pix 501 strange problem

sadok.mouha · ‎08-13-2005

I have a 501 device. I have configured a site 2 site tunnel. It worked for a while (2 days) and then stopped. The problem now is that I'm blocked in Phase 1. My pix send a packet ISAKMP to the other side, the second respond and my pix does nothing when receiving it, strange.

attached is the config and the debug, any help please?

Thanx

jmia · ‎08-13-2005

I presume that you have a pix-to-pix vpn tunnel, if so can you issue the following command on both pix's :

(in config mode)

clear isakmp sa

clear cry ipsec sa

now ping from an internal client to an internal peer client to bring up the vpn tunnel.

Also, why do you have two transform-set statements on your 501?

Let me know how you get on.

Jay

sadok.mouha · ‎08-14-2005

The second transform set is unused and I have removed it and applied clear isakmp sa & clear cty ipsec sa but no changes. When I make difference between the two peers, I received "NO PROPOSAL CHOOSEN", it's ok. the problem is when the two configs are the same, I receives a response from the distant vpn gateway and then my pix ignore it and restarts phase negociation again. Stange !!! I'm blocked :(

jmia · ‎08-14-2005

Use the following document to compare and troubleshoot :

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a0080094761.shtml

Let me know how you get on.

Jay

sadok.mouha · ‎08-15-2005

Thank you. I used this document but no changes. I have changed from 3des to des with the other side and still the same problem. I don't understand why is my pix don't continue phase 1 negociation :(

Any help please?

sadok.mouha · ‎08-15-2005

I have captured packets between my pix (192.168.99.250) who is nated and the distant gateway (xxx.xxx.xxx.xxx public ip). Is the packets are normal? As you can see, my pix ignore the response of the distant gateway.

attaeched s is the debug output.

sadok.mouha · ‎08-16-2005

Thank you for your help during last days. Finaly, It worked :) I reset to factory default and reconfigured the vpn Tunnel. Until now, I don't understand the real problem. I'm going to restore my config (access-list, ...) and see where is the problem.

Thank you again