Hi Jouni, This is strange as is working now after just restarting the comcast router and asa (i had already done this). I think either the ASA or the comcast router is on the way out. Just to reply to some of the things you mention as really don't want this kind of thing happening where i don't have a clue to what went wrong or why is started working again: - I know (well, seems most likely) the hosts had the correct details on the PIX side as other sites can access them (and there are multiple hosts also and would be strange that they all had died) as can also the clients at the pix site. - the pix can see all hosts behind it; there are no routers. it is possible a switch is on it's way out on the pix site though. I presume this network is a production one (is in real use)? Have you changed the ASA outside IP address to private for the purpose of this forum post? Or do you have a NAT device in front of the ASA doing static NAT for ASAs outside interface? This is a production network; i didn't change the outside interface ip address to a private one - it has a router doing static nat; the router is provided by comcast and this is how they provide the router and address range, not allowing you to access or change. With the above info, does it seem likely that it is the asa or comcast router that is having the issues? ... View more

Just a thought but could the asa shun the remote network? ... View more

Hi Jouni, Hmmm, how can i check that? This is an extract fro "sh conn" on the remote pix (192.168.200.253) -  is that what i should be looking at? TCP out 192.168.100.5:135 in 192.168.200.122:4733 idle 0:01:28 Bytes 0 flags saA TCP out 192.168.100.2:135 in 192.168.200.3:4242 idle 0:00:30 Bytes 0 flags saA TCP out 192.168.100.2:135 in 192.168.200.3:4243 idle 0:00:09 Bytes 0 flags saA this is an sh conn extrct from the asa (192.168.100.253) TCP outside 192.168.200.55:135 inside 192.168.100.115:53181, idle 0:00:03, bytes 0, flags saA TCP outside 192.168.200.66:135 inside 192.168.100.115:53180, idle 0:00:02, bytes 0, flags saA Both devices have internet access and don't have any routers behind the firewalls. I believe the problem is to be on the asa not the remote pix (but may be wrong)..... i am the only person with access to the pix and i haven't made a change for around six months but i did make a change to the asa a few days back... ill post the config but i think is a simple one so wonder if it is the hardware... : Saved : ASA Version 7.2(4) ! hostname bosfw enable password 1nbBm6rSIvdi3SGH encrypted passwd 2KFQnbNIdI.2KYOU encrypted names name 192.168.100.0 Network-Boston name 192.168.200.0 Network-London name 192.168.40.0 Network-HongKong name 192.168.101.0 Network-Boston-VPN ! interface Vlan1 nameif inside security-level 100 ip address 192.168.100.253 255.255.255.0 ! interface Vlan2 nameif outside security-level 0 ip address 10.1.10.2 255.255.255.0 ! interface Ethernet0/0 switchport access vlan 2 ! interface Ethernet0/1 ! interface Ethernet0/2 ! interface Ethernet0/3 ! interface Ethernet0/4 ! interface Ethernet0/5 ! interface Ethernet0/6 ! interface Ethernet0/7 ! ftp mode passive dns server-group DefaultDNS domain-name domain.com access-list outside_1_cryptomap extended permit ip Network-Boston 255.255.255.0 Network-London 255.255.255.0 access-list inside_nat0_outbound extended permit ip Network-Boston 255.255.255.0 Network-London 255.255.255.0 access-list inside_nat0_outbound extended permit ip Network-Boston 255.255.255.0 Network-HongKong 255.255.255.0 access-list inside_nat0_outbound extended permit ip Network-Boston 255.255.255.0 Network-Boston-VPN 255.255.255.0 access-list outside_2_cryptomap extended permit ip Network-Boston 255.255.255.0 Network-HongKong 255.255.255.0 access-list vpnuser_splitTunnelAcl standard permit Network-Boston 255.255.255.0 pager lines 24 logging enable logging asdm informational mtu inside 1500 mtu outside 1500 ip local pool VPNDHCP 192.168.101.100-192.168.101.200 mask 255.255.255.0 ip verify reverse-path interface outside icmp unreachable rate-limit 1 burst-size 1 icmp permit any inside asdm image disk0:/asdm-524.bin asdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 0 access-list inside_nat0_outbound nat (inside) 1 0.0.0.0 0.0.0.0 route outside 0.0.0.0 0.0.0.0 10.1.10.1 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute aaa-server CyptoCard protocol radius aaa-server CyptoCard (inside) host 192.168.100.1 key password radius-common-pw password no eou allow clientless http server enable http Network-Boston 255.255.255.0 inside http Network-HongKong 255.255.255.0 inside http Network-London 255.255.255.0 inside http Network-Boston-VPN 255.255.255.0 outside no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA crypto map outside_map 1 match address outside_1_cryptomap crypto map outside_map 1 set peer 62.X.X.X crypto map outside_map 1 set transform-set ESP-DES-MD5 crypto map outside_map 2 match address outside_2_cryptomap crypto map outside_map 2 set peer 116.X.X.X crypto map outside_map 2 set transform-set ESP-DES-MD5 crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map crypto map outside_map interface outside crypto isakmp enable outside crypto isakmp policy 10 authentication pre-share encryption des hash md5 group 2 lifetime 86400 crypto isakmp policy 30 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 telnet Network-London 255.255.255.0 inside telnet Network-HongKong 255.255.255.0 inside telnet Network-Boston 255.255.255.0 inside telnet timeout 5 ssh Network-London 255.255.255.0 inside ssh Network-HongKong 255.255.255.0 inside ssh Network-Boston 255.255.255.0 inside ssh Network-Boston-VPN 255.255.255.0 inside ssh timeout 5 console timeout 0 management-access inside dhcpd auto_config outside ! group-policy vpnuser internal group-policy vpnuser attributes dns-server value 192.168.100.1 8.8.8.8 vpn-tunnel-protocol IPSec split-tunnel-policy tunnelspecified split-tunnel-network-list value vpnuser_splitTunnelAcl default-domain value arete.net tunnel-group 62.X.X.X type ipsec-l2l tunnel-group 62.X.X.X ipsec-attributes pre-shared-key * tunnel-group 116.X.X.X type ipsec-l2l tunnel-group 116.X.X.X ipsec-attributes pre-shared-key * tunnel-group vpnuser type ipsec-ra tunnel-group vpnuser general-attributes address-pool VPNDHCP authentication-server-group CyptoCard default-group-policy vpnuser tunnel-group vpnuser ipsec-attributes pre-shared-key * ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters   message-length maximum 512 policy-map global_policy class inspection_default   inspect dns preset_dns_map   inspect ftp   inspect h323 h225   inspect h323 ras   inspect rsh   inspect rtsp   inspect esmtp   inspect sqlnet   inspect skinny   inspect sunrpc   inspect xdmcp   inspect sip   inspect netbios   inspect tftp ! service-policy global_policy global prompt hostname context Cryptochecksum:cbb7494c7b6b48db5d01a8fc7f1ce042 : end ... View more

Hello Jack, I can confirm the vpn tunnel is being built on both sides. I have also tried restarting the vpn but with no luck. Thanks, Tarran ... View more

Hi Jouni, In reply: - The VPN is up. - The counters also go up per connection attempt - i manage both sides of the vpn and i haven't made changes in atleast a few days.... the asa is a very simple config setup. - i am testing multiple hosts and all seem to come back with syn timeout. I have also restarted both sides of the vpn. Thanks, Tarran ... View more

I'm running ASA 8.4. So i have tried this via the ASDM and the CLI and still no joy and am thinking is something todo with that the ASA has the outside address of "2.2.2.2" but actually "2.2.2.2" is Nat'd to 192.168.0.1 and this is the actual outside interface address... If that makes sense. Remote Outside IP: 1.1.1.1 Local Outside IP: 2.2.2.2 (but Nat'd to 192.168.0.1) The remote l2l pix515e is expecting from 2.2.2.2 ... View more