am having trouble getting a PIX to PIX vpn working. It's between a pix-506 firmware 6.1(1) and a pix-506 firmware 5.1(1). This is what I get when I have debug crypto ipsec, and debug crypto isakmp enabled and I try to ping from pixA to pixB:
VPN Peer: ISAKMP: Added new peer: ip:65.114.226.162 Total VPN Peers:1
VPN Peer: ISAKMP: Peer ip:65.114.226.162 Ref cnt incremented to:1 Total VPN Peer
s:1
ISAKMP (0): beginning Main Mode exchange
crypto_isakmp_process_block: src 65.114.226.162, dest 63.230.113.162
OAK_MM exchange
ISAKMP (0): processing SA payload. message ID = 0
ISAKMP (0): Checking ISAKMP transform 1 against priority 1 policy
ISAKMP: encryption DES-CBC
ISAKMP: hash MD5
ISAKMP: default group 1
ISAKMP: auth pre-share
ISAKMP: life type in seconds
ISAKMP: life duration (basic) of 1000
ISAKMP (0): atts are acceptable. Next payload is 0
ISAKMP (0): SA is doing pre-shared key authentication using id type ID_FQDN
return status is IKMP_NO_ERROR
crypto_isakmp_process_block: src 65.114.226.162, dest 63.230.113.162
OAK_MM exchange
ISAKMP (0): processing KE payload. message ID = 0
ISAKMP (0): processing NONCE payload. message ID = 0
ISAKMP (0): processing vendor id payload
ISAKMP (0): speaking to another IOS box!
ISAKMP (0): ID payload
next-payload : 8
type : 2
protocol : 17
port : 500
length : 27
ISAKMP (0): Total payload length: 31
return status is IKMP_NO_ERROR
crypto_isakmp_process_block: src 65.114.226.162, dest 63.230.113.162
OAK_MM exchange
ISAKMP (0): processing ID payload. message ID = 0
ISAKMP (0): processing HASH payload. message ID = 0
ISAKMP (0): SA has been authenticated
ISAKMP (0): beginning Quick Mode exchange, M-ID of -1838113416:92709d78IPSEC(key
_engine): got a queue event...
IPSEC(spi_response): getting spi 0x97b8112(159088914) for SA
from 65.114.226.162 to 63.230.113.162 for prot 3
return status is IKMP_NO_ERROR
crypto_isakmp_process_block: src 65.114.226.162, dest 63.230.113.162
OAK_QM exchange
oakley_process_quick_mode:
OAK_QM_IDLE
ISAKMP (0): processing SA payload. message ID = 2456853880
ISAKMP : Checking IPSec proposal 1
ISAKMP: transform 1, ESP_DES
ISAKMP: attributes in transform:
ISAKMP: encaps is 1
ISAKMP: SA life type in seconds
ISAKMP: SA life duration (basic) of 28800
ISAKMP: SA life type in kilobytes
ISAKMP: SA life duration (VPI) of 0x0 0x46 0x50 0x0
ISAKMP: authenticator is HMAC-MD5
ISAKMP (0): atts are acceptable.IPSEC(validate_proposal_request): proposal part
#1,
(key eng. msg.) dest= 65.114.226.162, src= 63.230.113.162,
dest_proxy= 192.168.1.0/255.255.255.0/0/0 (type=4),
src_proxy= 192.168.0.0/255.255.255.0/0/0 (type=4),
protocol= ESP, transform= esp-des esp-md5-hmac ,
lifedur= 0s and 0kb,
spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x4
ISAKMP (0): processing NONCE payload. message ID = 2456853880
ISAKMP (0): processing ID payload. message ID = 2456853880
ISAKMP (0): processing ID payload. message ID = 2456853880
ISAKMP (0): Creating IPSec SAs
inbound SA from 65.114.226.162 to 63.230.113.162 (proxy 192.168.1.
0 to 192.168.0.0)
has spi 159088914 and conn_id 4 and flags 4
lifetime of 28800 seconds
lifetime of 4608000 kilobytes
outbound SA from 63.230.113.162 to 65.114.226.162 (proxy 192.168.0
.0 to 192.168.1.0)
has spi 1010433820 and conn_id 3 and flags 4
lifetime of 28800 seconds
lifetime of 4608000 kilobytesIPSEC(key_engine): got a queue event...
IPSEC(initialize_sas): ,
(key eng. msg.) dest= 63.230.113.162, src= 65.114.226.162,
dest_proxy= 192.168.0.0/255.255.255.0/0/0 (type=4),
src_proxy= 192.168.1.0/255.255.255.0/0/0 (type=4),
protocol= ESP, transform= esp-des esp-md5-hmac ,
lifedur= 28800s and 4608000kb,
spi= 0x97b8112(159088914), conn_id= 4, keysize= 0, flags= 0x4
IPSEC(initialize_sas): ,
(key eng. msg.) src= 63.230.113.162, dest= 65.114.226.162,
src_proxy= 192.168.0.0/255.255.255.0/0/0 (type=4),
dest_proxy= 192.168.1.0/255.255.255.0/0/0 (type=4),
protocol= ESP, transform= esp-des esp-md5-hmac ,
lifedur= 28800s and 4608000kb,
spi= 0x3c39ff1c(1010433820), conn_id= 3, keysize= 0, flags= 0x4
VPN Peer: IPSEC: Peer ip:65.114.226.162 Ref cnt incremented to:2 Total VPN Peers
:1
VPN Peer: IPSEC: Peer ip:65.114.226.162 Ref cnt incremented to:3 Total VPN Peers
:1
return status is IKMP_NO_ERROR
As far as I can tell everything looks good, but for some reason I get Request times out's.
Here is the output when I type show crypto ipsec sa:
interface: outside
Crypto map tag: transam, local addr. 63.230.113.162
local ident (addr/mask/prot/port): (192.168.0.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
current_peer: 65.114.226.162
PERMIT, flags={origin_is_acl,}
#pkts encaps: 3, #pkts encrypt: 3, #pkts digest 3
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0
#send errors 1, #recv errors 0
local crypto endpt.: 63.230.113.162, remote crypto endpt.: 65.114.226.162
path mtu 1500, ipsec overhead 56, media mtu 1500
current outbound spi: 3c39ff1c
inbound esp sas:
spi: 0x97b8112(159088914)
transform: esp-des esp-md5-hmac ,
in use settings ={Tunnel, }
slot: 0, conn id: 4, crypto map: transam
sa timing: remaining key lifetime (k/sec): (4608000/27276)
IV size: 8 bytes
replay detection support: Y
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0x3c39ff1c(1010433820)
transform: esp-des esp-md5-hmac ,
in use settings ={Tunnel, }
slot: 0, conn id: 3, crypto map: transam
sa timing: remaining key lifetime (k/sec): (4607999/27249)
IV size: 8 bytes
replay detection support: Y
As you can see I get a send error, I can't figure out what I am doing wrong.
I used this website to set this up, I didn't deviate except for IP addresses:
http://www.cisco.com/warp/public/110/38.html
Any assistance would be much appreciated.
Thanks,
Chris
