Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

Register Log in
  • Congratulations Westi on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

515E to Symantec FW

Status
Not open for further replies.
Tspiritstorm

Tspiritstorm

IS-IT--Management
Aug 24, 2003
7
US
I am trying to connect to a client and have been unable to do so. I even went to a bare-bones config and I am still nto seeing anything. My contact on the other end says his config is correct and I believe mine is all good. So here is my basic config. Could anyone take a look and possibly point me in the right direction or confirm my config?

PIX Version 6.3(1)
interface ethernet0 100full
interface ethernet1 100full
interface ethernet2 auto shutdown
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 intf2 security4
enable password xxxxxxxxxxxxxxxxxxx encrypted
passwd xxxxxxxxxxx.xxxxxxxx encrypted
hostname xxxxxx
domain-name xxxxxx.xxxxxxx.xxxxx
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
names
access-list acl_grp permit icmp any any
access-list 101 permit ip 192.168.1.0 255.255.255.0 192.168.100.0 255.255.255.0

pager lines 24
mtu outside 1500
mtu inside 1500
mtu intf2 1500
ip address outside xxx.xxx.xxx.xxx 255.255.255.224
ip address inside 192.168.1.1 255.255.255.0
no ip address intf2
ip audit info action alarm
ip audit attack action alarm
pdm history enable
arp timeout 14400
global (outside) 1 xxx.xxx.xxx.xxx
nat (inside) 0 access-list 101
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-group acl_grp in interface outside
access-group acl_grp in interface inside
route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 192.168.1.13 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set single esp-3des esp-md5-hmac
crypto map pix2sef 10 ipsec-isakmp
crypto map pix2sef 10 match address 101
crypto map pix2sef 10 set peer xxx.xxx.xxx.xxx
crypto map pix2sef 10 set transform-set single
crypto map pix2sef interface outside
isakmp enable outside
isakmp key ******** address xxx.xxx.xxx.xxx netmask 255.255.255.255
isakmp identity address
isakmp policy 5 authentication pre-share
isakmp policy 5 encryption 3des
isakmp policy 5 hash md5
isakmp policy 5 group 1
isakmp policy 5 lifetime 1080
telnet timeout 5
ssh timeout 5
console timeout 0
terminal width 80
 
Sort by date Sort by votes
Looks fine to me... I would configure debugs on the PIX and try to determine at which phase it is failing...

debug crypto isakmp
debug crypto ipsec

I would also request other side to look into debugs as well.
 
Upvote 0 Downvote
Thanks for the response...

I am not sure if this is my problem or not since I have not set up a VPN on the PIX before. From its appearance it almost seems I have something wrong in my config, any thoughts?

Running the debug cmd lines I get the following:

crypto_isakmp_process_block:src:xxx.xxx.xxx, dest:xxx.xxx.xxx spt:500 dpt:5
00
OAK_MM exchange
ISAKMP (0): processing SA payload. message ID = 0

ISAKMP (0): Checking ISAKMP transform 1 against priority 5 policy
ISAKMP: encryption 3DES-CBC
ISAKMP: hash MD5
ISAKMP: auth pre-share
ISAKMP: default group 1
ISAKMP: life type in seconds
ISAKMP: life duration (basic) of 64800
ISAKMP (0): atts are acceptable. Next payload is 3
ISAKMP (0): processing vendor id payload

ISAKMP (0): SA is doing pre-shared key authentication using id type ID_IPV4_ADDR

return status is IKMP_NO_ERROR
crypto_isakmp_process_block:src:xxx.xxx.xxx, dest:xxx.xxx.xxx spt:500 dpt:5
00
OAK_MM exchange
ISAKMP (0): processing KE payload. message ID = 0

ISAKMP (0): processing NONCE payload. message ID = 0

return status is IKMP_NO_ERROR
crypto_isakmp_process_block:src:xxx.xxx.xxx, dest:xxx.xxx.xxx spt:500 dpt:5
00
ISAKMP: reserved not zero on payload 5!
crypto_isakmp_process_block:src:xxx.xxx.xxx, dest:xxx.xxx.xxx spt:500 dpt:5
00
ISAKMP: reserved not zero on payload 5!
crypto_isakmp_process_block:src:xxx.xxx.xxx, dest:xxx.xxx.xxx spt:500 dpt:5
00
ISAKMP: reserved not zero on payload 5!

crypto_isakmp_process_block:src:xxx.xxx.xxx, dest:xxx.xxx.xxx spt:500 dpt:5
00
OAK_MM exchange
ISAKMP (0): processing SA payload. message ID = 0

ISAKMP (0): Checking ISAKMP transform 1 against priority 5 policy3
ISAKMP: encryption 3DES-CBC
ISAKMP: hash MD5
ISAKMP: auth pre-share
ISAKMP: default group 1
ISAKMP: life type in seconds
ISAKMP: life duration (basic) of 64800
ISAKMP (0): atts are acceptable. Next payload is 3
ISAKMP (0): processing vendor id payload

ISAKMP (0): SA is doing pre-shared key authentication using id type ID_IPV4_ADDR

return status is IKMP_NO_ERROR
crypto_isakmp_process_block:src:xxx.xxx.xxx, dest:xxx.xxx.xxx spt:500 dpt:5
00
OAK_MM exchange
ISAKMP (0): processing KE payload. message ID = 0

ISAKMP (0): processing NONCE payload. message ID = 0

return status is IKMP_NO_ERROR
crypto_isakmp_process_block:src:xxx.xxx.xxx, dest:xxx.xxx.xxx spt:500 dpt:5
00
ISAKMP: reserved not zero on payload 5!02010: 0 in use, 0 most used

crypto_isakmp_process_block:src:xxx.xxx.xxx, dest:xxx.xxx.xxx spt:500 dpt:5
00
ISAKMP: reserved not zero on payload 5!
crypto_isakmp_process_block:src:xxx.xxx.xxx, dest:xxx.xxx.xxx spt:500 dpt:5
00
ISAKMP: reserved not zero on payload 5!
ISAKMP (0): deleting SA: src xxx.xxx.xxx, dst xxx.xxx.xxx

crypto_isakmp_process_block:src:xxx.xxx.xxx, dest:xxx.xxx.xxx spt:500 dpt:5
00
OAK_MM exchange
ISAKMP (0): processing SA payload. message ID = 0

ISAKMP (0): Checking ISAKMP transform 1 against priority 5 policy
ISAKMP: encryption 3DES-CBC
ISAKMP: hash MD5
ISAKMP: auth pre-share
ISAKMP: default group 1
ISAKMP: life type in seconds
ISAKMP: life duration (basic) of 64800
ISAKMP (0): atts are acceptable. Next payload is 3
ISAKMP (0): processing vendor id payload

ISAKMP (0): SA is doing pre-shared key authentication using id type ID_IPV4_ADDR

return status is IKMP_NO_ERROR
ISADB: reaper checking SA 0xe4c2d4, conn_id = 0
ISADB: reaper checking SA 0xe4ad2c, conn_id = 0 DELETE IT!

VPN Peer:ISAKMP: Peer Info for xxx.xxx.xxx/500 not found - peers:0

ISADB: reaper checking SA 0xe4c2d4, conn_id = 0
ISADB: reaper checking SA 0xe4b4b4, conn_id = 0
crypto_isakmp_process_block:src:xxx.xxx.xxx, dest:xxx.xxx.xxx spt:500 dpt:5
00
OAK_MM exchange
ISAKMP (0): processing KE payload. message ID = 0

ISAKMP (0): processing NONCE payload. message ID = 0

return status is IKMP_NO_ERROR
crypto_isakmp_process_block:src:xxx.xxx.xxx, dest:xxx.xxx.xxx spt:500 dpt:5
00
ISAKMP: reserved not zero on payload 5!
crypto_isakmp_process_block:src:xxx.xxx.xxx, dest:xxx.xxx.xxx spt:500 dpt:5
00
ISAKMP: reserved not zero on payload 5!
crypto_isakmp_process_block:src:xxx.xxx.xxx, dest:xxx.xxx.xxx spt:500 dpt:5
00
ISAKMP: reserved not zero on payload 5!
ISAKMP (0): deleting SA: src xxx.xxx.xxx, dst xxx.xxx.xxx
ISADB: reaper checking SA 0xe4c2d4, conn_id = 0
DELETE IT!

VPN Peer:ISAKMP: Peer Info for xxx.xxx.xxx/500 not found - peers:0

ISADB: reaper checking SA 0xe4b4b4, conn_id = 0
crypto_isakmp_process_block:src:xxx.xxx.xxx, dest:xxx.xxx.xxx spt:500 dpt:5
00
OAK_MM exchange
ISAKMP (0): processing SA payload. message ID = 0

ISAKMP (0): Checking ISAKMP transform 1 against priority 5 policy
ISAKMP: encryption 3DES-CBC
ISAKMP: hash MD5
ISAKMP: auth pre-share
ISAKMP: default group 1
ISAKMP: life type in seconds
ISAKMP: life duration (basic) of 64800
ISAKMP (0): atts are acceptable. Next payload is 3
ISAKMP (0): processing vendor id payload

ISAKMP (0): SA is doing pre-shared key authentication using id type ID_IPV4_ADDR

return status is IKMP_NO_ERROR
crypto_isakmp_process_block:src:xxx.xxx.xxx, dest:xxx.xxx.xxx spt:500 dpt:5
00
OAK_MM exchange
ISAKMP (0): processing KE payload. message ID = 0

ISAKMP (0): processing NONCE payload. message ID = 0

return status is IKMP_NO_ERROR
crypto_isakmp_process_block:src:xxx.xxx.xxx, dest:xxx.xxx.xxx spt:500 dpt:5
00
ISAKMP: reserved not zero on payload 5!
crypto_isakmp_process_block:src:xxx.xxx.xxx, dest:xxx.xxx.xxx spt:500 dpt:5
00
ISAKMP: reserved not zero on payload 5!
crypto_isakmp_process_block:src:xxx.xxx.xxx, dest:xxx.xxx.xxx spt:500 dpt:5
00
ISAKMP: reserved not zero on payload 5!
ISAKMP (0): deleting SA: src xxx.xxx.xxx, dst xxx.xxx.xxx
ISADB: reaper checking SA 0xe4ad2c, conn_id = 0
ISADB: reaper checking SA 0xe4b4b4, conn_id = 0 DELETE IT!

VPN Peer:ISAKMP: Peer Info for xxx.xxx.xxx/500 not found - peers:0

ISADB: reaper checking SA 0xe4ad2c, conn_id = 0
ISAKMP (0): deleting SA: src xxx.xxx.xxx, dst xxx.xxx.xxx
ISADB: reaper checking SA 0xe4ad2c, conn_id = 0 DELETE IT!

VPN Peer:ISAKMP: Peer Info for xxx.xxx.xxx/500 not found - peers:0
 
Upvote 0 Downvote
The preshared keys are not matching... check the key on both ends and retype them correctly.
 
Upvote 0 Downvote
After making both keys match my log changed a bit. AM I reading this right showing me that something on my clients end is not set up correctly since the logs establish a connection then drops the connection based on bad source information?

crypto_isakmp_process_block:src:xxx.xxx.xxx.xxx, dest:xxx.xxx.xxx.xxx spt:500 dpt:5
00
OAK_MM exchange
ISAKMP (0): processing SA payload. message ID = 0

ISAKMP (0): Checking ISAKMP transform 1 against priority 5 policys
ISAKMP: encryption 3DES-CBC
ISAKMP: hash MD5
ISAKMP: auth pre-share
ISAKMP: default group 1
ISAKMP: life type in seconds
ISAKMP: life duration (basic) of 64800
ISAKMP (0): atts are acceptable. Next payload is 3
ISAKMP (0): processing vendor id payload

ISAKMP (0): SA is doing pre-shared key authentication using id type ID_IPV4_ADDR

return status is IKMP_NO_ERROR
crypto_isakmp_process_block:src:xxx.xxx.xxx.xxx, dest:xxx.xxx.xxx.xxx spt:500 dpt:5
00
OAK_MM exchange
ISAKMP (0): processing KE payload. message ID = 0

ISAKMP (0): processing NONCE payload. message ID = 0

return status is IKMP_NO_ERROR
crypto_isakmp_process_block:src:xxx.xxx.xxx.xxx, dest:xxx.xxx.xxx.xxx spt:500 dpt:5
00
OAK_MM exchange
ISAKMP (0): processing ID payload. message ID = 0
ISAKMP (0): processing HASH payload. message ID = 0
ISAKMP (0): SA has been authenticated

ISAKMP (0): ID payload
next-payload : 8
type : 1
protocol : 17
port : 500
length : 8
ISAKMP (0): Total payload length: 12
return status is IKMP_NO_ERROR
ISAKMP (0): sending INITIAL_CONTACT notify
ISAKMP (0): sending NOTIFY message 24578 protocol 1
ISAKMP (0): sending phase 1 RESPONDER_LIFETIME notify
ISAKMP (0): sending NOTIFY message 24576 protocol 1
VPN Peer: ISAKMP: Added new peer: ip:xxx.xxx.xxx.xxx/500 Total VPN Peers:1
VPN Peer: ISAKMP: Peer ip:xxx.xxx.xxx.xxx/500 Ref cnt incremented to:1 Total VPN
Peers:1
crypto_isakmp_process_block:src:xxx.xxx.xxx.xxx, dest:xxx.xxx.xxx.xxx spt:500 dpt:5
00
OAK_QM exchange
oakley_process_quick_mode:
OAK_QM_IDLE
ISAKMP (0): processing SA payload. message ID = 68144190

ISAKMP : Checking IPSec proposal 1

ISAKMP: transform 1, ESP_3DES
ISAKMP: attributes in transform:
ISAKMP: encaps is 1
ISAKMP: authenticator is HMAC-MD5
ISAKMP: SA life type in seconds
ISAKMP: SA life duration (basic) of 28800
ISAKMP (0): atts are acceptable.IPSEC(validate_proposal_request): proposal part
#1,
(key eng. msg.) dest= xxx.xxx.xxx.xxx, src= xxx.xxx.xxx.xxx,
dest_proxy= 192.168.1.0/255.255.255.0/0/0 (type=4),
src_proxy= 192.168.100.0/255.255.255.0/0/0 (type=4),
protocol= ESP, transform= esp-3des esp-md5-hmac ,
lifedur= 0s and 0kb,
spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x4

ISAKMP (0): processing NONCE payload. message ID = 68144190

ISAKMP (0): processing ID payload. message ID = 68144190
ISAKMP (0): ID_IPV4_ADDR_SUBNET src 192.168.100.0/255.255.255.0 prot 0 port 0
ISAKMP (0): processing ID payload. message ID = 68144190
ISAKMP (0): ID_IPV4_ADDR_SUBNET dst 192.168.1.0/255.255.255.0 prot 0 port 0IPSEC
(key_engine): got a queue event...
IPSEC(spi_response): getting spi 0x233ddc72(591256690) for SA
from xxx.xxx.xxx.xxx to xxx.xxx.xxx.xxx for prot 3

return status is IKMP_NO_ERRORh4
ISAKMP (0): sending NOTIFY message 11 protocol 302101: decaps: rec'd IPSEC packe
t has invalid spi for destaddr=xxx.xxx.xxx.xxx, prot=esp, spi=0x233ddc72(192703619
5)
402101: decaps: rec'd IPSEC packet has invalid spi for destaddr=xxx.xxx.xxx.xxx, p
rot=esp, spi=0x233ddc72(1927036195)
4
ISAKMP (0): sending NOTIFY message 11 protocol 302101: decaps: rec'd IPSEC packe
t has invalid spi for destaddr=xxx.xxx.xxx.xxx, prot=esp, spi=0x233ddc72(192703619
5)

ISAKMP (0): retransmitting phase 2...
crypto_isakmp_process_block:src:xxx.xxx.xxx.xxx, dest:xxx.xxx.xxx.xxx spt:500 dpt:5
00
ISAKMP (0): processing NOTIFY payload 16 protocol 0
spi 0, message ID = 681093952
return status is IKMP_NO_ERR_NO_TRANS
ISAKMP (0): retransmitting phase 2...
crypto_isakmp_process_block:src:xxx.xxx.xxx.xxx, dest:xxx.xxx.xxx.xxx spt:500 dpt:5
00
ISAKMP (0): processing NOTIFY payload 16 protocol 0
spi 0, message ID = 681093952
return status is IKMP_NO_ERR_NO_TRANS
ISAKMP (0): retransmitting phase 2...
crypto_isakmp_process_block:src:xxx.xxx.xxx.xxx, dest:xxx.xxx.xxx.xxx spt:500 dpt:5
00
ISAKMP (0): processing NOTIFY payload 16 protocol 0
spi 0, message ID = 681093952
return status is IKMP_NO_ERR_NO_TRANS
ISAKMP (0): retransmitting phase 2...
crypto_isakmp_process_block:src:xxx.xxx.xxx.xxx, dest:xxx.xxx.xxx.xxx spt:500 dpt:5
00
ISAKMP (0): processing NOTIFY payload 16 protocol 0
spi 0, message ID = 681093952
return status is IKMP_NO_ERR_NO_TRANS
return status is IKMP_NO_ERR_NO_TRANS
00
ISAKMP (0): processing NOTIFY payload 16 protocol 0
spi 0, message ID = 681093952
return status is IKMP_NO_ERR_NO_TRANS
ISAKMP (0): retransmitting phase 2...
Thane(config)#
crypto_isakmp_process_block:src:xxx.xxx.xxx.xxx, dest:xxx.xxx.xxx.xxx spt:500 dpt:5
00
ISAKMP (0): processing NOTIFY payload 16 protocol 0
spi 0, message ID = 681093952
ISAKMP (0): deleting SA: src xxx.xxx.xxx.xxx, dst xxx.xxx.xxx.xxx
return status is IKMP_NO_ERR_NO_TRANS
ISADB: reaper checking SA 0xe4a09c, conn_id = 0 DELETE IT!

VPN Peer: ISAKMP: Peer ip:xxx.xxx.xxx.xxx/500 Ref cnt decremented to:0 Total VPN
Peers:1
VPN Peer: ISAKMP: Deleted peer: ip:xxx.xxx.xxx.xxx/500 Total VPN peers:0
 
Upvote 0 Downvote
Also just as a curious note... How do I get around these two commands:

access-list acl_grp permit icmp any any
access-list 101 permit ip 192.168.1.0 255.255.255.0 192.168.100.0 255.255.255.0

In order to full access to the PDM? It seems the access-list 101 prevents that full access.

And thank you for all your help today. Tunnels are now up.
 
Upvote 0 Downvote
Status
Not open for further replies.

Similar threads

Sameer258
  • Locked
  • Question
Need Help to Find ip and mac address with email who one open my email
Replies
0
Views
779
Sameer258
Sameer258
Sparrow4
  • Locked
  • Question
Configure Avaya IPO R11 / VM Pro + Office365 or Exchange for voicemail to email
Replies
2
Views
648
Johnkite
Johnkite
Tommy_T
  • Locked
  • Question
Sonic wall - Have an issue remotely connectioning VNC and SMB (and AFP) to one of the 2 ISP circuits
Replies
1
Views
580
nnaarrnn
nnaarrnn
Russtoleum
  • Locked
  • Question
Windows client can't connect to sonicwall l2tp server
Replies
0
Views
147
Russtoleum
Russtoleum
ISDPCMAN
  • Locked
  • Question
Cannot connect to TZ-215 Sonicwall appliance with web browser!
Replies
0
Views
163
ISDPCMAN
ISDPCMAN

Part and Inventory Search

Sponsor

Back
Top