How about the Nexus 5672? At least found no reference to MacSec in the docs, only TrustSec. ... View more

I just read in this forum that the 'Allow Local LAN access'-parameter doesn't have any effect with the PIX so you'll have to forget about that option. You need to use split-tunneling, include all ranges used in the main office which should be accessible for the clients: access-list split_tunnel_acl permit ip MAINOFFICE-NET1 255.255.255.0 any access-list split_tunnel_acl permit ip MAINOFFICE-NET2 255.255.255.0 any vpngroup split-tunnel split_tunnel_acl It does mean any other traffic will be sent out unencrypted, you can prevent this from happening by using appropriate access-lists. ... View more

You may be missing static mappings between the interfaces? ... View more

Maybe you used different vpngroups for the both types of clients with different VPN-pools? And maybe one of these ranges is not routed internally? ... View more

Have you configured a firewall policy which is handled differently by the client. If there a difference in the split-tunnel configuration? ... View more

If you have used the statement 'sysopt connection permit-ipsec' IPSec traffic will pass even if your access-list denies it. So just disable this with 'no sysopt connection permit-ipsec'. You now should be able to specify exactly what IPSec traffic you want to allow. ... View more

How's the webserver connected? Using a cross-cable? If so check the speed/duplex settings at both sides, make sure they are set to the same settings at both sites. Setting them both to auto-negotiation should be fine. ... View more

This is probably related to a router performing PAT at the remote location. The router maybe translates all PPTP-sessions to the same IP-address and source-port, confusing the PIX. Many types of soho-routers are able to handle outgoing PPTP sessions, verify if this one does. In the case of an IPSec remote access VPN the solution would be to use PIX software 6.3, activate NAT-T (isakmp nat-traversal). Activate the 'Transparent tunneling'-option in the VPN-client. ... View more

This seems to be your problem: *Mar 1 01:51:55.755: IPSEC(validate_transform_proposal): invalid local address 22.81.27.2 This is probably the address you use on the loopback interface? ip nat inside source list 1 interface Loopback0 overload You need to define which traffic you want to encrypt: ip access-list extended VPNRANGE permit ip any 192.168.200.218 0.0.0.1 permit ip any 192.168.200.220 0.0.0.0 deny ip any any crypto dynamic-map mapadinamico 10 set transform-set mitrans match address VPNRANGE ... View more

The reason clear arp helped may be because you have overlapping translations: You have assigned a pool for outgoing traffic: global (outside) 1 xxx.xxx.xxx.14 netmask 255.255.255.240 And you also have addresses from this pool assigned to servers: static (inside,outside) xxx.xxx.xxx.3 192.168.1.10 netmask 255.255.255.255 0 0 static (inside,outside) xxx.xxx.xxx.4 192.168.1.9 netmask 255.255.255.255 0 0 static (inside,outside) xxx.xxx.xxx.5 192.168.1.11 netmask 255.255.255.255 0 0 To prevent problems in the future I think you better change the global line to: global (outside) 1 interface ... View more

I can't think of any way to get this to work other than buying another 515E along with failover licenses. That way you have a completely redundant firewall setup with two different links. ... View more

On device B you using both access-lists and conduits, get rid of the conduit-statementsm, esp and isakmp are already included in the access-list. You don't need the following statement: access-list acl_out permit tcp host 1.1.1.1 host 2.2.2.2 eq 500 In this case you don't need the following statement, because you're not terminating IPSec traffic on this device: sysopt connection permit-ipsec Take at the log to see what's happening. Do the crypto map access-lists match traffic, use 'sh access-list' and look at the counters ... View more

Please try another wireless adapter, because there seem to be problems with this specific 3Com card (at least I have! :-). Switching over to another card solved the problem. ... View more