topic Re: PIX site to site vpn issues in Network Security

PIX site to site vpn issues

handley88 — Mon, 11 Mar 2019 14:53:13 GMT

Hi,

My IPSEC VPN tunnel between two pix's has gone down and after trying

the normal reboots I attached a syslog to one end and got a ipsec

isakmp phase 1 retransmit message

cisco doesnt really explain the causes of this.

Does anyone have any ideas what this means ? or the causes ?

I have attached both configs

Thanks

Alex

Re: PIX site to site vpn issues

andrew.prince — Thu, 19 Feb 2009 09:44:21 GMT

try "debug crypto isakmp"

then post the output

Re: PIX site to site vpn issues

lreger — Sat, 21 Feb 2009 06:22:53 GMT

Where you able to get the VPN's back up?

Re: PIX site to site vpn issues

handley88 — Sat, 21 Feb 2009 13:39:31 GMT

Im still having problems.

here is the debug output requested.

I noticed this line in the debug

crypto_isakmp_process_block:src:81.129.167.199, dest:Local IP of PIX spt:50996 dpt:500

The IP seems to below to BT, is this normal ?

Thanks

Alex

Re: PIX site to site vpn issues

andrew.prince — Sat, 21 Feb 2009 14:30:47 GMT

check the following:-

1) You have the same IKE config at both sites.

2) You have configure the correct IP address for the remote peer on both sites.

The capture log indicates you are not neogtiating IKE correctly, either due to hash/encryption mis-match or incorrect peer IP address or both.

HTH>

Re: PIX site to site vpn issues

handley88 — Tue, 24 Feb 2009 11:35:48 GMT

Hi, I have checked the above with no luck. could a nat/router problem cause that output ?

also what does this line mean ?

crypto_isakmp_process_block:src:81.129.167.199, dest: a.a.a.a spt:50996 dpt:500

Many Thanks

Alex

Re: PIX site to site vpn issues

andrew.prince — Tue, 24 Feb 2009 11:42:44 GMT

it is possible if you are not directly connecting to the internet, and there is a NAT device in between.

It says that it is blocking an ISKMP packet from 81.129.167.199 to a.a.a.a

Re: PIX site to site vpn issues

handley88 — Thu, 26 Feb 2009 11:47:03 GMT

Thanks, I think the actual config's are ok so im going to try swapping the router.

Re: PIX site to site vpn issues

handley88 — Fri, 27 Feb 2009 09:47:06 GMT

hi, changed the router over and now receive this error

ISAKMP (0): speaking to another IOS box!

ISAKMP (0:0): Detected NAT-D payload

ISAKMP (0:0): NAT does not match MINE

ISAKMP (0:0): Detected NAT-D payload

ISAKMP (0:0): NAT does not match HIS hash

Alex

Re: PIX site to site vpn issues

andrew.prince — Fri, 27 Feb 2009 15:40:07 GMT

That is not good - you need to do the below:-

1) Check your config

2) Check your config

I say it twice as about 99% of network related issues are configuration based.

HTH>

Re: PIX site to site vpn issues

handley88 — Thu, 05 Mar 2009 13:31:17 GMT

Thanks for all your help.

The issue was that the remote boarder router although in its config said it was not doing any NAT it actually was. As soon as the router was swapped out the tunnel came back up.

Alex

Re: PIX site to site vpn issues

andrew.prince — Thu, 05 Mar 2009 13:34:55 GMT

np - glad to help.