I am trying to setup router to router with a pix in between but am having nat difficulties, see attachment for design and address. I am trying to use Dynamic Multipoint IPSEC
Partial Configs:
Router A
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 5
crypto isakmp key cisco address 0.x.x.x.0.0.0
!
crypto ipsec transform-set asis2s3des esp-3des esp-sha-hmac
!
crypto map map1 10 ipsec-isakmp
set peer 1.1.1.2
set transform-set asis2s3des
match address map1
!
interface Tunnel0
bandwidth 1000
ip address 10.x.x.x.255.255.0
ip mtu 1436
ip nhrp authentication test123
ip nhrp map 10.x.x.x.1.1.2
ip nhrp network-id 100000
ip nhrp holdtime 300
ip nhrp nhs 10.0.5.1
delay 1000
tunnel source GigabitEthernet0/0
tunnel destination 1.x.x.2
tunnel key 100000
crypto map map1
!
interface GigabitEthernet0/0
description $ETH-LAN$$ETH-SW-LAUNCH$$INTF-INFO-GE 0/0$
ip address 1.1.x.x.x.255.0
ip nat outside
ip virtual-reassembly
duplex full
speed 100
media-type rj45
crypto map map1
!
ip nat inside source route-map nonat interface GigabitEthernet0/0 overload
!
ip access-list extended map1
permit gre host 12.x.x.120 host 12.x.x.123
!
access-list 110 deny ip 10.x.x.x.0.0.255 10.0.0.0 0.0.255.255
access-list 110 permit ip 10.x.x.x.0.0.255 any
!
route-map nonat permit 10
match ip address 110
Partial Pix Config:
access-list outside permit esp host 1.1.1.3 host 1.1.1.2
access-list outside permit udp host 1.1.1.3 host 1.1.1.2 eq isakmp
access-list outside permit icmp host 1.1.1.3 host 1.1.1.2
access-list outside permit gre host 1.1.1.3 host 1.1.1.2
access-list outside permit udp host 1.1.1.3 host 1.1.1.2 eq 4500
global (outside) 1 interface
nat (inside) 1 0.x.x.x.0.0.0 0 0
static (inside,outside) 1.x.x.x.168.2.2 netmask 255.255.255.255 0 0
Router B Partial Config
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 5
crypto isakmp key cisco address x.x.x.x.0.0.0
!
crypto ipsec transform-set asis2s3des esp-3des esp-sha-hmac
!
crypto ipsec profile asis2s
set transform-set asis2s3des
!
interface Tunnel0
bandwidth 1000
ip address 10.0.x.x.255.0
no ip redirects
ip mtu 1436
ip nhrp authentication test123
ip nhrp map multicast dynamic
ip nhrp network-id 100000
ip nhrp holdtime 600
no ip split-horizon eigrp 500
delay 1000
tunnel source GigabitEthernet0/0
tunnel mode gre multipoint
tunnel key 100000
tunnel protection ipsec profile asis2s
!
interface GigabitEthernet0/0
ip address 192.168.2.2 255.255.255.248
duplex full
speed 100
media-type rj45
When I debug isakmp on router A i see:
Mar 1 21:12:28.867: ISAKMP (0:268435570): ID payload
next-payloadall : 8
type : 1
address : 192.168.2.2
protocol : 17
port : 0
length : 12
*Mar 1 21:12:28.867: ISAKMP:(0:114:HW:2):: peer matches *none* of the profiles
I would think I should see 1.1.1.2 instead of 192.168.2.2??? Correct?
Thanks for the help!
