VPN Dynamic Crypto Map not working

[john.graves]

I am forced by the ISP to configure an agressive mode VPN. I am now being told by a cisco tech that I cannot do this.

I left the VPN configuration on the remote end alone...I confirmed that the remote PIX ipsec SA DOES contain the current ip address of the outside interface.

The tech said that I should not have a transform-set definition in the dynamic map but the guide says to do so??? Is this the problem??

John G.

[aacole]

John,

What device are you trying to configure, I read your message as saying you are trying to make a VPN to a remote PIX. But I'm sure the PIX only supports IKE main mode, not aggressive mode.

If its a PIX then the transform set is applied as shown in this configuration snipit.

crypto ipsec transform-set VPN-CLIENT esp-aes-256 esp-md5-hmac

crypto dynamic-map CLIENT-MAP 10 set transform-set VPN-CLIENT

crypto map VPNMAP 10 ipsec-isakmp dynamic CLIENT-MAP

crypto map VPNMAP interface outside

Andy