10-10-2002 04:36 AM - edited 02-20-2020 10:17 PM
Hi, I have configured a VPN tunnel from a PIX to a Cisco 3640. The problem is I can only initiate the tunnel from the PIX side. Once the IPSec SA is created I can ping from either side, but I can only ping from the PIX side initially.
I've triple checked all access-lists but can't see anything wrong.
Any ideas ?
10-10-2002 04:30 PM
If you are sure about the access-list, it could be some firewalling issue.
Since the tunnel is up from the firewall end, the traffic from the router end can already send to the pix end.
If initiating from router end, it could be being blocked by some firewalling/filter inbound to the pix.
Regards,
10-11-2002 01:24 AM
I have found the problem, the access-lists have to match exactly on both ends.
My access-list read:
Router side:
permit ip 10.128.0.0 0.0.255.255 192.168.80.0 255.255.255.0
PIX side:
permit ip 192.168.80.0 255.255.255.0 10.128.1.0 255.255.255.0
permit ip 192.168.80.0 255.255.255.0 10.128.2.0 255.255.255.0
needed to change it to:
router side:
stayed the same.
pix side:
permit ip 192.168.80.0 255.255.255.0 10.128.0.0 255.255.0.0
Now it works in both directions !
Thanks for your help
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide