 40 set transform-set ESP-3DES-MD5
crypto map outside_map 60 ipsec-isakmp
crypto map outside_map 60 match address outside_cryptomap_60
crypto map outside_map 60 set peer xx.xx.xx.xx
crypto map outside_map 60 set transform-set ESP-3DES-MD5
crypto map outside_map 80 ipsec-isakmp
crypto map outside_map 80 match address outside_cryptomap_80
crypto map outside_map 80 set peer xx.xx.xx.xx
crypto map outside_map 80 set transform-set ESP-3DES-MD5
crypto map outside_map interface outside
isakmp enable outside
isakmp key xxxxx address xx.xx.xx.xx netmask 255.255.255.255 no-xauth no-config-mode
isakmp key xxxxx address xx.xx.xx.xx netmask 255.255.255.255 no-xauth no-config-mode
isakmp key xxxxx address xx.xx.xx.xx netmask 255.255.255.255 no-xauth no-config-mode
isakmp key xxxxx address xx.xx.xx.xx netmask 255.255.255.255 no-xauth no-config-mode
isakmp identity address
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400


IX2
PIX Version 6.3(1)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
hostname Tamburini
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
access-list inside_access_in permit ip any any
access-list inside_access_in permit icmp any any
access-list outside_access_in permit ip any any
access-list outside_access_in permit icmp any any
access-list inside_outbound_nat0_acl permit ip 10.100.3.0 255.255.255.0 10.100.2.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.100.3.0 255.255.255.0 10.100.20.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.100.3.0 255.255.255.0 10.100.21.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.100.3.0 255.255.255.0 10.100.22.0 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.100.3.0 255.255.255.0 10.100.2.0 255.255.255.0
access-list outside_cryptomap_40 permit ip 10.100.3.0 255.255.255.0 10.100.20.0 255.255.255.0
access-list outside_cryptomap_60 permit ip 10.100.3.0 255.255.255.0 10.100.21.0 255.255.255.0
access-list outside_cryptomap_80 permit ip 10.100.3.0 255.255.255.0 10.100.22.0 255.255.255.0
pager lines 24
icmp permit any outside
icmp permit any inside
mtu outside 1500
mtu inside 1500
ip address outside xx.xx.xx.xx 255.255.255.248
ip address inside 10.100.3.1 255.255.255.0
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 xx.xx.xx.xx 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
http server enable
http 0.0.0.0 0.0.0.0 outside
http 0.0.0.0 0.0.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto map outside_map 20 ipsec-isakmp
crypto map outside_map 20 match address outside_cryptomap_20
crypto map outside_map 20 set peer xx.xx.xx.xx
crypto map outside_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 40 ipsec-isakmp
crypto map outside_map 40 match address outside_cryptomap_40
crypto map outside_map 40 set peer xx.xx.xx.xx
crypto map outside_map 40 set transform-set ESP-3DES-MD5
crypto map outside_map 60 ipsec-isakmp
crypto map outside_map 60 match address outside_cryptomap_60
crypto map outside_map 60 set peer xx.xx.xx.xx
crypto map outside_map 60 set transform-set ESP-3DES-MD5
crypto map outside_map 80 ipsec-isakmp
crypto map outside_map 80 match address outside_cryptomap_80
crypto map outside_map 80 set peer xx.xx.xx.xx
crypto map outside_map 80 set transform-set ESP-3DES-MD5
crypto map outside_map interface outside
isakmp enable outside
isakmp key xxxxx address xx.xx.xx.xx netmask 255.255.255.255 no-xauth no-config-mode
isakmp key xxxxx address xx.xx.xx.xx netmask 255.255.255.255 no-xauth no-config-mode
isakmp key xxxxx address xx.xx.xx.xx netmask 255.255.255.255 no-xauth no-config-mode
isakmp key xxxxx address xx.xx.xx.xx netmask 255.255.255.255 no-xauth no-config-mode
isakmp identity address
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400

IX3
PIX Version 6.3(1)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
hostname Bologna
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
access-list inside_access_in permit ip any any
access-list inside_access_in permit icmp any any
access-list outside_access_in permit ip any any
access-list outside_access_in permit icmp any any
access-list inside_outbound_nat0_acl permit ip 10.100.20.0 255.255.255.0 10.100.2.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.100.20.0 255.255.255.0 10.100.3.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.100.20.0 255.255.255.0 10.100.21.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.100.20.0 255.255.255.0 10.100.22.0 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.100.20.0 255.255.255.0 10.100.2.0 255.255.255.0
access-list outside_cryptomap_40 permit ip 10.100.20.0 255.255.255.0 10.100.3.0 255.255.255.0
access-list outside_cryptomap_60 permit ip 10.100.20.0 255.255.255.0 10.100.21.0 255.255.255.0
access-list outside_cryptomap_80 permit ip 10.100.20.0 255.255.255.0 10.100.22.0 255.255.255.0
pager lines 24
icmp permit any outside
icmp permit any inside
mtu outside 1500
mtu inside 1500
ip address outside xx.xx.xx.xx 255.255.255.248
ip address inside 10.100.20.1 255.255.255.0
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 xx.xx.xx.xx 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
http server enable
http 0.0.0.0 0.0.0.0 outside
http 0.0.0.0 0.0.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto map outside_map 20 ipsec-isakmp
crypto map outside_map 20 match address outside_cryptomap_20
crypto map outside_map 20 set peer xx.xx.xx.xx
crypto map outside_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 40 ipsec-isakmp
crypto map outside_map 40 match address outside_cryptomap_40
crypto map outside_map 40 set peer xx.xx.xx.xx
crypto map outside_map 40 set transform-set ESP-3DES-MD5
crypto map outside_map 60 ipsec-isakmp
crypto map outside_map 60 match address outside_cryptomap_60
crypto map outside_map 60 set peer xx.xx.xx.xx
crypto map outside_map 60 set transform-set ESP-3DES-MD5
crypto map outside_map 80 ipsec-isakmp
crypto map outside_map 80 match address outside_cryptomap_80
crypto map outside_map 80 set peer xx.xx.xx.xx
crypto map outside_map 80 set transform-set ESP-3DES-MD5
crypto map outside_map interface outside
isakmp enable outside
isakmp key xxxxx address xx.xx.xx.xx netmask 255.255.255.255 no-xauth no-config-mode
isakmp key xxxxx address xx.xx.xx.xx netmask 255.255.255.255 no-xauth no-config-mode
isakmp key xxxxx address xx.xx.xx.xx netmask 255.255.255.255 no-xauth no-config-mode
isakmp key xxxxx address xx.xx.xx.xx netmask 255.255.255.255 no-xauth no-config-mode
isakmp identity address
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400


IX4
PIX Version 6.3(1)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
hostname Pesaro
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
access-list inside_access_in permit ip any any
access-list inside_access_in permit icmp any any
access-list outside_access_in permit ip any any
access-list outside_access_in permit icmp any any
access-list inside_outbound_nat0_acl permit ip 10.100.21.0 255.255.255.0 10.100.2.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.100.21.0 255.255.255.0 10.100.3.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.100.21.0 255.255.255.0 10.100.20.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.100.21.0 255.255.255.0 10.100.22.0 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.100.21.0 255.255.255.0 10.100.2.0 255.255.255.0
access-list outside_cryptomap_40 permit ip 10.100.21.0 255.255.255.0 10.100.3.0 255.255.255.0
access-list outside_cryptomap_60 permit ip 10.100.21.0 255.255.255.0 10.100.20.0 255.255.255.0
access-list outside_cryptomap_80 permit ip 10.100.21.0 255.255.255.0 10.100.22.0 255.255.255.0
pager lines 24
icmp permit any outside
icmp permit any inside
mtu outside 1500
mtu inside 1500
ip address outside xx.xx.xx.xx 255.255.255.248
ip address inside 10.100.21.1 255.255.255.0
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 xx.xx.xx.xx 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
http server enable
http 0.0.0.0 0.0.0.0 outside
http 0.0.0.0 0.0.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto map outside_map 20 ipsec-isakmp
crypto map outside_map 20 match address outside_cryptomap_20
crypto map outside_map 20 set peer xx.xx.xx.xx
crypto map outside_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 40 ipsec-isakmp
crypto map outside_map 40 match address outside_cryptomap_40
crypto map outside_map 40 set peer xx.xx.xx.xx
crypto map outside_map 40 set transform-set ESP-3DES-MD5
crypto map outside_map 60 ipsec-isakmp
crypto map outside_map 60 match address outside_cryptomap_60
crypto map outside_map 60 set peer xx.xx.xx.xx
crypto map outside_map 60 set transform-set ESP-3DES-MD5
crypto map outside_map 80 ipsec-isakmp
crypto map outside_map 80 match address outside_cryptomap_80
crypto map outside_map 80 set peer xx.xx.xx.xx
crypto map outside_map 80 set transform-set ESP-3DES-MD5
crypto map outside_map interface outside
isakmp enable outside
isakmp key xxxxx address xx.xx.xx.xx netmask 255.255.255.255 no-xauth no-config-mode
isakmp key xxxxx address xx.xx.xx.xx netmask 255.255.255.255 no-xauth no-config-mode
isakmp key xxxxx address xx.xx.xx.xx netmask 255.255.255.255 no-xauth no-config-mode
isakmp key xxxxx address xx.xx.xx.xx netmask 255.255.255.255 no-xauth no-config-mode
isakmp identity address
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400

IX5
PIX Version 6.3(1)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
hostname Roma
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
access-list inside_access_in permit ip any any
access-list inside_access_in permit icmp any any
access-list outside_access_in permit ip any any
access-list outside_access_in permit icmp any any
access-list inside_outbound_nat0_acl permit ip 10.100.22.0 255.255.255.010.100.2.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.100.22.0 255.255.255.010.100.3.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.100.22.0 255.255.255.010.100.20.0 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.100.22.0 255.255.255.010.100.21.0 255.255.255.0
access-list outside_cryptomap_20 permit ip 10.100.22.0 255.255.255.010.100.2.0 255.255.255.0
access-list outside_cryptomap_40 permit ip 10.100.22.0 255.255.255.010.100.3.0 255.255.255.0
access-list outside_cryptomap_60 permit ip 10.100.22.0 255.255.255.010.100.20.0 255.255.255.0
access-list outside_cryptomap_80 permit ip 10.100.22.0 255.255.255.010.100.21.0 255.255.255.0
pager lines 24
icmp permit any outside
icmp permit any inside
mtu outside 1500
mtu inside 1500
ip address outside xx.xx.xx.xx 255.255.255.248
ip address inside 10.100.22.1 255.255.255.0
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 xx.xx.xx.xx 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
http server enable
http 0.0.0.0 0.0.0.0 outside
http 0.0.0.0 0.0.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto map outside_map 20 ipsec-isakmp
crypto map outside_map 20 match address outside_cryptomap_20
crypto map outside_map 20 set peer xx.xx.xx.xx
crypto map outside_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 40 ipsec-isakmp
crypto map outside_map 40 match address outside_cryptomap_40
crypto map outside_map 40 set peer xx.xx.xx.xx
crypto map outside_map 40 set transform-set ESP-3DES-MD5
crypto map outside_map 60 ipsec-isakmp
crypto map outside_map 60 match address outside_cryptomap_60
crypto map outside_map 60 set peer xx.xx.xx.xx
crypto map outside_map 60 set transform-set ESP-3DES-MD5
crypto map outside_map 80 ipsec-isakmp
crypto map outside_map 80 match address outside_cryptomap_80
crypto map outside_map 80 set peer xx.xx.xx.xx
crypto map outside_map 80 set transform-set ESP-3DES-MD5
crypto map outside_map interface outside
isakmp enable outside
isakmp key xxxxx address xx.xx.xx.xx netmask 255.255.255.255 no-xauth no-config-mode
isakmp key xxxxx address xx.xx.xx.xx netmask 255.255.255.255 no-xauth no-config-mode
isakmp key xxxxx address xx.xx.xx.xx netmask 255.255.255.255 no-xauth no-config-mode
isakmp key xxxxx address xx.xx.xx.xx netmask 255.255.255.255 no-xauth no-config-mode
isakmp identity address
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400

 

[dopehead]

Have your tried "show crypto isa sa" ? and maybe debugging on the key exchange "debug crypto isakmp"

Doesn't seem like an isp prob if it worked before and now it doesn't

Jan

 

[PaoloZ]

After the nth attempt I was able to see the 5 VPNS work for about 12 hours, than a compete collapse.
During the day sporadic ipSec connections are established.

This is the result of show crypto isa sa:

Total : 3
Embryonic : 0
dst src state pending created
xx.xx.xx.xx xx.xx.xx.xx QM_IDLE 0 2
xx.xx.xx.xx xx.xx.xx.xx QM_IDLE 0 2
xx.xx.xx.xx xx.xx.xx.xx QM_IDLE 0 2


Result of firewall command: "show crypto ipsec sa"

interface: outside
Crypto map tag: outside_map, local addr. xx.xx.xx.xx
local ident (addr/mask/prot/port): (10.100.2.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (10.100.3.0/255.255.255.0/0/0)
current_peer: xx.xx.xx.xx
PERMIT, flags={origin_is_acl,}
#pkts encaps: 88, #pkts encrypt: 88, #pkts digest 88
#pkts decaps: 10, #pkts decrypt: 10, #pkts verify 10
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0
#send errors 30, #recv errors 0
local crypto endpt.: xx.xx.xx.xx, remote crypto endpt.: xx.xx.xx.xx
path mtu 1500, ipsec overhead 56, media mtu 1500
current outbound spi: 0
inbound esp sas:
inbound ah sas:
inbound pcp sas:
outbound esp sas:
outbound ah sas:
outbound pcp sas:

Speaking with the ISP technicians I've learned that they are impementing a drastic policy about MTU 1500 upon the ISP net.

Is it possible that decreasing the MTU outside of the pixes could solve the problem ?

If yes, what is the ideal MTU ?

Thanks

Paolo

 

[yizhar]

HI.

> Is it possible that decreasing the MTU outside of the pixes could solve the problem ?
It is possible. Try it.
I would start with MTU of 1300.

You should try to get more info from the pix devices.
Use syslog messages all the time, and use debug commands from time to time (when the tunnel works and when not).

> access-list outside_access_in permit ip any any
This seems like a bad idea, unless it is all in a lab.



Yizhar Hurwitz

http://teachers.sivan.co.il/yizhar

 

[PaoloZ]

>> access-list outside_access_in permit ip any any
>This seems like a bad idea, unless it is all in a lab.

Thanks, we are testing the VPN deployed without connection to the real nets.

What would be the best policy to give full access to the VPN, something like :

access-list outside_access_in permit ip 10.100.xx.0 255.255.255.0 any

for each ot he 4 remote nets.

Paolo

 

[yizhar]

HI.

> What would be the best policy to give full access to the VPN, something like
If you're using "sysopt connection permit-ipsec", then you do not need to modify "access-list outside_access_in ..."

If you are going for granular control and rules, than that is a different story and probably will be a bit complex in your full mesh design.
However this:
> access-list outside_access_in permit ip 10.100.xx.0 255.255.255.0 any
Should work if you disable "sysopt connection permit-ipsec".



Yizhar Hurwitz

http://teachers.sivan.co.il/yizhar