Weird pix-to-pix vpn issue 1

[smikes19]

Hi,
I have 4 other sites VPN'ed together pix-to-pix. When I try to change up the isakmp key or the access-list line to match, the PIX denies all internet access. Sometimes if I replace the lines, internet access works again, sometimes it won't. I end up having to reload the original config. It'd be nice for the internet access to work constantly so that I can change the configs up without having to worry. Anyone know why this happens or is there a work around?

thanks!

 

[Iota]

Yes... I'm assuming you're telneting into pix through the VPN tunnel. When you make changes to the tunnel, you will interrupt sustain connections to the pix.

The best way to work on a pix is via SSH. You want:
(in config term)
ca generate rsa 1024
ssh 0.0.0.0 0.0.0.0 outside

First line generates your Encryption key.
2nd line allows you to SSH into your pix from anywhere--You must use the outside IP address of the pix.

As for SSH clients, I use SecureCRT, but there are free ones out there as well, just go to google.

-Iota

 

[Iota]

BTW... When you finally establish the SSH PIX connection,
Pix supports DES encryption, not 3DES, Blowbish, etchh
the username for the session is: pix
and the password for the session is: <telnet pass>

Then you just enable like normal.

Iota

 

[smikes19]

Thanks Iota,
I dont know if I want to go that far...as i'll probably never use it. Im actually telnet'ing into the inside interface. When I make changes to the VPN config from there, access from the inside to the outside comes to a halt...sorry I should have been more clear on that one.

--mike

 

[Iota]

How about a Config post minus passwords ?

-Iota

 

[yizhar]

HI.

What pix version?
It might have been fixed in newer version, try searching CISCO web site for open cavets.

You can try to disable IPSEC while modifying it, like
no isakmp enable outside
no nat 0 access-list ...
[... make changes ...]
nat 0 access-list ...
isakmp enable outside

(Maybe unbinding the crypto map will also do the job, maybe only disabling nat 0 is enough, you can try and see).

You should also capture the syslog messages you get when the Internet connection is stopped, this will help you pin point the cause of the problem.

You should also read about the
clear xlate
and other clear commands, maybe this can also help.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar