Concentrator/multiple PIXes

[jreusch]

Two networks behind a concentrator, 10.10.10.x and 192.168.96.x. The Pix is on the 192, and a router with NAT disabled (transparent) routes to the 10.10. Multiple PIX 501s are all in the 192.168.97.x to 192.168.125.x range, no overlaps. Traffic comes in to the concentrator, and to the 192 side, but not to the 10 side, and no traffic back out. Pulling our hair out here. Any help appreciated. Configs will follow if you think you have an idea, or experience in this.

[jackko]

1. on the main office pix, verify whether there is a route pointing to the router for net 10.x.

2. on the router, verify whether the default route is set to the pix interface; or routes pointing to the pix for remote nets.

3. verify the no-nat and crypto acl on concentrator and remote pixes.

e.g. on the remote pix,

access-list no_nat permit ip 192.168.96.0 255.255.255.0

access-list no_nat permit ip 10.10.10.0 255.255.255.0

access-list l2lvpn permit ip 192.168.96.0 255.255.255.0

access-list l2lvpn permit ip 10.10.10.0 255.255.255.0