IPSec through PIX

[e-see]

I have a 26xx router behind a PIX thats sets up a VPN to an outside router> I can ping the remote IP .address on the LAN at the remote site but the remote site cannot ping the network off the inside router behind the PIX. I see the IPSec peers okay. When I do sh crypto ipsec sa on either router I only packets at one side:

#pkts encaps: 10, #pkts encrypt: 10

#pkts decaps: 0, #pkts decrypt: 0

and on the other router:

#pkts encaps: 0, #pkts encrypt: 0

#pkts decaps: 10, #pkts decrypt: 10

They both only see one side. Suggestions?

[paddyxdoyle]

Im not too sure what's going on from your description but the things to check are

Are your crypto access-lists mirrored on your VPN routers?

Is your PIX allowing IPSEC from inside to outside and outside to inside (esp and isakmp). This needs to be configured either in your access-lists or you can use the "sysopt connection permit-ipsec" command which enables IPSEC traffic to bypass access-list filtering.

HTH

Paddy