SITE-to-SITE vpn

[AlexR909]

I tried to do a site-to-site vpn connection using 2 of my pix515/515e I tried to configure the vpn using the ASDM vpn wizard. but i can't seem to make it talk .

here's my config

10.10.100.50[pc]--[pix515e]--<192.168.0.0/24>--[pix515]--10.11.100.10[pc]

I basically want to tunnel 10.10.100.0 to the other end of the pix and vice versa.

pix515e# show run
: Saved
:
PIX Version 7.0(5)
!
hostname pix515e
domain-name domain1.lan
enable password <pass> encrypted
names
dns-guard
!
interface Ethernet0
nameif outside
security-level 0
ip address 192.168.0.124 255.255.255.0
!
interface Ethernet1
nameif inside
security-level 100
ip address 10.10.100.1 255.255.255.0
!
interface Ethernet2
shutdown
no nameif
no security-level
no ip address
!
passwd <pass> encrypted
ftp mode passive
same-security-traffic permit intra-interface
access-list 101 extended permit icmp any any echo-reply
access-list 101 extended permit icmp any any time-exceeded
access-list 101 extended permit icmp any any unreachable
access-list inside_nat0_outbound extended permit ip 10.10.100.0 255.255.255.0 10.11.100.0 255.255.255.0
access-list outside_cryptomap_20 extended permit ip 10.10.100.0 255.255.255.0 10.11.100.0 255.255.255.0
pager lines 24
mtu outside 1500
mtu inside 1500
ip verify reverse-path interface outside
no failover
asdm image flash:/asdm-505.bin
no asdm history enable
arp timeout 14400
global (outside) 10 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 10 10.10.100.0 255.255.255.0
access-group 101 in interface outside
route outside 0.0.0.0 0.0.0.0 192.168.0.254 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
username admin password <pass> encrypted privilege 15
aaa authentication ssh console LOCAL
http server enable
http 192.168.0.75 255.255.255.255 outside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto map outside_map 20 match address outside_cryptomap_20
crypto map outside_map 20 set peer 192.168.0.125
crypto map outside_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map interface outside
isakmp enable outside
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash sha
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
tunnel-group 192.168.0.125 type ipsec-l2l
tunnel-group 192.168.0.125 ipsec-attributes
pre-shared-key *
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 5
ssh version 2
console timeout 0
management-access inside
dhcpd address 10.10.100.50-10.10.100.253 inside
dhcpd dns 192.168.0.10 192.168.0.11
dhcpd lease 3600
dhcpd ping_timeout 50
dhcpd domain domain1.lan
dhcpd option 3 ip 10.10.100.1
dhcpd enable inside
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map global_policy
class inspection_default
inspect dns maximum-length 512
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
Cryptochecksum:5c1a4f383a67a8277a6d95a0b03cc642
: end


pix515# show run
: Saved
:
PIX Version 7.2(2)
!
hostname pix515
domain-name domain2.lan
enable password <pass> encrypted
names
!
interface Ethernet0
speed 100
duplex full
nameif outside
security-level 0
ip address 192.168.0.125 255.255.255.0
!
interface Ethernet1
speed 100
duplex full
nameif inside
security-level 100
ip address 10.11.100.1 255.255.255.0
!
interface Ethernet2
shutdown
no nameif
no security-level
no ip address
!
passwd <pass> encrypted
ftp mode passive
dns server-group DefaultDNS
domain-name domain2.lan
access-list outside_20_cryptomap extended permit ip 10.11.100.0 255.255.255.0 10.10.100.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 10.11.100.0 255.255.255.0 10.10.100.0 255.255.255.0
pager lines 24
mtu outside 1500
mtu inside 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image flash:/asdm-522.bin
no asdm history enable
arp timeout 14400
nat (inside) 0 access-list inside_nat0_outbound
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
no eou allow clientless
username admin password <pass> encrypted privilege 15
aaa authentication ssh console LOCAL
http server enable
http 192.168.0.75 255.255.255.255 outside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto map outside_map 20 match address outside_20_cryptomap
crypto map outside_map 20 set pfs
crypto map outside_map 20 set peer 192.168.0.124
crypto map outside_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
tunnel-group 192.168.0.124 type ipsec-l2l
tunnel-group 192.168.0.124 ipsec-attributes
pre-shared-key *
telnet timeout 5
ssh 192.168.0.75 255.255.255.255 outside
ssh timeout 5
ssh version 2
console timeout 0
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:27fbf18a51bc95717770e8d39fe5c9e5
: end

[chris898]

By default, a PIX allows NO traffic to go from a high security interface to a low-security one. To do so requires two things:

1) a translation (this is set up by your NAT statements)
2) an access rule (which is incomplete)

You need to add statements to your access list 101 that permits ISAKMP traffic from the other end of the connection. This will be IP protocols 49 (ESP) and 51 (AH), and UDP port 500. It also needs to permit any other traffic that you want to allow.

Adding the command "sysopt connection permit-ipsec" also makes setting up VPNs easier, as it allows any IPSec-encapsulated packet to bypass the inbound ACLS and be processed by the VPN daemon.

[AlexR909]

the NAT translation and Access rules I've put in are just for basic NATin'g I tried to just nat it without those access-list 101 statements and i can't seem to talk to anything behind ethernet0.

thanks for the tip on the ports though I'll add those up and do some testing.