PIX 506 VPN over PPPOE help

[cibt]

I am installing a PIX506 on a DSL line that uses PPPOE. The PPPOE is configured properly and everything works fine. All outbound internet traffic is good. Now, I am trying to get the site-to-site VPN working. I have two possible tunnels to connect to that go to 10.6 and 10.2. I have debug crypto isakmp/ipsec turned on, but I never get any logging. It seems like no VPN interesting traffic ever gets generated (I have ping -t setup for 10.2.x.x to generate the tunnel). What I am missing that is blocking the tunnel from even trying to be created? Here is the config:

show run
: Saved
:
PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password sPqq5mY0Hm3DBbxP encrypted
passwd sPqq5mY0Hm3DBbxP encrypted
hostname
domain-name <skip>
clock summer-time EST recurring 2 Sun Mar 2:00 1 Sun Nov 2:00
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
<--- More --->

fixup protocol tftp 69
names
access-list IpsecVpn permit ip 10.9.0.0 255.255.0.0 10.2.0.0 255.255.0.0
access-list Internal permit ip 10.9.0.0 255.255.0.0 10.2.0.0 255.255.0.0
access-list Internal permit ip 10.9.0.0 255.255.0.0 10.6.0.0 255.255.0.0
access-list Internal permit icmp any any
access-list Internal permit udp any any eq domain
access-list Internal permit tcp any any eq www
access-list Internal permit tcp any any eq https
access-list Internal permit ip any any
access-list External permit icmp any any
access-list IpsecVpnSf permit ip 10.9.0.0 255.255.0.0 10.6.0.0 255.255.0.0
access-list Nat0 permit ip 10.9.0.0 255.255.0.0 10.2.0.0 255.255.0.0
access-list Nat0 permit ip 10.9.0.0 255.255.0.0 10.6.0.0 255.255.0.0
pager lines 24
logging on
logging timestamp
logging console errors
logging trap notifications
logging host inside 10.2.30.202 17/1514
mtu outside 1492
mtu inside 1492
ip address outside pppoe setroute
ip address inside 10.9.1.1 255.255.0.0
<--- More --->

ip audit info action alarm
ip audit attack action alarm
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list Nat0
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-group External in interface outside
access-group Internal in interface inside
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 10.0.0.0 255.0.0.0 inside
floodguard enable
<--- More --->

fragment chain 1
sysopt connection permit-ipsec
crypto ipsec transform-set strong esp-3des esp-sha-hmac
crypto ipsec transform-set des esp-des esp-md5-hmac
crypto map VpnMap 15 ipsec-isakmp
crypto map VpnMap 15 match address IpsecVpn
crypto map VpnMap 15 set peer <z.z.z.z>
crypto map VpnMap 15 set transform-set des
crypto map VpnMap 20 ipsec-isakmp
crypto map VpnMap 20 match address IpsecVpnSf
crypto map VpnMap 20 set peer <y.y.y.y>
crypto map VpnMap 20 set transform-set des
isakmp enable outside
isakmp key ******** address <y.y.y.y> netmask 255.255.255.255
isakmp key ******** address <z.z.z.z> netmask 255.255.255.255 no-xauth no-config-mode
isakmp identity address
isakmp policy 5 authentication pre-share
isakmp policy 5 encryption des
isakmp policy 5 hash md5
isakmp policy 5 group 1
isakmp policy 5 lifetime 28800
telnet 10.0.0.0 255.0.0.0 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
<--- More --->

ssh timeout 60
management-access inside
console timeout 0
vpdn group pppoex request dialout pppoe
vpdn group pppoex localname <skip>
vpdn group pppoex ppp authentication pap
vpdn username <skip> password *********
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
terminal width 80
Cryptochecksum:2c0b62e673a5aa92cd322c2f05d18f2b
: end

PixTvcHo(config)#

 

[Minue]

Hello
I have taken a quick look at your config.For starter try taking out this line.
"access-group Internal in interface inside"
Also do you have a static public IP for the PIX?Do you have control of the other side of the tunnels are they configured correctly?
You will also need to permit UDP isakmp and esp
Will get back to you
Regards

 

[cibt]

It is a pppoe connection, so the outside address dynamic.

 

[Minue]

Hello
I am using a pppoe connection also.But my address is static.
To do a site-to-site VPN you will need static address.Or hope your ISP give long leases to the dynamic address.And when the address get change,hust change it on the PIX to suit.But it's not a professional solution.
Any first troubleshoot the configuration by taking out that access-list I mention ealier.And let us know how it goes.
Regards

 

[cmptrnerd]

I was told that this can be done by setting the host site as an easy VPN server and then making your remote Pix an easy VPN client. I'm going to try this between my office and my home pix since my home has a dsl ppoe connection.


Mark

 

[boymarty24]

Or you can try using the isakmp identity key-id command

This command is used with dynamic vpn endpoints