PIX 506e unable to establish a VPN connection HELP!

[PollekeICT]

PIX 506e.

Unable to VPN, error is 106023 deny udp src xxxx dest /500

It seams like all packets going thru the PIX to the internal interface. VPN must be established to te PIX

Anyone has an idea, i really apprechiate any reaction.

Thanx Paul

 

[flauret]

hi guy,

I think like evrybody here precision could be better to help you.

anyway, from where to what do you want to establish a vpn? if the goal is to do it with the same hardware like pix to pix. you should check if you're provider does not filter anything on your line.
also take care to activate isakmp outside( i think it's outside)

did you check your setting with a sample from cisco web site?

come back and tell us more

fred

 

[PollekeICT]

Hi Fred,

Thanks for you reply.

Run both wizards for enabling Site-to-Site VPN with another 506e, and Cisco VPN Client.
This other 506e is accepting VPN client.
ISP is not filtering because packets do arrive at the PIX, and yes isakmp outside is enabled.

I remember PDM pop-upped a warning stating something like, "When you do this the unit isn't accessable from the outside". Also when i enable telnet for a specific ip (My IP) the packet go straight to the inside network.

I compared 4 succesfull installations of a PIX 506e with this one, and can't find the responsible config-line.

I posted a earlier thread where the running config is in.

Thanks in advance,

Paul

 

[LloydSev]

Go ahead and post both configs for us..

Remember to post responsibly and remove any potential security related stuff.

Also, the PDM (as you will come to know) is not well thought of by most as it doesn't work as well as it should.

http://www.cisco.com/en/US/products...s_configuration_example09186a0080094761.shtml

Computer/Network Technician
CCNA

 

[PollekeICT]

Thanks Lloyd for you reaction.

I tried reloading the system with telnet and that solved it.

 

[LloydSev]

Glad you got it working!

Computer/Network Technician
CCNA

 

[Decryptk33p3r]

Yes, UDP/500 is part of the crypto process, but if you are passing through a PIX from something like a client, If this is the case then you need UDP/500 protocol 50 & 51 AH & ESP opened to pass client through. If you are trying to just L2L crypto tunnel up that's different. What version are you running 6.3.4 ? Is this a dynamic setup or IP to IP? All of this matters, fill me in & I can help you further.
Thanks
Mike