VPN tunnel is up but no traffic from end to end

[tanker135]

ALL:

The tunnel is established (good phase 1&2) sh cry isa sa and sh cry ips sa both show good. However, I cannot ping end to end. I've checked routing. Nothing helps. I did change network 172.18.129.0 to 192.168.1.0 and all is well. Do you have any suggestions?

Here is the config of one PIX the other PIX is identical except for the addresses and ACL 101(it mirrors the other). The really frustrating part is that I've built many PIX to PIX VPNs in the past.

nameif ethernet0 outside security0
nameif ethernet1 inside security100
hostname HQ-VPN-PIX
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
names
access-list 101 permit ip 172.18.129.0 255.255.255.0 172.18.0.0 255.255.192.0
pager lines 24
logging on
no logging timestamp
no logging standby
no logging console
no logging monitor
no logging buffered
no logging trap
no logging history
logging facility 20
logging queue 512
interface ethernet0 10baseT
interface ethernet1 10full
mtu outside 1500
mtu inside 1500
ip address outside 66.x.x.x 255.255.255.192
ip address inside 172.18.0.21 255.255.192.0
arp timeout 14400
nat 0 access-list 101
route outside 0.0.0.0 0.0.0.0 66.x.x.x 1
timeout xlate 3:00:00 conn 1:00:00 half-closed 0:10:00 udp 0:02:00
timeout rpc 0:10:00 h323 0:05:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
AAA-server RADIUS protocol radius
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
no sysopt route dnat
crypto ipsec transform-set chevelle esp-3des esp-md5-hmac
crypto map transam 1 ipsec-isakmp
crypto map transam 1 match address 101
crypto map transam 1 set peer 207.x.x.x
crypto map transam 1 set transform-set chevelle
crypto map transam interface outside
isakmp key xxxxx address 207.x.x.x netmask 255.255.255.255
isakmp enable outside
isakmp identity address
isakmp policy 1 authentication pre-share
isakmp policy 1 encryption 3des
isakmp policy 1 hash md5
isakmp policy 1 group 1
isakmp policy 1 lifetime 3600
isakmp keepalive 10 2
terminal width 80

 

[mynus]

This is a stupid point because I'm guessing you've actually checked for other traffic...but can you telnet to the other end point? It doesn't look like you've permitted traffic from your endpoint into your network.