PIX 515E to ASA5510 vpn tunnel was working great...

[blade10]

All-

I had changed nothing on my side (PIX515E 6.3) and the tech on the other side ASA5510 claims to have changed nothing either..

The vpn tunnel is not working, we can't see eachother yet when I do a sho crypto isakmp SA it shows MQ_IDLE as being established between my public IP and their public IP.. he secret peer key good from both side...

What generally makes a vpn ipsec tunnel fail when you've exhausted all the logical stuff.... nothing looks changed yet connectivity is not there.. what gives.

I see many posts where engineers stated the same thing, nothing changed yet a tunnel that was working for 2 years now suddenly ceased to work.

I've done all the debug commands, nothing looks wrong, I added nor deleted any access-lists pertaining to this specific tunnel.

any suggestions at all? please help if you can...

blade

 

[NetworkGhost]

What does the IPSEC SA look like? Do you see the encrypted count incrementing? decrypted?

If you enable logging

logging buffered 6

and so a show log, do the logs display any errors when you try the VPN traffic?

http://www.wr-mem.com

 

[desperado618]

If ISAKMP shows QM_Idle, I doubt there will be an IPSEC SA.
Have you tried clearing the ISAKMP SA? After clearing the tunnel on both sides, turn on debugging (debug crypto isakmp 5). Paste a scrubbed version of the debug output in this forum. If would be best if the tunnel were initiated on the remote side.

http://www.NetLeets.com

IT Security news and information
In plain English