Pix 501 tunnel to Monowall issue

[BrotherJones]

hello all, I am trying to setup an ipsec tunnel from my apartment's 501 to my office (connecting to a Monowall). The system admin gave me this list of info and I configured my pix with it, but can't get a tunnel established at all. I'm sure I messed up on the pix configuration somewhere. Does anything stand out? Thanks.

Info from the system admin (config info in the Monowall)
remote subnet 192.168.129.0/24
remote gateway 216.x.x.70
Phase 1 (authentication)
Negotiation Mode:Aggressive
My Identifier:My IP Address (this setting varies)
Encryption Algorithm: 3Des
Hash algorithm: MD5
DH Key Group: 1
Lifetime: 86400
Authentication method: Pre-shared Key
Pre-shared Key: ********

Phase 2roposal
Protocol:ESP
Encryption Algorithms: 3Des
Hash Algorithms: MD5
PFS Key Group:1
Lifetime 86400


My Pix 501 Config
PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password j1FJaH.3aOH9j1N3 encrypted
passwd a4rBB8i2E9n08egq encrypted
hostname pixfirewall
domain-name x.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol pptp 1723
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list inbound permit icmp any any echo-reply
access-list no-nat permit ip 172.17.1.0 255.255.255.0 192.168.129.0 255.255.255.0
access-list no-nat permit ip 192.168.129.0 255.255.255.0 172.17.1.0 255.255.255.0
pager lines 24
logging on
mtu outside 1500
mtu inside 1500
ip address outside dhcp setroute
ip address inside 172.17.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list no-nat
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set monovpnset esp-3des esp-md5-hmac
crypto ipsec security-association lifetime kilobytes 5000
crypto map monovpnmap 10 ipsec-isakmp
crypto map monovpnmap 10 match address monovpn
crypto map monovpnmap 10 set peer 216.x.x.70
crypto map monovpnmap 10 set transform-set monovpnset
crypto map monovpnmap 10 set security-association lifetime seconds 86400 kilobytes 5000
crypto map monovpnmap interface outside
isakmp enable outside
isakmp key ******** address 216.x.x.70 netmask 255.255.255.255
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash md5
isakmp policy 10 group 1
isakmp policy 10 lifetime 86400
telnet 172.17.1.0 255.255.255.0 inside
telnet timeout 60
ssh 172.17.1.0 255.255.255.0 inside
ssh timeout 15
console timeout 0
dhcpd address 172.17.1.5-172.17.1.25 inside
dhcpd dns x.x.x.x
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd enable inside
terminal width 80
Cryptochecksum:aaae90cbfe7c0887c678890c66f336ea
: end

 

[wirelesspeap]

you need this statement:

crypto map monovpnmap 10 set pfs group1

that will enable psf on phase II to match with the other
side.

 

[wirelesspeap]

you need this statement:

isakmp identity address
crypto map monovpnmap 10 set pfs group1

that will enable psf on phase II to match with the other
side.

 

[BrotherJones]

thanks wirelesspeap.

the first statement took, but the 2nd command (the crypto map one) generated this error -
This crypto map is incomplete
To remedy the situation, add a peer and a valid access-list to this crypto map.

 

[wirelesspeap]

I've never dealt with Pix501 so I am not sure if pfs is supported. I only dealt with 506, 506E, 515, 515E and higher model and I know pfs is supported because I've done
it many times.

 

[BrotherJones]

ok, no prob. I am going to do some reading over the next few days and try to figure this out. Thanks for trying to help!